Lucky Nyathi | PiE+ | 31 October 2026
In roughly twenty minutes on Thursday night, an attacker drained Binance hot wallets across ten blockchains. It is now the biggest crypto theft on record. Here is how it worked, who is being blamed, and what it means for everyone who keeps money on an exchange.
On 29 October 2026, around 20:05 UTC, billions of dollars in crypto started leaving wallets that belong to Binance, the world’s largest crypto exchange. According to blockchain forensics firm TRM Labs, about $6.36 billion was moved out across ten networks: Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. That is roughly four times the $1.5 billion Bybit hack of February 2025, the previous record.
Binance suspended withdrawals on several networks and halted trading while it investigated. Its message to customers: user funds are safe, and the exchange will cover all losses from the hack. Binance itself puts the figure at about $6.3 billion.
How the attack unfolded
This was not a smash-and-grab. TRM’s on-chain analysis shows preparation began at least 36 hours earlier.
- 28 October: the attacker’s operator wallet was topped up with small amounts routed through Tornado Cash, a mixer that hides where crypto comes from.
- Early 29 October: malicious code was deployed and tested on two wallets, then rehearsed in its final form on a third.
- 20:05 to 20:09 UTC: five Binance wallets on the XRP Ledger sent about 233 million XRP to one attacker address.
- From 20:10 UTC: Solana and Optimism wallets followed. At 20:20 a Bitcoin hot wallet sent 18,270 BTC out, and within two minutes a Tron wallet sent more than 612 million USDT.
- About 23:05 UTC: a second wave hit Binance wallets on Avalanche and Polygon.
Most of the value came from Ethereum, around $3.79 billion, followed by Bitcoin at about $1.47 billion and Tron at about $628 million.
The technical bit: a hot wallet turned into a sweeper
A hot wallet is an internet-connected wallet that an exchange uses to process customer withdrawals. It has to be online, which is also what makes it a target.
On Ethereum, the attacker used a feature called EIP-7702, introduced in the Pectra upgrade in May 2025. It lets an ordinary wallet hand control of its behaviour to a smart contract by signing an authorization. After that, every call to the wallet runs the contract’s code until the wallet signs something new.
Here is the clever part. Every wallet keeps a running transaction count, called a nonce, and an authorization only works at the exact count the wallet has reached when it executes. Binance’s hot wallet is busy, so its count keeps moving. The attacker therefore submitted one transaction carrying 50 pre-signed authorizations covering consecutive counts, guaranteeing that one would land on the right number. One did. The wallet was now running a “sweeper” contract that obeyed only the attacker.
Three minutes and 24 seconds later, a single instruction emptied it: about 167,000 ETH plus dozens of tokens, including roughly $1.6 billion in USDT. The delegation stayed in place, so the attacker kept sweeping any new funds that arrived through the night.
The bigger clue: this was not just Ethereum
Early theories suggested the Ethereum signatures were phished. That does not explain the rest. In the same window, Binance wallets on nine other chains, each with different key types and signing schemes, sent funds to the attacker through ordinary signed transfers.
TRM’s assessment is that the most likely explanation is a compromise of Binance’s hot wallet signing infrastructure, meaning the attacker could get Binance’s own systems to sign transactions of their choosing across chains. Binance’s initial investigation, as reported by Axios and Al Jazeera, points to a compromised laptop belonging to one engineer, which gave the attacker a way into internal systems. Binance has not yet published a full root cause.
Who is blamed
TRM attributes the attack, with high confidence, to TraderTraitor, North Korea’s elite hacking unit. Chainalysis has also said it assesses the group is likely responsible. The FBI previously named the same group in the Bybit case. TRM points to familiar fingerprints: Tornado Cash funding, staging well before the theft, and signatures prepared in advance and fired off in one burst. Binance has not formally named a culprit in the early reporting, so treat attribution as the assessment of analysts, not a court finding.
The race to freeze the money
The good news, relatively speaking, is how fast the industry reacted. About $2.7 billion has been frozen:
- Tether: roughly 1.77 billion USDT
- Circle: roughly 825 million USDC, frozen in coordination with law enforcement
- Ripple: 40.5 million RLUSD
- World Liberty Financial: 27.8 million USD1
- Arbitrum’s Security Council: about $30 million in ETH and ARB, pulled out of the attacker’s wallet
The attacker raced the clock. TRM says about 325 million USDT was dumped on market makers at a discount of more than 10 percent in exchange for ETH, and another 60 million USDT was posted as collateral on the lending protocol Aave to borrow ETH. Bitcoin was pushed through a peel chain, a technique that splits funds into smaller pieces to make them harder to follow.
The result: the attacker still controls an estimated $2.4 billion, including more than 420,000 ETH and 18,270 BTC, assets that no stablecoin issuer can freeze. Expect attempts to move them through bridges, swap services and over-the-counter brokers in the coming days.
Market and industry fallout
Bitcoin dropped about 5 percent after the news, to below $80,000. Analysts quoted by Al Jazeera warned that a hit to confidence in a giant centralised exchange can spill over to retail investors everywhere. The hack also lands in a rough month for cybersecurity, which Axios has labelled “Black October” after a run of major breaches.
What it means for African users
Binance has a large footprint on the continent, from peer-to-peer trading to licensed operations in South Africa. We did not find reporting yet on how African accounts specifically were affected, so check Binance’s official channels for status updates. A few sensible habits apply regardless:
- Do not leave more on any exchange than you actively need to trade.
- Turn on app-based two-factor authentication and an anti-phishing code.
- Expect scammers to exploit the chaos with fake “withdrawal recovery” messages. Only use Binance’s official app and website.
What to watch next
- Binance’s full post-mortem and when withdrawals resume on all networks
- Whether the attacker’s remaining $2.4 billion starts moving, and where it surfaces
- Whether exchanges rethink signing infrastructure, tighter limits on hot wallets, and screening for unexpected EIP-7702 delegations
This is a developing story, and figures are as reported by TRM Labs and major outlets as of 30 to 31 October 2026.
