Binance’s $6.3B Vault Gives Way: $3B Frozen, Signing System in the Hot Seat

Binance completed an initial investigation into an October 29, 2026 security incident that produced an estimated $6.3 billion in unauthorized withdrawals, making it the largest cryptocurrency theft on record. The exchange said it had set aside more than $6.34 billion in company funds to cover losses, including $5 billion already held in the same tokens affected by the incident, and pledged to cover every loss through its SAFU emergency reserve and company funds. About $3 billion of affected assets had been frozen with assistance from blockchain partners.

Binance initially reported that the breach may have started with a compromised DevOps engineer’s laptop, providing access to a service container from which an attacker could submit unauthorized withdrawal transactions. A subsequent investigation uncovered “additional points of breach,” leading co-CEO Richard Teng to describe the incident as “a more complex attack process” rather than a single “one-click” action. The exchange said, “We have found no evidence of any wallet private key leak,” while noting that its investigation had not attributed responsibility to any individual.

On-chain data initially showed at least $5.57 billion leaving Binance-linked wallets, with early estimates including $3.51 billion on Ethereum, $1.44 billion in 18,270 Bitcoin and $630 million on Tron. The first major Ethereum transaction, recorded at 20:24 UTC, sent 167,464 ETH and 63 token transfers to a newly created address, including 1.615 billion USDT. Blockaid researchers said the attacker bundled 50 EIP-7702 authorizations into one transaction targeting Binance 14, delegating the wallet to an unverified sweeper contract that could drain tokens and Ether.

Blockaid co-founder and CEO Ido Ben-Natan said the preliminary evidence pointed to “key misuse,” in which compromised signing infrastructure authorized malicious transactions without exposing the underlying private key. He said EIP-7702 may have enabled the assets to be swept in one operation or helped bypass security checks, but attackers could also have completed the theft through multiple transactions. Binance paused withdrawals, revoked the affected address authorization and worked with law enforcement and blockchain intelligence firms to trace and recover funds. Deposits were operating normally by Friday morning, while withdrawals were expected to resume within 48 hours.

Tether and Circle froze affected stablecoins as the stolen assets moved rapidly across networks, with Arkham later reporting that issuers had frozen $2.80 billion and that $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens could still be moved. TRM Labs attributed the attack to North Korea’s TraderTraitor with “high confidence,” while Chainalysis, which estimated the loss at about $6.4 billion, cited the commingling of stolen Binance funds with proceeds from the earlier Bitget exploit. On-chain investigator ZachXBT said the link indicated that the same actor was likely behind both incidents. Binance said it would publish a detailed technical post-mortem and an updated Proof of Reserves once remediation and verification were complete.