The reported $6.3 billion Binance hack involved suspected malicious EIP-7702 authorizations and multiple wallet drains.
Attackers reportedly converted stablecoins, borrowed through Aave, and moved funds across multiple blockchains.
North Korea-linked group TraderTraitor was reportedly identified as a possible suspect, but attribution has not been independently confirmed.
Binance reported freezing approximately $3 billion in assets and outlined plans to cover losses and restore withdrawals.
On October 29, 2026, Binance suffered one of the largest cryptocurrency thefts in history.
Attackers drained approximately $6.3 billion in digital assets from the exchange’s hot wallets. The theft affected multiple blockchains. Most of the funds were moved within just 20 minutes.
While Binance continues investigating the breach, blockchain researchers have reconstructed several parts of the attack. Here’s what happened, how the attackers moved the funds, and what Binance is doing to recover the losses.
How Did the Binance Hack Begin?
The attack began on October 29, at around 20:05 UTC. According to blockchain intelligence firm TRM Labs , attackers transferred about $6.36 billion from Binance-controlled wallets across ten blockchains.
The most intense period lasted roughly 20 minutes. However, suspicious withdrawals and related transactions continued beyond that initial window.
The attackers targeted hot wallets. These are internet-connected wallets that exchanges use to process deposits and withdrawals. Unlike cold wallets, which are kept offline, hot wallets need frequent access to transaction-processing systems.
(Source:TRM)
This makes their security especially important. Binance initially linked the incident to a potentially compromised laptop belonging to a DevOps engineer.
The suspected compromise may have allowed unauthorized access to internal systems used to process withdrawals.
However, Binance later said investigators had discovered additional points of breach. The company has not yet disclosed the complete entry point or explained how every affected system was compromised.
Importantly, Binance says it has found no evidence that wallet private keys were leaked. That suggests the attackers may have exploited the systems responsible for authorizing transactions rather than simply stealing wallet credentials.
How Was the $6.3 Billion Hack Executed?
One of the most important findings involves Binance’s transaction-signing infrastructure.
These systems authorize cryptocurrency transfers from exchange-controlled wallets.
Investigators found that stolen funds moved through transactions carrying valid wallet authorizations.
The blockchain therefore accepted the transfers as properly signed transactions.
The key question is how the attackers obtained those authorizations.
The Ethereum EIP-7702 Exploit
Investigators identified a particularly unusual method involving Ethereum’s EIP-7702 feature.
Introduced through Ethereum’s Pectra upgrade in May 2025, EIP-7702 allows a standard Ethereum wallet to temporarily operate using smart-contract code. The feature supports advanced wallet functions, including automated and bundled transactions. However, it can also become dangerous when a wallet authorizes malicious code.
The attacker prepared a malicious smart contract designed to transfer assets out of an affected Binance wallet. The attacker then obtained 50 valid authorizations associated with a Binance-controlled wallet known as Binance 14.
At 20:20 UTC, those authorizations were submitted onchain. Minutes later, the malicious contract was used to drain the wallet.
A single transaction transferred about 167,464 ETH and 63 different tokens, including around 1.6 billion USDT, to attacker-controlled addresses. The value of this Ethereum operation was estimated at roughly $2.5 billion.
The attacker did not stop after the initial withdrawal. As additional funds arrived in the compromised wallet, the malicious code continued transferring them out. Further sweeps occurred at approx 21:04 UTC and 21:44 UTC.
(Source:TRM)
The unauthorized delegation remained active for nearly four hours before it was revoked. This explains how one compromised authorization mechanism could allow repeated withdrawals.
However, EIP-7702 explains only part of the attack. Funds were also stolen from wallets on Bitcoin, Tron, Solana, and other networks. Those blockchains do not use Ethereum’s EIP-7702 feature.
Investigators are still examining how the attackers gained transaction-signing authority across the wider exchange infrastructure.
Where Did the Stolen Cryptocurrency Go?
Moving billions of dollars out of Binance was only the first stage.
The attackers then began transferring and converting assets before issuers and other exchanges could restrict them.
Blockchain intelligence firms began tracking the funds almost immediately.
Their findings revealed activity across several networks.
The Race to Convert Stablecoins Before They Were Frozen
A significant portion of the stolen funds consisted of stablecoins, including USDT, USDC, and RLUSD. Unlike Bitcoin and Ether, these tokens can be frozen by their issuers under certain conditions.
To avoid having stolen stablecoins frozen, the attackers rushed to convert them into cryptocurrencies such as ETH and TRX.
According to blockchain analytics firm Elliptic , around $786 million in stablecoins was converted before freezes took effect. On Ethereum, the attackers exchanged around 434 million USDT for 160,451 ETH.
The transactions passed through decentralized trading venues, including Uniswap and 1inch, alongside market makers.
Source: Elliptic
The attackers accepted unfavorable exchange rates. Elliptic estimated losses of 12% to 26% against market prices on certain swaps. This suggests the attackers prioritized converting assets quickly over securing the best prices.
How the Hacker Used Aave to Borrow ETH
Another important part of the attack involved decentralized lending protocol Aave. Instead of selling all the stolen stablecoins, an attacker-linked wallet used some of them to borrow ETH.
Between 20:58 and 21:01 UTC on Oct 29, the wallet deposited nearly 60 million USDT into Aave V3 on Ethereum . It then borrowed 19,762 wrapped Ether (WETH), worth about $44.6 million at the time.
This was not a normal token swap. The attacker deposited USDT as collateral and received WETH through a loan.
The USDT remained inside Aave’s lending system, while the borrowed WETH was controlled by the attacker-linked wallet.
The transaction took place about 40 minutes before Aave began freezing its markets. The timing was significant. Borrowing ETH allowed the attacker to obtain another asset without immediately selling the deposited stablecoins.
However, the loan was not free money. The attacker still had debt secured by the USDT collateral. Aave’s risk service providers confirmed that the position remained overcollateralized and subject to normal liquidation rules.
Aave Froze Its Lending Markets
After identifying the attacker-linked borrowing activity, Aave coordinated with its risk and security partners. The protocol temporarily froze lending markets across V3 and V4.
The restrictions prevented users, including the attacker, from opening new supply or borrowing positions. Existing borrowers could still repay loans, and withdrawals and liquidations remained available. However, nine assets temporarily remained at a loan-to-value ratio of zero.
These included USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUT, PAXG, and OP. This prevented those assets from being used as collateral for new borrowing.
Aave confirmed that its smart contracts were not compromised. The restrictions were precautionary measures intended to prevent further misuse of stolen assets.
Bitcoin and TRX Transfers
The attackers also distributed stolen assets across multiple addresses. Onchain investigators identified 18,270 BTC transferred during the attack.
Elliptic reported that the Bitcoin was subsequently distributed across 19 addresses, most holding 1,000 BTC each.
The TRON network also became part of the fund movements. Elliptic identified 234 million USDT exchanged for 638 million TRX through SunSwap.
Arkham Intelligence later tracked repeated TRX transfers involving wallets labeled as Binance hacker addresses. On Oct 30, the largest observed transfers included over 2.40 million, 2.20 million, and 1.49 million TRX.
Together, these three transactions were worth more than $2 million at the valuations shown by the tracker.
BREAKING: Wallets labeled as Binance hacker addresses by Arkham Intelligence are moving millions of TRX across multiple addresses following the $6.3 billion security breach.
Onchain data shows major transfers of 2.40M, 2.20M, and 1.49M $TRX within the past hour, worth approx $2 million combined.
#Binance #TRON #TRX #BinanceHack
— TheNewsCrypto (@The_NewsCrypto) October 30, 2026
Additional transfers continued. However, these movements do not necessarily mean the assets were sold. Some may have involved transfers between addresses controlled by the same attacker.
Selling Other Stolen Tokens
The attackers also held numerous smaller cryptocurrencies. Investigators found that around 150 different stolen tokens were sold for ETH through decentralized exchanges.
These included assets such as UNI, LINK, and AAVE.
The selling added pressure to some token markets.
One reported transaction involved 134.1 million FUN tokens being exchanged for approx 111.5 ETH.
The trade caused a sharp price decline in a low-liquidity Uniswap pool.
Automated Transfers and Fund Obfuscation
Chainalysis also identified unusual transaction patterns. Rather than moving funds directly from one wallet to another, the attackers repeatedly circulated assets through multiple addresses.
Some transfers even returned funds to addresses used earlier. This activity suggests the use of automated transaction systems. Such movements can make blockchain investigations more complicated by creating large transaction trails.
However, blockchain transfers remain publicly visible, allowing investigators to follow funds across supported networks.
How Much of the Stolen Money Has Been Frozen?
Stablecoin issuers and blockchain industry partners moved to restrict stolen assets after the breach. Companies including Tether and Circle participated in freezing affected tokens.
By Oct 30, Binance said approximately $3 billion in assets had been frozen. This represented a substantial portion of the estimated $6.3 billion impact.
However, frozen assets are not the same as recovered funds. The assets must still be verified and returned through the appropriate recovery process.
Elliptic estimated that approx $3.33 billion remained in assets such as BTC, ETH, XRP, and TRX that issuers could not directly freeze at the time of its analysis. These figures may change as investigators identify additional wallets and transactions.
Source: Elliptic
Binance says it is coordinating with law enforcement. Its recovery efforts remain ongoing.
Who Was Behind the Binance Hack?
The identity of the attackers remains a major question. Blockchain intelligence firm TRM Labs has attributed the attack with high confidence to North Korean-linked hackers associated with the TraderTraitor operation.
The firm identified similarities with earlier cryptocurrency thefts. These included the speed of the attack, its technical complexity, and patterns of fund movement.
The operation also drew comparisons with the February 2025 Bybit hack , which involved $1.5 billion. However, Binance has not publicly confirmed the identity of the attackers.
The North Korea attribution remains an assessment by blockchain investigators rather than a final determination by Binance or law enforcement.
Binance’s $6.34 Billion Recovery Plan and Withdrawal Timeline
Binance says its own hot wallets were compromised and customer funds were unaffected.
The exchange has reserved more than $6.34 billion in company funds to cover losses. Of this amount, $5 billion is already held in the affected tokens. This covered nearly 80% of the required replacement assets.
Binance is purchasing the remaining assets through market and OTC deals. The reserve is separate from the about $3 billion in frozen assets.
Source: Binance:
Binance temporarily suspended withdrawals and targeted a phased resumption within 34 hours of its October 31 update, subject to security checks. The exchange also expects updated Proof of Reserves results by Monday, Nov 2. A detailed technical post-mortem is planned once the investigation progresses.
What Happens Next?
Although investigators have reconstructed major parts of the attack, the complete sequence remains unclear.
Binance has not explained how the attackers gained signing authority across its infrastructure or identified every point of compromise.
The recovery of frozen funds and the identification of those responsible also remain unresolved.
The incident highlights a major security risk for cryptocurrency exchanges: protecting private keys may not be enough if attackers can compromise the systems authorized to use them.
The final impact will depend on what Binance’s investigation reveals and how much of the stolen cryptocurrency can ultimately be recovered.
