Binance $6.3B Hack: What Happened and Why Self-Custody Matters

On Thursday 29 October 2026, an attacker moved roughly $6.3 billion in crypto out of Binance's hot wallets across about ten blockchains. Binance, the world's largest crypto exchange, has called the estimated total impact "around $6.3B". Blockchain analytics firm TRM puts the figure at about $6.36 billion and says it is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.

This article sets out what Binance and independent investigators have confirmed so far, how part of the theft worked on Ethereum and what the incident teaches anyone who holds crypto. The investigation is still going on, and some details may change.

What happened, in brief

• When: According to TRM, most of the funds were moved in about 20 minutes, starting at 20:05 UTC on 29 October.
• Where: Binance hot wallets, which are internet-connected wallets used to process withdrawals, on around ten blockchains. That includes Ethereum, Bitcoin, Solana, Tron, XRP Ledger and several EVM networks.
• How much: About $6.3 billion, according to Binance.
• Frozen so far: Binance says about $3 billion has been frozen on-chain with the help of blockchain partners.
• Who pays: Binance says it will cover all losses from its SAFU fund and company funds and that user funds are safe. AP reports that the company has reserved more than $6.34 billion of its own funds to cover the stolen assets.
• Service status: Binance temporarily suspended withdrawals while it completes security checks. It later clarified that deposits are unaffected.

How the attackers got in

Binance's initial investigation suggests the incident may have involved a compromised DevOps engineer's laptop. That access allowed the attacker to reach a service container and submit unauthorised withdrawal transactions. Binance says it has found no evidence of any wallet private key leak and will publish a detailed technical post-mortem once the facts are verified.

Binance co-CEO Richard Teng stressed that this was not a simple one-click action. "The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process," he said, adding that the investigation has not attributed responsibility to any individual. Binance has since said it uncovered additional points of breach beyond the laptop, without yet naming them. In a video reported by AP, Teng said the attackers used complex tactics, including a "self-destruct mechanism" that makes the incident harder to investigate.

As an immediate precaution, Binance says it revoked the affected address authorisation, paused withdrawals and brought in law enforcement and blockchain intelligence partners to trace and recover funds.

How the Ethereum part worked: EIP-7702

The most technically striking part of the theft happened on Ethereum, and it involved a feature called EIP-7702. It went live in May 2025 as part of Ethereum's Pectra upgrade. EIP-7702 lets an ordinary wallet sign an "authorisation" that makes it run a smart contract's code as if it were its own. The feature was designed for useful things such as batching transactions and having someone else pay gas.

According to CoinDesk's reconstruction of the on-chain data:

• At about 16:00 UTC the attacker deployed a "sweeper" contract that only their own wallet could operate.
• At 20:20:59 UTC they sent a single transaction carrying 50 authorisations, each signed by the wallet Etherscan labels "Binance 14" and each pointing it at the sweeper. Because the busy hot wallet's transaction counter (its nonce) kept changing, the 50 signatures covered 50 consecutive nonce values. Ethereum accepted the one that matched.
• At 20:24:23 UTC the attacker called the sweeper through Binance 14 and, in one transaction, moved about 167,464 ETH and 63 tokens, including roughly 1.6 billion USDT. That was about $2.5 billion in under four minutes.
• Customer deposits kept being routed into Binance 14, and the attacker swept them out again at 21:04 and 21:44 UTC. TRM says the attacker also used the wallet's borrowed code to pull 823 million USDC from a separate Binance smart wallet.
• The malicious delegation was revoked at 00:10:35 UTC on 30 October, nearly four hours later.

Protos notes that the delegation was mainly a convenience. Other Binance wallets on Ethereum, and the other EVM chains, were drained with ordinary transfers. On Bitcoin, Solana, Tron and other networks that do not use EIP-7702, funds also left through normal signed transfers. The common thread, as CoinDesk puts it, is that the transactions carried valid signatures from Binance-controlled wallets. How the attacker obtained the ability to produce those signatures is still under investigation.

Who is suspected

Binance has not named a culprit and says it is working with law enforcement to identify those responsible. Independently, TRM attributed the attack "with high confidence" to TraderTraitor, a North Korean state-backed unit also tracked as Lazarus Group and APT38, and Chainalysis said it agrees. The FBI attributed the 2025 Bybit hack to the same group, according to AP.

Where the money is now

Freezes have moved fast. TRM says stablecoin issuers including Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB. According to TRM, the attacker raced the freezes by selling USDT and borrowing ETH, and still controls more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze. Binance's own running total of frozen assets is around $3 billion.

Why self-custody matters

None of this means Binance users have lost money. The exchange has said it will cover the losses. But the incident is a clear reminder of how custody works.

1. On an exchange, your access depends on the exchange. When Binance paused withdrawals as a precaution, customers had to wait. That was a sensible security step, but it shows that coins held on any platform are subject to that platform's decisions. In a self-custody wallet, nobody can pause your withdrawals.

2. Concentration creates targets. Exchanges pool customers' coins into a small number of very large wallets. That makes them some of the most valuable targets in the world for well-funded attackers. Thousands of individually held wallets are a far less attractive single prize.

3. "Not your keys" cuts both ways. Self-custody removes exchange risk but moves the security job to you. The same lessons apply at a small scale: protect your seed phrase, use a hardware wallet for larger amounts and keep devices you use for crypto clean.

4. Be careful what you sign, especially EIP-7702 delegations. CoinDesk reports that, within weeks of EIP-7702 launching, market maker Wintermute found that most delegations pointed at copy-pasted sweeper scripts used by thieves. If any site asks your wallet to delegate your account to a contract, or to "upgrade" your account, stop and check. A malicious delegation can expose everything in the wallet, including funds deposited later.

5. Watch for follow-up scams. Big incidents bring fake "refund" sites, fake support agents and phishing emails. Binance has asked users to rely only on its official channels. Nobody legitimate will ask for your seed phrase.

What to do now

• If you hold funds on Binance, follow updates only on Binance's official website and verified accounts.
• Ignore DMs or emails offering compensation, refunds or "account verification". They are very likely scams.
• If you use a self-custody wallet, review token approvals and any account delegations, and revoke what you do not recognise.
• Read our guide to non-custodial wallets if you are considering self-custody for the first time.

This article reflects what Binance and the sources below had reported by 31 October 2026. Binance has said it will publish a detailed post-mortem once its investigation is complete.

Sources

1. Binance – Security Incident Update (2026-10-30)
2. AP News – What to know about the $6.3B hack on Binance
3. CoinDesk – How an Ethereum upgrade helped drain part of Binance's loss
4. BleepingComputer – Binance links $6.3 billion crypto theft to compromised DevOps laptop
5. Protos – How the Binance hack happened on-chain on Ethereum

FAQ

Were Binance customers' funds lost?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. Withdrawals were temporarily suspended while security checks are completed; Binance says deposits are unaffected.

Who was behind the Binance hack?

Binance has not attributed the attack to anyone and says it is working with law enforcement. Blockchain analytics firms TRM and Chainalysis have attributed it to TraderTraitor, a North Korean state-backed hacking unit also tracked as Lazarus Group.

Should I move my crypto off exchanges?

That is your decision and this is not financial advice. The incident is a reminder that funds on any exchange depend on that company's security and policies, while self-custody puts control, and responsibility, with you.

Not financial advice. This article is for general information only and is not financial, investment or tax advice. Crypto-assets are high risk and largely unregulated in the UK; you could lose all the money you put in. Do your own research.