Binance Hit by $6.3B Hack Across Multiple Blockchains

Attackers drained about $6.3 billion in cryptocurrency from Binance’s online wallets on October 29, targeting assets across multiple blockchains. The exchange halted withdrawals, worked with partners to freeze about $3 billion, and pledged to cover customer losses.

Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop. Subsequent findings identified additional breach points. The company has found no evidence of leaked wallet private keys, while blockchain investigators describe an attack on the infrastructure that authorizes withdrawals.

The laptop was an initial lead, not the complete explanation

In its first incident report, Binance said the compromised laptop appeared to have enabled access to a service container and unauthorized withdrawal requests. The exchange later reported additional points of breach and described a multi-stage attack.

Richard Teng said the theft was not explained by one engineer’s permissions or a single action, according to Decrypt. Binance has not assigned responsibility to an individual employee. Investigators have not published how the laptop was compromised or the complete sequence connecting the entry points to the withdrawals.

TRM Labs found ordinary signed transfers on several networks alongside malicious delegated execution on Ethereum. Its assessment points to compromised signing infrastructure. An attacker controlling requests to a signing service would not necessarily need to extract the underlying private keys. Binance’s report of no evidence of key leakage therefore does not establish whether its authorization controls worked correctly.

Transfers started before the main Ethereum sweep

Hot wallets are connected to the internet and hold assets exchanges use for withdrawals. TRM traces approximately $6.36 billion in transfers across ten blockchains, valued when the assets left. Bitquery’s reconstruction covers 17 wallets on nine chains. Their scope differs, but both describe coordinated transfers across networks.

• October 29, about 20:05 UTC: Five Binance XRP wallets begin sending assets to one address, according to TRM.
• About 20:20 UTC: A Bitcoin wallet sends 18,270 BTC. Malicious delegation activity appears on Ethereum in the same period.
• 20:24 UTC: The main Ethereum sweep transfers approximately 167,464 ETH and 63 token transfers, including 1.615 billion USDT.
• Later that evening: Additional withdrawals and sweeps continue. Bitquery traces the last Ethereum sweep to 23:56 UTC.

All timeline entries use UTC. Berlin was one hour ahead. The 20:24 Ethereum transaction was part of the attack, not its starting point.

Signed permissions let malicious code run a wallet

TRM reports a batch of 50 pre-signed EIP-7702 authorizations covering consecutive transaction counts. One matched the Ethereum wallet’s current count and delegated execution to attacker-controlled code. The operator then repeatedly called the wallet to transfer assets, including funds arriving after the first sweep.

EIP-7702 lets an ordinary Ethereum account execute delegated smart-contract code after signed authorization. The delegation persists until changed or cleared. This gives delegated code access in the authorizing account’s context. The protocol still requires a valid signature.

The Ethereum delegation explains one transfer mechanism. Other affected networks used ordinary signed transactions, so EIP-7702 alone does not explain the wider breach. The unresolved issue is how the attacker obtained authorization across Binance’s withdrawal infrastructure.

Issuers froze stablecoins while the attacker moved funds

Tether, Circle and other token issuers restricted assets linked to the attack. Arbitrum’s Security Council also intervened on its network. Binance reports approximately $3 billion frozen, while Bitquery’s reconstruction identifies about $2.7 billion frozen or rescued under its own accounting.

Bitquery reports approximately $729 million of stolen USDT converted into ETH and TRX before freezes took effect. Its 06:43 UTC snapshot on October 30 estimated roughly $3.2 billion still held by the attacker. These are dated findings, rather than live balances. Frozen assets have not necessarily been returned, and the different totals do not establish a final net loss.

The containment accounts also differ. Binance says outflows stopped when it paused withdrawals. Bitquery’s chronology records Ethereum sweeps after withdrawal-pause times reported by the press. The accounts have not been reconciled in a published technical postmortem.

TRM attributes the attack to North Korea’s TraderTraitor group with high confidence. Chainalysis also assesses North Korea as responsible, Reuters reported. Those are the firms’ assessments. Binance has not named an attacker.

Withdrawals remain paused as Binance replaces affected tokens

Deposits operate normally, according to Binance’s latest service update. Withdrawals remain suspended while Binance works on the withdrawal service and related addresses. The company’s latest estimate was about 45 hours from the time of its announcement, with exact timing still subject to confirmation. No completed restart had been verified for this report as of October 30 at 14:27 CET.

Binance initially pledged its SAFU fund and company resources to cover losses. It now says more than $6.34 billion in company funds has been allocated, with $5 billion already held in the affected tokens. The remaining assets are being purchased on exchanges and through over-the-counter deals to match the missing token balances. Some purchases take longer because of low liquidity and settlement times.

The allocation excludes the approximately $3 billion frozen on-chain. Replenishing reserves, recovering frozen assets, and restoring withdrawals are separate processes. Binance plans to publish updated proof of reserves after remediation and a full technical report once investigators verify the attack path.