The Attack Unfolds
On October 29, 2026, attackers drained about $6.15 billion from Binance in 31 minutes, making it one of the largest thefts in cryptocurrency history. Binance initially reported losses at $6.3 billion, while blockchain analytics firm BitOK's transaction-by-transaction analysis put the total at $6.15 billion across nine blockchains.
The attackers never obtained Binance's private keys. Instead, they manipulated Binance's own systems to approve the theft, using a compromised DevOps engineer's laptop to submit fake withdrawal orders through a service container within Binance's infrastructure.
Building the Weapon
The attacker prepared the attack using a custom smart contract on Ethereum. Before targeting Binance, they conducted two rehearsals with their own wallets on October 29 between 02:28 and 16:47 UTC to test the tool's functionality.
The final version of the contract had a critical capability: it could execute arbitrary commands on behalf of any wallet that granted it permission. This tailored design suggested the attacker possessed detailed knowledge of Binance's wallet architecture.
The 31-Minute Drain
From 20:04:52 to 20:35:53 UTC on October 29, the attacker emptied Binance hot wallets on XRP Ledger, Solana, Bitcoin, Ethereum, Tron, Base, Optimism, Arbitrum, and Avalanche. The stolen assets included:
- 18,270.2 BTC
- 197,540 ETH
- 2.49 billion USDT
- 823 million USDC
- 233.46 million XRP
- 970,522 SOL
- Dozens of other tokens
Every transfer was signed using Binance's own wallets. BitOK identified the fraudulent transactions by their distinctive patterns: fees 2 to 2.7 times higher than normal, transaction formats that Binance's standard payout software does not use, and fake transfers interspersed between genuine customer withdrawals.
The 50-Key Trick
The most sophisticated element involved Ethereum wallet Binance 14, a continuously active hot wallet processing customer withdrawals. At 20:20:59 UTC, the attacker used Ethereum's EIP-7702 feature to submit 50 permission slips simultaneously, each carrying a different transaction number (nonce). Since the wallet's nonce was constantly changing, only one slip would carry the correct number and be accepted.
When one slip matched, Binance 14 began taking orders from the attacker's contract while continuing to process legitimate transactions normally. Minutes later, a single transaction emptied 65 different tokens worth more than $2.2 billion, including 1.615 billion USDT and 167,464 ETH.
Converting and Concealing
Between 20:30 and 21:14 UTC, the attacker rapidly moved stolen stablecoins into other assets to avoid freezing. On Ethereum, 435 million USDT was swapped into ETH on Uniswap within hours. On Tron, the attacker converted 234 million USDT into 638.2 million TRX through 16 swaps on SunSwap.
The attacker monitored on-chain freeze requests from stablecoin issuers. In one instance, a wallet shifted 130 million USDT just 48 seconds before Tether executed a freeze. However, the attacker hesitated with another wallet and lost nearly 175 million USDT to freezing.
Freezing and Seizure
In total, approximately $2.79 billion was frozen, burned, or seized by various parties:
- Tether froze $1.38 billion in USDT on Ethereum
- Circle froze $823 million in USDC on Ethereum
- Tether froze $378.7 million in USDT on Tron
- Other issuers froze additional stablecoins and wrapped tokens
- BEAM's issuer burned 984 million stolen tokens
- Arbitrum's Security Council seized 8,426 ETH and 74.56 million ARB
Despite these actions, 669 million USDT had already been converted into ETH and TRX.
Continued Control and Potential Link
The attacker retained control of Binance 14 for nearly four hours, repeatedly sweeping new funds as Binance sent routine top-ups to the wallet. Binance did not revoke the delegation until 00:10:35 UTC on October 30.
BitOK identified a significant finding: stolen Binance funds reached an Ethereum address that had already been receiving proceeds from the September 2026 Bitget hack. The attacker routed TRX and USDT through THORChain, a cross-chain swap protocol, to receive ETH at the shared address. By 06:20 UTC on October 30, the address had collected both Bitget-linked and Binance-linked funds before sending them to new wallets.
BitOK noted that both attacks involved breaching internal systems without stealing private keys, and both attackers employed similar tactics: rehearsals, Tornado Cash for funding anonymity, instant conversions of freezable tokens, and activity during UTC+9 working hours. BitOK assessed that the two thefts may be linked to the same North Korean group, though this remains analytical attribution rather than confirmed proof.
Remaining Holdings and Response
As of October 30 at 06:20 UTC, BitOK linked the attacker to approximately $2.95 billion in assets, including 197,460 ETH, 18,270.2 BTC, 233.46 million XRP, about 970,500 SOL, 675.9 million TRX, and 1.61 million AVAX. Bitcoin's public ledger keeps the 18,270 BTC traceable, but no mechanism exists to freeze native coins.
Binance paused withdrawals from its Bitcoin and Tron hot wallets around 20:36 UTC, while deposits continued. The exchange pledged to cover all customer losses from its SAFU emergency fund and its own resources. Across the broader market, $1.58 billion in leveraged positions were liquidated within 24 hours.
Industry Lessons
BitOK identified lessons for cryptocurrency exchanges: the security of private keys alone is insufficient. Exchanges require controls over signing authority, safeguards against suspicious withdrawal instructions, prompt revocation of compromised permissions, and continuous monitoring of asset movements across networks.
