Binance’s $6.3B Exit Was No One-Click Wonder—and the Freezes Are Still Catching Up

Binance confirmed a security incident estimated to have affected about $6.3 billion on Friday, October 30, 2026, making it the largest cryptocurrency theft on record. The exchange said it had reserved more than $6.34 billion in company funds to cover the losses, including $5 billion already held in the same tokens stolen. Binance is purchasing the remaining assets through market and over-the-counter transactions, buying an updated proof-of-reserves report by Monday and targeting the resumption of withdrawals within 40 hours. Deposits are operating normally, while withdrawals remain suspended as the exchange rebuilds and tests its withdrawal infrastructure.

Co-CEO Richard Teng said the attack was more extensive than the initial findings indicated and that a compromised DevOps engineer’s laptop may have provided an initial route into Binance’s systems. “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” Teng wrote. “Our investigation has not attributed responsibility to any individual.” Binance found “additional points of breach,” while reporting: “We have found no evidence of any wallet private key leak.” Teng said the attacker used a self-destruct mechanism to erase tools and traces and exploited Ethereum’s EIP-7702 account-delegation feature to obtain execution authority over a hot wallet without passing through Binance’s normal approval controls.

On-chain estimates of the outflow continued to change as investigators traced transfers across multiple networks. Arkham initially estimated the haul at $6.01 billion from Binance hot wallets on nine blockchains, while TRM Labs assessed it at about $6.36 billion and Chainalysis at about $6.4 billion. Earlier tallies included $5.57 billion across three blockchains—$3.51 billion on Ethereum, $1.44 billion in 18,270 BTC and $630 million on Tron—and approximately $5.643 billion as of October 29, 2026, at 21:22 UTC. At 20:24 UTC, one Ethereum transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT, to a newly created address, before 195,460 ETH was forwarded elsewhere within 15 minutes. The drain continued across Bitcoin, Ethereum, Tron, Solana, XRP Ledger and several layer-2 networks.

Tether and Circle used their token-issuer controls to immobilize portions of the stolen assets. Tether reported freezing more than 1.567 billion USDT, while Circle froze $823 million USDC. Binance later said approximately $3 billion of affected assets had been frozen with assistance from blockchain partners; Arkham reported that issuers had frozen $2.80 billion at one stage. Frozen assets included Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP) and Arbitrum (ARB). Circle CEO Jeremy Allaire said the company was coordinating with law enforcement, while Binance said it was working with the FBI, the U.S. Secret Service and other agencies to trace and recover funds.

TRM Labs, Chainalysis and Singapore-based Pangolin Intelligence linked the attack to North Korea’s TraderTraitor group. TRM Labs said it had “high confidence” in the attribution, citing “robust on and off-chain intelligence,” while Chainalysis cited funds from the Binance theft being commingled with assets from September’s Bitget exploit. On-chain investigator ZachXBT said the mixing of those funds “indicates the same actor is likely behind both incidents.” Blockaid CEO Ido Ben-Natan said the preliminary evidence pointed to compromised signing infrastructure rather than a leaked private key, although EIP-7702 may have helped attackers bypass safeguards and drain assets in one sweep.

Binance said the compromised wallets held its own funds and that customer assets were not affected. “We are committed to covering all hacked losses through our company funds. Your assets are safe,” Teng said, adding that most user assets remain in cold wallets and enter hot wallets only when withdrawals are processed. The exchange pledged to cover losses through its SAFU emergency fund and company funds, revoked the affected authorization, and is working with law enforcement, blockchain intelligence firms and token issuers on recovery efforts. The attack nevertheless rattled crypto markets: Bitcoin fell to about $76,400, ETH traded below $2,200, BNB fell below $700, and more than $1.33 billion in leveraged positions were liquidated.