Illustration to comeA colossal vault door stands ajar in the dark. From a small hatch at its base, ten luminous rivers of coins pour out, each bending away toward a different horizon. A single small laptop glows on the floor beside the hatch. Illustration drawn by Antigravity · prompts at the end Explainer · as of Friday 30 Oct 2026, evening (US Pacific) How $6.3 billion walked out of Binance On Thursday 29 October an attacker got Binance’s own systems to sign away crypto on ten blockchains at once: the largest theft on record. Here is what happened, minute by minute, and why the keys never left the vault. $6.3B taken, by Binance’s estimate TRM Labs: $6.36B; Chainalysis: $6.4B 10 blockchains hit at once Ethereum and Bitcoin gave up 83% ~20 min for most of it to leave from 20:05 UTC; last sweep 23:56 ~$3B frozen by stablecoin issuers almost all of it USDT and USDC 4.4× the previous record Bybit, February 2025: $1.46B The short version One laptop, then the signing machine. Binance traced the entry to a DevOps engineer’s compromised laptop. From there the attacker got Binance’s hot-wallet signing system to approve its transactions. No key leaked, and the money left anyway. Wallets on ten chains, with different key types, all signed for the attacker within about half an hour. Issuers froze about $3B before Binance hit pause. Tether and Circle locked stablecoins within the first hour. Bitcoin and ether can’t be frozen. North Korea’s TraderTraitor is the prime suspect. TRM Labs and Chainalysis say so. No government has yet. Binance says customers won’t pay. It will cover every loss. Withdrawals stay paused until about Sunday 1 November. 1 · The laptop2 · The signer3 · Timeline4 · The freeze5 · Laundering6 · Who7 · The record8 · Who pays9 · What’s next 1 · The way in It began on one engineer’s laptop Binance’s first account, on Friday: the incident “may involve a compromised DevOps engineer’s laptop”, which let the attacker into a service container (one boxed-up piece of Binance’s internal software) and from there “submit unauthorized withdrawal transactions”. Hours later co-CEO Richard Teng widened it. The attacker “did not simply use one engineer’s permissions”: there were more breach points, and tooling built to destroy itself. How the laptop was compromised, Binance hasn’t said. Illustration to comeAn engineer’s desk at night, seen from behind an empty chair: a laptop screen glows in an otherwise dark room. Thin threads of light leave the screen and run under a door toward distant server racks. The entry point Binance named first: one engineer’s machine. Image prompt An engineer’s desk at night, seen from behind an empty chair: a laptop screen glows in an otherwise dark room. Thin, almost invisible threads of light leave the screen and run across the floor, under a door, toward rows of server racks in the far distance. Quiet, uneasy mood. “Blaming a single laptop risks confusing the entry point with the full cause.” Pieter Arntz, researcher at Malwarebytes, to Hackread How North Korea’s hackers usually get onto a laptop Background Fake recruiters. In 2024 a LinkedIn “recruiter” sent an employee of the Japanese wallet firm Ginco a “pre-employment test” that was malware. Weeks later the attackers used that foothold to alter a DMM Bitcoin transaction and took 4,502.9 BTC, about $308M (FBI and Japan’s National Police Agency, December 2024). Poisoned developer tools. Bybit’s $1.46B loss in February 2025 began on a Safe{Wallet} developer’s computer. The attackers slipped JavaScript into Safe’s web app that changed what Bybit’s signers approved. Trojanized apps. The group’s name comes from fake crypto-trading apps it sent to employees of blockchain firms (US CISA advisory AA22-108A, April 2022). Malicious packages. In August 2026 North Korean actors hid malware in npm packages that fetched their instructions from the Ethereum blockchain (Hackread). Two days earlier. On 27 October Binance said it had blocked several North Korea-linked intrusion attempts the week before. Nothing public ties them to this breach (Cointegrity). 2 · The mechanism The keys stayed put. The signing machine was hijacked. Exchanges keep most coins offline, plus a working float in hot wallets whose keys live inside an automated signer: an internal service asks, the signer checks the request and signs. Binance says it found “no evidence of any wallet private key leak”. That is what makes this hack unusual. Wallets on ten chains, with different key types and signing schemes, all produced valid signatures for the attacker within about half an hour. TRM Labs’ reading: the attacker could make Binance’s signing system sign “transactions of its choosing across chains”. Follow the attack, step by step ▶ Play the attack 💻Laptop1 A DevOps engineer’s laptop. DevOps engineers build and run the internal systems that move money. Binance says this laptop was compromised. How, it hasn’t said. Binance says 📦Container2 A service container. From the laptop the attacker reached an internal app running in its own sandbox, and submitted withdrawal requests as if it were a legitimate Binance service. Binance says ✍️Signer3 The signer said yes. No key was copied; the attacker controlled what got signed. How its requests got past the signer’s checks is the open question Binance’s post-mortem has to answer. Analysts’ inference: TRM Labs, Blockaid 👛Hot wallets4 Hot wallets on ten chains. The XRP Ledger went first at 20:05 UTC, then Solana, Optimism, Bitcoin, Ethereum, Tron, Arbitrum, Avalanche, Polygon and Base. On Ethereum, one big wallet was turned into attacker-controlled code (EIP-7702, in the deep dive below). On-chain record 🕳️Attacker5 Attacker wallets. About $6.36B arrives, most of it within 20 minutes. Stablecoins are dumped or borrowed against at once; the bitcoin is split into 19 wallets and left alone. On-chain record 🧊Freeze6 The freeze. Tether, Circle, Ripple, World Liberty Financial and Arbitrum’s Security Council lock about $2.7B by 00:30 UTC Friday, about $3B by Friday evening. Bitcoin and ether can’t be frozen. On-chain record Illustration to comeA giant brass machine presses glowing wax seals onto a conveyor of envelopes. Behind it, a safe holding keys stays shut. The shadow of a hand slides extra envelopes onto the belt, and the machine seals those too. The keys never left the safe. The machine that uses them signed whatever it was fed. Image prompt Inside a vast server hall, a giant brass machine presses glowing wax seals onto an endless conveyor belt of envelopes. Behind it, a heavy safe holding keys stays shut and untouched. The shadow of a hand slides extra envelopes onto the belt, and the machine seals those too. Ethereum and Bitcoin wallets gave up 83% of it Ethereum$3.79B Bitcoin$1.47B Tron$628M XRP Ledger$296M Solana$96M Arbitrum, Optimism, Base$39M Avalanche$28M Polygon$10M Value when taken, by chain. TRM Labs, as of 00:30 UTC Friday; it reports Arbitrum, Optimism and Base together. Hot wallets, cold wallets and the signer Background Cold wallets keep their keys offline. Moving money out of them takes people and a ceremony, so most of an exchange’s coins sit there. Hot wallets hold the float that pays customer withdrawals around the clock. Their keys have to sign without a human, inside a signing service (often hardware security modules or multi-party computation). The signer is a machine built to say yes. It signs whatever arrives through the approved request path, after automated checks: limits, allow-lists, policy rules. Capture that path, and the keys work for you without ever being copied. Binance holds roughly $150B for customers (estimates run from $144B to $155B), so the stolen $6.3B is about 4% of it. Why “no key leak” isn’t reassuring Technical A stolen key opens one wallet. Here wallets using two signature algorithms (secp256k1 ECDSA and Ed25519) and separate key stores all signed for the attacker within about 30 minutes: 17 hot wallets in all, by Bitquery’s count. One captured request path explains that; seventeen stolen keys would not. The 50 pre-signed Ethereum authorizations point the same way. Someone holding the key would sign once, at the right moment. TRM reads the batch as a sign that the access was time-limited, or that signatures had to be requested through a system. Not everyone agrees. Mark Karpelès, the former Mt. Gox chief, thinks the attackers probably reached the keys of at least two wallets, and SlowMist’s security chief keeps key theft open. The chain records what was signed, never who asked. EIP-7702: one transaction, $2.5 billion Technical · try it What it is. Since Ethereum’s Pectra upgrade (May 2025), an ordinary wallet can sign an authorization that makes it run a smart contract’s code. It stays that way until the wallet signs another one. The move. At 20:20:59 UTC the attacker sent one transaction carrying 50 authorizations, all signed with the key of “Binance 14”, a large Binance hot wallet. Each pointed the wallet at the attacker’s sweeper contract, which only the attacker could call. Why 50. Every authorization names the wallet’s nonce, its running transaction count. Binance 14 was still paying customers, so the count kept moving and the attacker couldn’t know its value when the transaction landed. It signed a window of 50 guesses, nonces 18,914,775 to 18,914,824. “One matched, which was all the attacker needed” (TRM). Try it: drag to set where Binance 14’s nonce stood when the transaction arrived. Live nonce 18,914,798: guess 24 of 50 matches. Illustrative: which of the 50 guesses matched hasn’t been published. The sweep. At 20:24:23, 3 min 24 s later, one call to the sweeper moved 167,464 ETH, 1.615B USDT and about 60 other tokens, roughly $2.5B. Binance 14 was left with 1 ETH (Blockaid). “Nothing in Ethereum failed” (Cointegrity). The protocol executed valid signatures exactly as specified. Blockaid says its detector flagged the delegation as malicious on sight; it sat on-chain for 3 min 24 s before the sweep. The wallet that kept refilling itself Technical The delegation belonged to the address, not the key. Binance’s deposit system kept consolidating customer deposits into Binance 14, and the attacker swept it again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC. At 21:44 alone it took 200M USDT and 13 other tokens. Inherited rights. Binance 14 owned a Circle smart account, “Binance Hot Wallet 34”. Code running at Binance 14 could use that right too: at 20:41 it pulled out 823M USDC. Circle froze it at 21:04. Rotating keys doesn’t clear it. Only a new authorization from the same wallet, pointing at the zero address, does. Binance sent one at about 00:10 UTC, four hours after the first outflow. 3 · Timeline Four hours, minute by minute Times are UTC, with your own clock beside them. Gold is the attacker, blue is whoever froze funds, black is Binance. ★ marks the key moments. ★ Key moments Everything Attacker Freezers Binance Staging · Wed 28 – Thu 29 Oct Wed morning Three small Tornado Cash withdrawals fund the attacker’s operator wallet. TRM Thu, early Rehearsals. The attack code is tested on the attacker’s own wallets, moving $2–6 at a time. TRM, Blockaid 15:59 UTC The final “sweeper” contract is deployed. Only the attacker can call it. Blockaid The burst · Thu 29 Oct 20:05 UTC First outflow: the XRP Ledger. Five Binance wallets send 233.46M XRP (about $296M) to one address. It hasn’t moved since. TRM ~20:10 UTC Solana and Optimism wallets follow. TRM 20:20 UTC The Bitcoin hot wallet sends 18,270 BTC (about $1.47B), split into round pieces in the same block. TRM 20:20:59 UTC 50 pre-signed authorizations hit “Binance 14”. One matches, and the wallet now runs the attacker’s code. Blockaid ~20:22 UTC Tron hot wallet sends 612.7M USDT and 46.4M TRX. TRM 20:24:23 UTC The sweep: about $2.5B in one call. 167,464 ETH, 1.615B USDT and some 60 tokens. Binance 14 is left with 1 ETH. Blockaid by ~20:36 UTC Eleven hot-wallet keys in 12 minutes. Binance wallets on
