In what is being described as the largest crypto theft ever, Binance reportedly lost around $6.36 billion in digital assets following a massive breach across ten blockchains on October 29, 2026. The theft was swiftly executed—most of the stolen funds were moved within just 20 minutes of the initial breach. Blockchain security firm TRM Labs has attributed the hack to TraderTraitor, a group believed to be aligned with North Korea known for targeting crypto platforms and financial systems. The attacked party has confirmed a security incident occurred, temporarily suspended withdrawals on several networks, and assured users that their non-affected funds are secure.
How the Attack Played Out
TRM’s analysis shows the hackers used malicious smart contract code—specifically an EIP-7702 delegation mechanism—to steadily drain a hot Ethereum wallet belonging to Binance. Preparations began at least 36 hours in advance, including small test withdrawals via Tornado Cash services. After staging tests on smaller wallets, the attacker deployed an identical scheme against a Binance hot wallet about four hours before the primary heist.
The theft began on the XRP Ledger at approximately 20:05–20:09 UTC, when five Binance wallets were emptied of about 233.46 million XRP. Shortly after, large transfers were made from Solana and Optimism. Around 20:20 UTC, a Binance-controlled Bitcoin wallet dispatched 18,270 BTC, which was then fragmented via peel chains. In Ethereum, a flood of authorizations totaling 50 approvals was sent from Binance’s wallet to an attacker-run sweeper. One of those approvals matched the wallet’s nonce counter and initiated a massive extraction—167,464 ETH and over 63 token types, including 1.615 billion USDT, were siphoned off. Incoming deposits continued to be collected by the same compromised smart contract, and an additional Binance smart-account was used to extract 823 million USDC.
Assets, Countermeasures & Exposure
The assets are valued at the time of transfer: nearly $3.79 billion in Ethereum, $1.47 billion in Bitcoin, and approximately $628 million in Tron. The analysis reflects blockchain activity observed up through 00:30 UTC on October 30, 2026; values may shift with later transactions or price moves. In response, around $2.7 billion of the stolen assets were restricted: stablecoin issuers and network entities froze funds, while Arbitrum’s Security Council reclaimed 8,426 ETH and 74.6 million ARB tokens.
The thief attempted some laundering maneuvers. About $325 million in USDT was converted into roughly 122,300 ETH through market makers or trading contracts, and another tranche—60 million USDT—was deposited into Aave, yielding a loan of nearly 19,760 ETH. TRM emphasizes that tracing these counterparties is crucial for uncovering who played a role, though existing crypto laundering networks like Lazarus may provide some clues.
Preventive Lessons & Technical Signals
TRM Labs recommends several best practices. Exchanges should monitor for unexpected EIP-7702 delegations, segment signing responsibilities across distinct systems and wallet tiers, and maintain robust procedures to revoke approvals. Key indicators of compromise include unanticipated smart contract authorizations on treasury wallets, bursts of consecutive nonce authorizations (as in the 50 approved signatures), repeated funds sweeps of incoming deposits, and the use of peel chains in Bitcoin proceeds.
All told, this incident not only represents a historic financial loss but also signals new levels of operational sophistication in crypto attacks. For Binance and the wider ecosystem, scrutiny over wallet security, permissioned smart contract behavior, and infrastructure integrity just jumped to a whole new level.
Analysis: This hack lays bare the increasingly blurred lines between smart contract vulnerabilities and real-world financial risk. The use of EIP-7702 delegations to hijack hot wallets suggests attackers are now exploiting nuanced Ethereum governance features—not merely unpatched code or phishing. Moving forward, exchanges must treat delegation-based permissions with the same severity as private key access. Investors and regulators should watch closely: how this breach reshapes standards for smart contract auditing, wallet infrastructure, and cross-chain liquidity protection could define the next chapter of crypto security.
