Binance’s $6.3B Exit Test: EIP-7702 Turned the Hot Wallet Into a Very Expensive Dustpan

Binance confirmed a security incident affecting an estimated $6.3 billion in cryptocurrency assets, making it the largest crypto theft on record, after unauthorized withdrawals from its hot wallets on October 29, 2026. Initial on-chain estimates placed the outflow at $5.57 billion, while Arkham later valued the activity at $6.01 billion and Chainalysis and TRM Labs estimated roughly $6.4 billion. The exchange said it had set aside more than $6.34 billion in company funds to cover losses, including $5 billion already held in the same tokens taken during the attack.

Binance co-CEO Richard Teng said the attacker did not simply use one engineer’s permissions and described the incident as “a more complex attack process.” The exchange’s initial investigation indicated that a compromised DevOps engineer’s laptop may have provided access to a service container capable of submitting unauthorized withdrawals, although Binance later reported “additional points of breach.” “We have found no evidence of any wallet private key leak,” Binance said. Teng added that the attack involved a self-destruct mechanism that destroyed tools and traces, while the use of Ethereum’s EIP-7702 delegation feature allowed a hot wallet to execute attacker-controlled smart-contract code without passing through Binance’s normal approval controls.

Blockaid co-founder and CEO Ido Ben-Natan said the preliminary findings pointed toward signing-infrastructure compromise rather than a private-key leak. “It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said. Blockaid identified 50 EIP-7702 authorizations bundled into a transaction targeting Binance 14 and said the affected account was delegated to an unverified sweeper contract. Ben-Natan said attackers could have stolen the funds without EIP-7702, although the feature may have enabled them to bypass security checks and drain assets in one sweep. TRM Labs said ordinary signed transfers were used on nine other blockchains.

Tether froze more than 1.567B USDT linked to the incident, while Circle CEO Jeremy Allaire said the company had frozen more than 800M USDC, with earlier reports placing the Circle freeze at $823 million. Binance later said approximately $3 billion of affected assets had been frozen with assistance from blockchain partners. Frozen assets included Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP) and Arbitrum (ARB). The exchange is working with the FBI, the U.S. Secret Service, law enforcement agencies, blockchain-intelligence firms and token issuers to trace and recover the assets.

TRM Labs attributed the attack to North Korea’s TraderTraitor group with “high confidence,” while Chainalysis CEO Jonathan Levin and on-chain investigator ZachXBT pointed to funds commingling with proceeds from the Bitget exploit. ZachXBT said the commingling indicated that the same actor was likely responsible for both incidents, while Chainalysis assessed the theft at $6.4 billion. Binance said its investigation had not attributed responsibility to any individual and that a detailed technical post-mortem would follow after all facts were verified. Withdrawals remained suspended during a security revamp, deposits resumed operating normally, and Binance targeted a Sunday restart while preparing an updated Proof of Reserves report for Monday.