Hot wallets, cold problem: Binance investigates $6.3B security incident

Binance said on October 30 that it had completed an initial investigation into a “security incident” involving approximately $6.3 billion in unauthorized withdrawals across Bitcoin, Ethereum, Tron and other blockchain networks. The exchange attributed the incident to a compromised DevOps engineer’s laptop, which reportedly provided access to a service container used to submit withdrawal transactions. Binance said it found no evidence of a wallet private-key leak and committed to covering losses through its SAFU fund and company resources.

On-chain estimates initially placed the outflows at $5.57 billion and later at approximately $5.643 billion as of October 29, 2026, at 21:22 UTC. One breakdown listed $3.528 billion on Ethereum, $1.449 billion in 18,270 Bitcoin and $628 million on Tron, with approximately $38 million leaving across Arbitrum, Optimism and Base. Change transactions were excluded from the calculation, which also did not count subsequent transfers and exchange transactions as duplicates.

The first Ethereum transaction at 20:24 UTC sent 167,464 ETH and 63 tokens, including 1.615 billion USDT, to a newly created address. Binance 16 sent another 28,005 ETH to the same address 24 seconds later, while the receiving address forwarded 195,460 ETH, worth roughly $440 million to another fresh address within 15 minutes. An address funded through Tornado Cash had submitted an EIP-7702 delegation for a Binance hot wallet three minutes before the first transfer. Odysseas Lamtzidi, founder of Phylax Systems, explained that EIP-7702 allows a normal wallet to execute delegated code that can authorize later transfers without another wallet signature.

Tether and Circle froze assets connected to the transfers. Early reports put the freezes at approximately $971 million in USDT and $823 million in USDC, or nearly $1.8 billion combined, although some freeze records initially showed pending execution. Tether CEO Paolo Ardoino later said the company froze more than 1.567 billion USDT linked to the incident, while Circle CEO Jeremy Allaire wrote, “Circle is closely tracking reports of a potential exploit involving Binance,” adding that the company froze more than 800M USDC in coordination with law enforcement. Binance later reported that about $3 billion had been frozen through blockchain partners.

Binance co-founder Changpeng Zhao said, “User funds are safe!” and added, “It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).” Zhao, who no longer manages the exchange, said he expected all user funds to be fully covered. Co-CEO Yi He reportedly expects withdrawals to reopen within 48 hours, while users reported withdrawals stuck at processing. Binance has advised customers to check updates through its official app or website, verify complete recipient addresses, use withdrawal allowlists and avoid unofficial links or requests for account information.

TRM Labs attributed the attack to North Korea’s TraderTraitor group with “high confidence,” while Chainalysis co-founder and CEO Jonathan Levin assessed that the group stole $6.4 billion, slightly above Binance’s estimated $6.3 billion impact. Onchain investigator ZachXBT said funds from Binance and the earlier Bitget exploit were commingled at the same address after moving through THORChain, indicating that the same actor was likely responsible for both incidents. Binance said it would publish a detailed technical post-mortem and proof of reserves after remediation and verification were complete.