The Binance hack, October 29, 2026: $6.3B from hot wallets, 50 EIP-7702 signatures and a delegation that stayed live for 3 hours 50 minutes

On the evening of October 29, 2026 (UTC), about $6.3B left Binance hot wallets on ten chains¹². It is the largest crypto theft on record, roughly four times the Bybit hack of February 2025². Stablecoin issuers and networks have frozen about $2.7–3B¹².

The story is still developing. Binance has not published a root cause, and analytics firms disagree on the totals. This post keeps three things apart:

• what we read on Ethereum ourselves: every transaction below is checked against its block³;
• what Binance, TRM, Chainalysis and Blockaid have reported;
• what nobody knows yet.

Data as of October 30, 2026.

In short

• How much. About $6.36B at prices when taken (TRM). Binance says $6.3B, Chainalysis $6.4B¹²⁴.
• Where. Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. Ethereum lost the most, about $3.79B².
• How, on Ethereum. The attacker obtained 50 authorizations signed with a Binance key in advance. They used them to turn the "Binance 14" hot wallet into a contract that obeys only them. 3 minutes 24 seconds later the wallet sent out 167,464 ETH and 1.615B USDT in one transaction³.
• How, on the other chains. Through ordinary signed transfers, no EIP-7702 involved². So the attacker was getting Binance's signing system to sign what they wanted.
• Cause, per Binance. A compromised DevOps engineer's laptop gave access to a service container, from which the attacker submitted withdrawals. Binance found no private key leak⁵⁶.
• Who. TRM and Chainalysis attribute the attack to North Korea's TraderTraitor group²⁴. Elliptic urges caution, because the laundering pattern differs from earlier ones⁶.
• Frozen. Tether about 1.77B USDT, Circle about 825M USDC, plus Ripple, World Liberty Financial and the Arbitrum Security Council².
• Users. Binance says it will cover all losses from its SAFU fund and company funds. Deposits and withdrawals are paused⁵.

Preparation: October 28–29

Everything below is Ethereum, UTC, block time. The attack's operator is 0x7C86…5CA0.

The sweeper is unverified. According to Blockaid, only the operator can call it. It has two functions: one sweeps all ETH and a list of tokens out of the wallet, the other makes the wallet call any contract⁷. The rehearsals moved $2–6 each⁷.

It is the same handwriting as Bybit and KelpDAO: small Tornado Cash withdrawals to fund an operator, staging hours ahead, and signatures obtained in advance and executed in one burst².

How EIP-7702 works, and why 50 signatures

EIP-7702 arrived on Ethereum with the Pectra upgrade in May 2025. The owner of a regular wallet (an EOA) signs an authorization: "my address runs the code of this contract". The authorization goes into a type-4 transaction, which anyone can submit, not only the owner. From then on, calling the wallet runs the contract's code. The delegation stays until the owner removes it⁸.

Each authorization is bound to the wallet's nonce, the number of its next transaction. Binance 14 was paying out user withdrawals at the time, so its nonce moved every minute and could not be predicted. The attacker therefore got signatures for 50 consecutive nonces, 18,914,775 to 18,914,824⁷. One would match, and the network would drop the other 49.

The Ethereum attack, step by step

20:20:59 — the delegation

The operator sent a type-4 transaction with 50 authorizations to Binance 14 (0x28C6…1d60) (0xad99…298b, block 26300753). One matched the current nonce. From that block on, Binance 14 ran the sweeper's code, while Binance kept sending withdrawals from it.

20:24:23 — $2.5B in one transaction

The operator called Binance 14, and the wallet ran the sweeper's function (0x53bd…e2f3, block 26300770). The collection address 0x5227…2f8c received:

• 167,464.25 ETH, as an internal transfer with no Transfer event;
• 1,615,409,498 USDT;
• 62.6M RLUSD, 27.8M USD1, 82 WBTC;
• 45 more tokens, among them PEPE, SHIB, ENA, SAND and WLFI.

Blockaid puts the total at about $2.5B⁷.

20:24:47 — Binance 16 sends on its own

24 seconds later a second hot wallet, Binance 16 (0xDFd5…963d), sent 28,005.6 ETH to the same collection address in an ordinary signed transaction (0x51f2…d39f). Binance 16 had no delegation. According to TRM, it also sent 55.7M USDT and 25.9M RLUSD².

This transfer matters more than it looks. It was signed with Binance 16's key in the normal way. The theory that someone was tricked into signing one authorization does not explain it, and it does not explain the other nine chains either².

20:41 to 23:56 — the wallet stays open

The delegation stayed in place. The operator could take every new inflow to Binance 14 without a new signature. They called the wallet ten more times³:

After the first drain that adds up to 823M USDC, 204M USDT and 5,157 ETH (about $12M). The USDC and USDT landed on a collection address that Tether and Circle had already frozen (see below), so nearly all of it was held. ETH cannot be frozen.

00:10:35 — the delegation is removed

Binance 14 sent a type-4 transaction with one authorization and returned to normal behavior (0xafbf…7209, block 26301896)³. That was 3 hours 46 minutes after the first drain and 3 hours 50 minutes after the delegation.

A fair correction: Tether and Circle froze the post-drain stablecoins anyway, because they arrived at an address that was already frozen. Removing the delegation at 20:30 would have saved about 5,157 ETH, around $12M. That is real money, but next to $6.3B it is a rounding error. The lesson is not the amount but the time: an open wallet stayed open for almost four hours.

The other nine chains

Here we rely on TRM's data and have not checked these chains ourselves².

The XRP Ledger wallets were emptied 15 minutes before the Ethereum delegation. All of these chains saw ordinary signed transfers².

Freezes

We read these events on Ethereum ourselves³:

Tether blocked the collection address 37 minutes after the first drain, Circle 41 minutes after. Totals per TRM²:

• Tether: about 1.77B USDT across Ethereum, Tron, Avalanche and Polygon.
• Circle: about 825M USDC.
• Ripple: 40.5M RLUSD.
• World Liberty Financial: 27.8M USD1.
• Arbitrum Security Council: at 00:08 on October 30 it forced 8,426 ETH and 74.6M ARB, about $30M, out of the attacker's wallet.

At 23:35 Binance put verified freezes at $2.54B, later at about $3B²⁵.

Where the money went

As of October 30, per TRM and Chainalysis²⁴:

• Stablecoins sold before the freeze. About 325M USDT went to market makers through UniswapX and other intent-based contracts for about 122,300 ETH. That is about $2,650 per ETH against a market of $2,300–2,350: the attacker paid about 12% extra for speed. The other 175M USDT from that batch was frozen.
• An Aave loan. A second wallet supplied 60M USDT and borrowed about 19,760 ETH. Aave froze the affected markets.
• Tron. 300M USDT was supplied to the JustLend protocol. Another 200M USDT went through hop wallets and was swapped on Uniswap, and 30M of it was frozen.
• RLUSD. 48M was sold on DEXs, and Ripple froze the remaining 40.5M.
• Bitcoin. The 18,270 BTC is being split through a peel chain into 1,000 and 100 BTC pieces, starting in the same block as the theft.
• Obfuscation. Thousands of transactions cycling between addresses. Many addresses first receive exactly 1 TRX, then funds, then pass them on. Some funds mixed with proceeds of the September Bitget hack.
• What is left. The attacker holds more than 420,000 ETH and 18,270 BTC, about $2.4B, plus smaller amounts on other chains. TRM expects bridges, swap services and OTC brokers next.

The pattern differs from Bybit, where the money mostly went through bridges. Here it goes through large market-maker swaps and lending protocols².

What is known about the cause

• Binance: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop." That gave access to a service container and the ability to submit unauthorized withdrawals. No wallet private key leak was found⁵⁶.
• TRM: the most likely explanation is that the attacker could make Binance's hot wallet signing system sign transactions of their choosing on every chain. The batch of pre-signed authorizations suggests the access was time-limited, or that signatures were requested through the system itself².
• What nobody knows yet: how the laptop was compromised, why the signing system signed an EIP-7702 authorization for a hot wallet, and why the delegation was only removed at 00:10.

What this hack teaches

What works:

1. An alert on large outflows from a hot wallet. A transfer above a $ amount rule on every major token with from = your wallet. Set the threshold above your largest normal withdrawal.
2. A balance alert. Native ETH emits no Transfer. Add the wallet under "Addresses" and create a "Total address balance in $ below threshold" rule.
3. A rehearsed response. Binance 14 had 3 hours 46 minutes between the first drain and the delegation being removed. Removing it is one transaction. Who signs it, through which system, and what to do when that very system is the suspect: decide before the incident.
4. Alerts to whoever holds the lever. Telegram is free. The person who can remove a delegation or stop a wallet should get the alert directly, not through a shared channel.

All alert recipes. How to act in the first minutes is covered in incident response.

We will update this post when Binance publishes a root cause.