Binance says approximately $6.3 billion was affected in the October 29 security incident, making the theft the largest publicly documented crypto hack by value. According to Binance’s official security update Binance security incident update, its preliminary investigation points to a compromised DevOps engineer’s laptop that may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. The exchange says it has found no evidence that wallet private keys were leaked.
Blockchain intelligence firm TRM Labs independently traced approximately $6.36 billion leaving Binance-attributed wallets across ten networks, with most transfers occurring during roughly 20 minutes beginning at 20:05 UTC. TRM attributes the operation with high confidence to North Korea-linked TraderTraitor, although no law-enforcement agency has publicly attributed the Binance breach to the group. TraderTraitor was previously formally linked by the FBI to the 2025 Bybit theft, whose proceeds later appeared in North Korea-linked laundering networks.
EIP-7702 Enabled the Ethereum Sweep
On Ethereum, the attacker used EIP-7702, introduced through the 2025 Pectra upgrade, to delegate a Binance hot wallet’s behavior to attacker-controlled contract code. TRM found 50 pre-signed authorizations covering consecutive nonces, increasing the likelihood that one would remain valid as the operational wallet continued processing transactions. Once a matching authorization executed, the attacker could use a sweeper contract to drain the wallet and subsequently capture assets that arrived at the same address.
EIP-7702 does not explain the full multichain breach. Binance wallets on Bitcoin, TRON, Solana, XRP Ledger, Arbitrum, Avalanche, Optimism, Base and Polygon also produced valid unauthorized transfers, generally through ordinary chain-specific signatures. The cross-chain pattern is why TRM believes the attacker gained access to Binance’s broader hot-wallet signing process rather than merely exploiting an Ethereum feature. Binance has not yet released its final technical post-mortem, so the precise root cause remains provisional.
Stablecoin Freezes Reach About $3 Billion
Issuer intervention sharply reduced the amount the attacker could freely move. TRM recorded Tether freezing about $1.77 billion in USDT and Circle freezing roughly $825 million in USDC, alongside smaller freezes involving RLUSD and USD1. Arbitrum’s Security Council separately removed approximately $30 million in ETH and ARB from attacker control. Binance subsequently said the verified amount frozen on-chain had reached approximately $3 billion, but immobilization should not be confused with recovery or restitution. That distinction has also mattered in earlier USDT freezes involving stolen exchange funds.
The attacker moved quickly to escape issuer controls, exchanging hundreds of millions of USDT for ETH and using stablecoins as collateral on lending protocols before freezes propagated. TRM estimated that the attacker still controlled more than 420,000 ETH and 18,270 BTC, worth roughly $2.4 billion at its observation time, beyond direct stablecoin-issuer freezing authority. Permissionless liquidity infrastructure can complicate containment once stolen assets are converted into non-freezable tokens, a dynamic already visible when Bitget-linked funds moved through THORChain.
Binance says SAFU and company funds will cover the losses and that customer assets remain safe. Deposits are currently operating normally, while withdrawals remain paused as the exchange rebuilds parts of its withdrawal infrastructure and associated addresses; Binance said it expects withdrawals to begin resuming within 48 hours. The immediate unresolved issues are the final root cause, how much of the frozen property can actually be recovered and whether the remaining attacker-controlled assets can be intercepted as laundering continues.
