An open digital vault in a server room, with coins drifting out of it into the aisle
Original AI-generated illustration.

Binance Confirms a $6.3 Billion Hack, With $3 Billion Frozen and 18,270 BTC Out of Reach

NodeWitness Team 10 min read

What began as an unexplained outflow from one Ethereum hot wallet turned out to be a coordinated raid on Binance wallets across ten blockchains. The exchange now puts the damage at about $6.3 billion, and the part that matters most for recovery is the part no issuer can freeze.

Binance's initial investigation suggests the attack started with a compromised laptop belonging to one of its DevOps engineers, which let an attacker reach a service container and "submit unauthorized withdrawal transactions" [20]. The exchange says it has found no evidence of a wallet private key leak, has revoked the affected address authorization and is working with law enforcement and blockchain intelligence firms to trace the funds [20]. It estimates the total impact at around $6.3 billion, says about $3 billion is already frozen on-chain and has pledged to cover all losses from SAFU and company funds [20]. A detailed post-mortem and an updated Proof of Reserves are due once the investigation and remediation are complete [20].

The first public word was far more guarded. Binance initially described "a potential security issue" and said it had not confirmed any impact to user funds [17], co-founder Yi He signed off with "User Funds SAFU" [18], and founder Changpeng Zhao wrote that "it does look like a hack" [19]. Confirmation, a dollar figure and a withdrawal freeze followed within hours.

TRM Labs, which traced every transfer out of Binance-attributed wallets, counts about $6.36 billion taken on ten chains, most of it in roughly 20 minutes on the evening of October 29 [21]. By TRM's reckoning that is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. TRM attributes the attack with high confidence to TraderTraitor, the North Korean unit the FBI held responsible for Bybit, and the BBC reports that Chainalysis reached a similar conclusion [21][22]. Binance did not answer the BBC's questions about a North Korean link [22].

One signer, ten chains

On Ethereum, the attack ran through the EIP-7702 delegation visible on-chain from the start. An outside account ending in 5CA0 submitted a type-4 transaction carrying 50 authorizations signed by the Binance 14 hot wallet's key, one of which went through and turned the wallet into a sweeper contract that took orders only from the attacker [2][21]. Minutes later the contract emptied Binance 14 of about 167,464 ETH, 1.615 billion USDT and dozens of other tokens [1][21]. Binance 16 sent another 28,005 ETH to the same address [5], and the delegation stayed live for hours, sweeping fresh deposits as they landed [6][21]. Hot wallets are the online wallets an exchange keeps funded to pay out customer withdrawals [9].

The other nine chains tell the bigger story. Binance wallets on the XRP Ledger, Bitcoin, Tron, Solana and elsewhere paid the attacker through ordinary signed transfers, using different key types and signing schemes, all within about half an hour [21]. TRM's reading is that the attacker gained the ability to make Binance's hot wallet signing system sign whatever it wanted [21]. That fits Binance's own account of a compromised service submitting withdrawals while no wallet key leaked [20].

The attack was prepared well in advance. The 5CA0 account had been seeded with small Tornado Cash withdrawals at least 36 hours earlier and rehearsed its code on other wallets before using it on Binance [3][7][8][21].

The bitcoin leg

Our first version of this story followed the Ethereum sweep, where no bitcoin was involved. TRM's report has since documented a bitcoin outflow, and the chain bears it out [21][23].

In block 973,732, eleven transactions from a single address sent 18,270.2 BTC to an address with no prior history [23]. The amount and timing match the 18,270 BTC that TRM says left a Binance bitcoin hot wallet, worth about $1.47 billion [21][23]. Inside that same block, the receiving address started breaking the haul into round 1,000 BTC chunks, each sent to a new address [24]. Investigators call this a peel chain, since each hop strips off one layer and passes the remainder along, which makes the trail slower to follow [21].

Binance's deep reserve stayed put. The address chain trackers attribute to its bitcoin cold wallet held 248,597.6 BTC when we checked on October 30, with its last movement on October 25 [13]. The stolen coins came from a hot wallet.

What could be frozen, and what could not

Stablecoin issuers can blacklist addresses in their token contracts, and they moved fast. The main Ethereum receiving address held about 975 million USDT and 823 million USDC when Tether and Circle blacklisted it [4][10][11]. Counting later freezes, TRM tallies about 1.77 billion USDT frozen by Tether, about 825 million USDC by Circle, 40.5 million RLUSD by Ripple and 27.8 million USD1 by World Liberty Financial [21]. Arbitrum's Security Council used its emergency powers to move 8,426 ETH and 74.6 million ARB out of the attacker's wallet [21]. Binance puts the verified total frozen at about $3 billion [20].

The attacker raced the freezes. It sold about 325 million USDT to market makers for roughly 122,300 ETH, accepting a discount of more than 10% [21]. Another of its wallets supplied 60 million USDT to Aave and borrowed 19,762 WETH before Aave froze 175 reserves on its V3 markets across 16 networks and 117 on V4 [25]. Aave's risk team also flagged a fresh inflow of 444,537 AVAX more than two hours after the first drain, a sign the access was still open [25].

Ether and bitcoin have no issuer to call. The receiving address forwarded 195,460 ETH to a new wallet within minutes [12], and TRM counts more than 420,000 ETH and 18,270 BTC, about $2.4 billion, now beyond any issuer's reach [21]. TRM expects those funds to head next for cross-chain bridges, swap services and over-the-counter brokers [21].

The market

Bitcoin's market took the hit in stages. On Binance it fell from about $80,850 before the attack to a low of $76,500 in the early hours of October 30, a drop of more than 5% [14]. Roughly $190 million in bitcoin positions were liquidated in the first hour, mostly longs [15]. The price later recovered part of the loss and stood near $78,650 when this update was written [14].

What it means for someone with money on Binance

For customers, the hack has turned into a wait. As of October 30, Binance had paused withdrawals while it rebuilt its withdrawal service and related address controls, said it expected to resume them within 48 hours and kept deposits open [26][27]. It has promised to make every loss good through SAFU, the emergency fund it last tapped in 2019 to replace 7,000 BTC stolen from a hot wallet [16][20]. Until then, the safest course is the one the exchange itself recommends. Rely on its official channels and treat any message offering refunds or asking for login details as a likely scam [17].

For bitcoin held as long-term savings, the episode adds a new detail to an old rule. Coins on an exchange are an IOU, and this one turned on a single employee's laptop. Coins in a wallet whose keys you hold answer to you alone.

Binance has promised a full technical post-mortem once its investigation closes, and this piece will be updated when it is published.

Sources

Source type in brackets. All times UTC. Accessed October 29 and 30, 2026.

  1. Etherscan, sweep transaction from Binance 14, 20:24:23 UTC, sweep function to 0x5227…2f8c. Also read on Blockscout. (Primary, on-chain)
  2. Etherscan, type-4 (EIP-7702) transaction, 20:20:59 UTC, with 50 Binance 14 authorizations for consecutive nonces, one valid, delegating to contract 0x63e8…6fAe. Binance 14's current code read via RPC: 0xef0100 + 0x63e8…6fAe. (Primary, on-chain)
  3. Etherscan, address 0x7C86…5CA0, activity on October 29, 2026. (Primary, on-chain)
  4. Etherscan, receiving address 0x5227…2f8c. Balances read on Blockscout at 21:10 UTC: 975,066,939 USDT and 823,000,000 USDC; about $2.36 billion across 64 tokens at Blockscout prices. (Primary, on-chain)
  5. Etherscan, 28,005.6 ETH sent from Binance 16, 20:24:47 UTC. (Primary, on-chain)
  6. Etherscan, later outflows from Binance 14: 780 million USDC (20:41 UTC), 43 million USDC (20:59 UTC) and another sweep (21:04 UTC). (Primary, on-chain)
  7. BeInCrypto, Lockridge Okoth, Is Binance Being Hacked? $2 Billion Outflow Puts Customer Funds in Question, October 29, 2026, 20:49 UTC. Tornado Cash funding; comments from Tree News and Spreek. (Secondary, press)
  8. PANews, Binance hot wallet suspected of attack, about $2.5 billion moved out, October 29, 2026, 20:51 UTC. In Chinese. (Secondary, press)
  9. Binance, How and Why Assets Move Between Binance Wallets. (Primary, company)
  10. Etherscan, USDT outflows from the receiver: 500 million to 0x9749…C762 and 200 million to 0x0Ddf…697e, between 20:30 and 20:34 UTC. AddedBlackList events in the USDT contract: receiver (21:01:35 UTC), 0x9749…C762, 0x0Ddf…697e, 0x8d53…639a and 0x7aa4…bfd1 (through 21:12 UTC). (Primary, on-chain)
  11. Etherscan, USDC Blacklisted event for the receiver, 21:04:59 UTC. Also checked with isBlacklisted via RPC. (Primary, on-chain)
  12. Etherscan, 195,460 ETH forwarded to 0x8532…43D4, 20:38:47 UTC; balance unchanged at 21:12 UTC. (Primary, on-chain)
  13. mempool.space, address 34xp4vRoCGJym3xR7yCVPFHoCNxv4Twseo, attributed to Binance by chain trackers. Balance 248,597.6 BTC, last movement October 25, 2026, checked on October 29 and again on October 30 at 06:10 UTC via the mempool.space API. (Primary, on-chain; third-party attribution)
  14. Binance, BTC/USDT candles from its public API. 15-minute candles on October 29: close of $80,395.81 at 20:30 UTC and a low of $78,297.05 in the 20:45 UTC candle. Hourly candles: open of $80,848.64 at 20:00 UTC on October 29, low of $76,500.11 in the 02:00 UTC candle on October 30 and a last price of $78,648 at 06:10 UTC on October 30. (Primary, market)
  15. TRdesk, BTC liquidations, calculated at 20:52 UTC: $190.6 million in one hour; 85.2% longs over 24 hours. (Secondary, market data)
  16. Binance, Binance Security Breach Update, May 7, 2019. (Primary, company)
  17. Binance (@binance), post on X, October 29, 2026, 21:15 UTC (edited 21:16 UTC). (Primary, company)
  18. Yi He (@heyibinance), post on X, October 29, 2026, 21:17 UTC. (Primary, social media)
  19. Changpeng Zhao (@cz_binance), post on X, October 29, 2026, 21:15 UTC. (Primary, social media)
  20. Binance, Security Incident Update, October 29, 2026. Compromised DevOps engineer's laptop, estimated impact of about $6.3 billion, about $3 billion frozen, coverage from SAFU and company funds. (Primary, company)
  21. TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, dated October 29, 2026 (published 02:10 UTC on October 30 per page metadata), with on-chain figures as of 00:30 UTC on October 30. Attribution to TraderTraitor, per-chain outflows, freezes and attacker holdings. Attribution is TRM's assessment. (Secondary, on-chain analysis)
  22. BBC, Osmond Chia, Crypto giant Binance hit by hack suspected to be largest in history, October 30, 2026. Chainalysis assessment and Binance's response on attribution. (Secondary, press)
  23. mempool.space, address bc1q0mtc…2mnm, first active in block 973,732 (20:20:06 UTC, October 29). Received 18,270.2 BTC in 11 transactions from bc1qm34l…7s3h, the largest being 7,636.8 BTC. Attribution of the source to Binance is TRM's; the amount and block match is our own check. (Primary, on-chain)
  24. mempool.space, first 1,000 BTC splits in block 973,732: b1473693…, 50a9d0ab… and following. (Primary, on-chain)
  25. LlamaRisk, Binance Hot Wallet Exploit: Aave's Response, Aave governance forum, October 30, 2026, 00:59 UTC. (Primary, protocol)
  26. FinanceFeeds, Binance Withdrawals to Resume Within 48 Hours, Deposits Back to Normal, October 30, 2026. Quotes posts by Yi He (04:17 UTC) and Binance's main account (04:36 UTC). (Secondary, press)
  27. Cointelegraph, Live Updates: Binance Losses Estimated at $6.3B amid Major Crypto Hack, October 30, 2026. (Secondary, press)

More in Price and market

See all 19 articles in Price and market →

Last updated: October 30, 2026