Binance Hack Explained: How Attackers Drained $6.3 Billion Without Stealing a Private Key

At 8:05 p.m. UTC on October 29, 2026, a security engineer at Binance watched a dashboard fill with withdrawals nobody had approved. Minutes later, an Ethereum hot wallet known as “Binance 14” sent roughly $2.5 billion in a single transaction to an address the company did not recognize. Within twelve minutes, nine more Binance hot wallets across multiple blockchains were sending funds to the same destination.

By the time the outflows stopped, third-party analysts had traced approximately $6.36 billion leaving Binance wallets across ten networks—reportedly the largest crypto theft ever recorded and roughly four times the size of the 2025 Bybit breach.

Binance says customer funds are safe, that it will cover all losses with company funds, and that it found no evidence of a wallet private-key leak. But the leading technical theory is more unsettling: attackers may have compromised the exchange’s transaction-signing infrastructure, making Binance’s own systems authorize the theft.

This article separates confirmed facts from working hypotheses, explains why EIP-7702 amplified the damage, reviews Binance’s security history, covers Michael Saylor’s response, and gives you a practical checklist if you hold funds on Binance or any centralized exchange.

What Happened in the Binance Hack?

Binance reported a major security incident on October 29, 2026, with an estimated impact of approximately $6.3 billion. The exchange halted deposits and withdrawals while its security team, blockchain-analytics partners, stablecoin issuers, and law-enforcement agencies worked to trace and freeze stolen assets.

According to Binance’s initial investigation, the breach may have begun with a compromised DevOps engineer’s laptop. The company said that access may have allowed an attacker to enter a service container and submit unauthorized withdrawal transactions.

Binance also said it had found no evidence of a wallet private-key leak. That distinction matters: a compromised internal system can enable unauthorized withdrawals without necessarily exposing the exchange’s underlying private keys.

The Verified Facts So Far

The scale is difficult to overstate. Reuters reported that the bulk of the theft unfolded in roughly 20 minutes, and blockchain-analysis firms TRM Labs and Chainalysis said the attack pattern resembled prior large thefts attributed to North Korea.

What Happened: A 20-Minute Drain Across Ten Blockchains

Binance suffered a coordinated security incident on October 29, 2026, in which attackers moved an estimated $6.3 billion from the exchange’s hot wallets across ten blockchains, primarily within a 20-minute window that began around 20:05 UTC. Binance’s official update confirmed the estimated impact at “around $6.3B” and said approximately $3 billion had already been frozen on-chain through partners and law enforcement.

The first confirmed outflows hit the XRP Ledger between 20:05 and 20:09 UTC. Five Binance wallets sent 233.46 million XRP to a single attacker address, leaving each wallet at its minimum balance. Solana and Optimism wallets followed shortly after 20:10 UTC.

At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC—roughly $1.47 billion—to an attacker address. That address immediately began splitting the funds into smaller transactions through a “peel chain” technique, a common obfuscation method used to make blockchain tracing harder.

Tron outflows totaled 612.7 million USDT. But the Ethereum drain became the centerpiece of the forensic analysis: Binance 14 sent approximately $2.5 billion in one transaction, then continued sweeping new deposits as they arrived.

Binance temporarily suspended withdrawals as a precaution. Deposits continued operating normally, and co-founder Yi He said withdrawal services were expected to begin resuming within 48 hours.

What Binance Confirmed

The Core Hypothesis: Signing Infrastructure, Not a Stolen Key

The leading technical hypothesis is that attackers compromised Binance’s transaction-signing infrastructure rather than stealing a private key outright. Blockaid co-founder and CEO Ido Ben-Natan described the preliminary assessment as “key misuse”: attackers tricked or compromised a signing system into authorizing malicious transactions without extracting the underlying private key.

Binance’s own initial investigation offers a complementary explanation. The company said the incident may have involved a compromised DevOps engineer’s laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Binance explicitly stated that it found no evidence of a wallet private-key leak.

Why does that distinction matter?

A stolen private key can be rotated. The damage is finite. A compromised signing pipeline, by contrast, signs whatever it is told—as many transactions as the attacker can queue, for as long as access persists.

Think of it this way: a stolen key is a burglary. A compromised signing system is a forged signature on every check in the building.

What Is Signing Infrastructure?

Every crypto withdrawal requires a valid cryptographic signature. Exchanges use signing systems to approve outbound transactions from hot wallets—the online wallets used to process customer withdrawals.

If an attacker gains control of that signing workflow, they do not need to know the private key. They only need the system to produce a valid signature for them.

That is why the possible compromise of a DevOps laptop matters. A DevOps engineer may have privileged access to deployment tools, internal services, containers, and operational infrastructure. A compromised endpoint can become a bridge into systems that ordinary users never touch.

Expert Insight: The most important security question for exchanges is no longer only “Are the keys safe?” It is “Can policy enforcement stop a malicious withdrawal before a valid signature is produced—even when the request appears legitimate?”

How EIP-7702 Turned a Hot Wallet Into a Weapon

EIP-7702 did not cause the Binance hack, but it may have amplified the losses. The Ethereum feature allows an ordinary wallet to delegate execution to a smart contract, effectively letting that contract control aspects of the wallet’s behavior. It was introduced in Ethereum’s Pectra upgrade in May 2025 to support legitimate use cases such as transaction batching and gas sponsorship.

For a hot wallet processing thousands of withdrawals each day, that same flexibility can become a liability.

On-chain analysis suggests the attacker prepared at least 36 hours before the theft. The attacker’s operator wallet received small withdrawals from Tornado Cash starting October 28, then rehearsed the delegate-and-sweep sequence on wallets it controlled.

At 20:20:59 UTC, the attacker submitted a single type-4 transaction containing 50 EIP-7702 authorizations. Each authorization was signed by the Binance 14 hot wallet for consecutive nonces. Because Binance 14 was still processing withdrawals, its nonce kept moving. By preparing signatures for 50 consecutive nonce values, the attacker increased the chance that one would still be valid when the transaction executed.

Forty-nine were invalid. One matched. That was enough.

Three minutes and 24 seconds later, the delegated wallet was instructed to sweep its entire balance—167,464 ETH and 63 tokens, including 1.615 billion USDT—to an attacker-controlled address. The delegation remained active, allowing the attacker to sweep new deposits as they arrived at 20:41, 20:59, 21:04 UTC, and beyond.

Pro Tip: EIP-7702 is not inherently unsafe. The root failure was the attacker’s ability to obtain valid signatures from Binance’s signing system. The lesson for exchanges is that signature policy enforcement must happen before signature generation—not after funds have left the wallet.

Who Is Behind It: North Korea’s TraderTraitor

Blockchain-intelligence firm TRM Labs attributes the attack to TraderTraitor, North Korea’s elite hacking unit, with “high confidence,” based on on-chain and off-chain intelligence. The FBI previously named the same group in connection with the $1.5 billion Bybit hack in February 2025.

Several features of the Binance incident resemble earlier North Korea-linked heists:

• Small Tornado Cash withdrawals funding an operator wallet.

• Staging activity that began well before the theft.

• Signatures obtained in advance, then executed in a single burst.

• Rapid splitting of stolen Bitcoin through peel chains.

• Use of multiple blockchains to complicate tracing and freezing.

The Bybit comparison is not incidental. In that attack, criminals allegedly compromised a Safe{Wallet} developer’s Mac through malicious tooling, hijacked AWS session tokens to bypass multi-factor authentication, and manipulated the transaction interface so signers approved a malicious transaction without realizing it. Blockaid’s Ben-Natan described the two incidents as “very, very similar.”

The pattern is consistent: compromise a human-adjacent device, pivot into the signing workflow, and let the system’s trust in its operators do the rest.

What Did Michael Saylor Say About Binance?

Michael Saylor publicly backed Binance’s commitment to make customers whole. In a post on X on October 30, he said Binance had committed its own balance sheet to covering losses and that he expected the company to deliver. He added that the industry would learn from the incident, strengthen security, and emerge more resilient.

Saylor did not announce a financial contribution from Strategy, nor did he disclose any exposure to Binance. His statement is best understood as institutional signaling: a prominent Bitcoin advocate publicly affirming that Binance’s remediation plan appeared credible at a moment when confidence was fragile.

The numbers behind Binance’s commitment matter. The exchange reportedly set aside more than $6.34 billion in corporate funds, including $5 billion already held in the exact cryptocurrencies affected. The remainder was being acquired through market and over-the-counter channels, a process that can take longer for less-liquid tokens. Binance also committed to publishing an updated Proof of Reserves once remediation is complete.

Pro Tip: Separate three claims when evaluating an exchange after a breach: “customer funds are safe,” “we will cover losses,” and “we have identified the root cause.” They are related, but they are not the same guarantee.

Binance’s Security History: A Pattern of Escalation

This is not Binance’s first major security event. The company’s history helps explain why the 2026 incident has drawn such intense scrutiny.

The SAFU fund has also evolved. In early 2026, Binance reportedly converted roughly $1 billion in stablecoins into 15,000 BTC, committing to replenish the fund if its value fell below $800 million because of price declines. By October 2026, the fund held more than $1.27 billion in Bitcoin.

That is a meaningful buffer—but it is only about one-fifth of the estimated impact of this incident. That is why Binance emphasized that its corporate balance sheet, not SAFU alone, is backing the shortfall.

Are Binance Customer Funds Safe?

Binance has repeatedly said customer funds are safe and that it will cover every loss. Co-CEO Richard Teng stated, “Your money is safe and we’re covering every loss,” while the company said it had set aside approximately $6.34 billion internally to cover the incident.

Binance also said it expected to resume withdrawal services within 48 hours, though the status of the remaining roughly $3.3 billion in affected assets was not immediately clear.

For users, the safest interpretation is cautious: Binance has made a strong public commitment, but the final outcome depends on completed investigations, asset recovery, and the exchange’s ability to honor its coverage pledge without broader financial strain.

Binance has stated that user funds are safe and that all losses will be covered by the SAFU fund and company funds. But “safe” is not the same as “accessible,” and the temporary withdrawal suspension is a reminder that keeping assets on an exchange means accepting platform-level custody risk.

Here is what to do, in order:

1. Verify your account activity, not just the headlines. Log into Binance through the official app or by typing the URL yourself. Check your spot balances, transaction history, pending withdrawals, and recent account activity. If anything looks wrong, open a support ticket immediately and document everything.

2. Do not share your seed phrase or private keys with anyone. No legitimate exchange, support agent, or recovery service needs them. Binance’s own investigation found no private key leak, but phishing campaigns exploiting the news are already circulating.

3. Watch for recovery scams. Fraudsters monitor public panic and pose as “Binance support” or “recovery experts,” promising to restore access or retrieve funds for an upfront fee. Binance will not DM you first. Recovery offers that arrive unsolicited are secondary scams.

4. Review your withdrawal address whitelist. If you have whitelisted addresses, confirm they are still correct. If you have not, consider setting up a whitelist once withdrawals resume—it adds a layer of protection against unauthorized withdrawals from your account.

5. Consider what “not your keys, not your coins” means for you. Long-term holdings do not need to sit on an exchange. A hardware wallet or a self-custody wallet gives you control over your private keys, at the cost of operational responsibility. The trade-off is real, but so is the custody risk.

6. Wait for the Proof of Reserves update before making large new deposits. Binance has committed to publishing updated reserves once remediation is complete. That document, combined with on-chain verification, is the only independent confirmation that customer liabilities are fully backed.

Pro Tip: If you are unsure whether a Binance-related message is real, close it and navigate to Binance’s official announcements page yourself. Do not click links in emails, DMs, or social media posts—even if they look like they come from someone you trust. The attacker’s first move in most follow-on scams is to exploit the credibility of the original event.

How to Protect Your Crypto After the Binance Hack

You cannot control an exchange’s internal security, but you can control your own exposure. The most important step is to reduce single points of failure.

Immediate Security Checklist

1. Change your Binance password. Use a long, unique password stored in a password manager.

2. Reset 2FA if needed. Prefer an authenticator app or hardware security key over SMS-based codes.

3. Review active sessions. Sign out of unfamiliar devices and revoke sessions you do not recognize.

4. Audit API keys. Delete unused keys and remove withdrawal permissions from keys you do not explicitly need.

5. Check withdrawal whitelist settings. Ensure only your own verified wallets are allowed.

6. Beware impersonators. Do not trust unexpected calls, emails, Telegram messages, or “support agents” asking for codes or remote access.

7. Never share your seed phrase. No legitimate exchange, wallet provider, or support agent needs it.

8. Use self-custody for long-term holdings. A hardware wallet can reduce dependence on any single exchange.

9. Verify addresses carefully. Confirm the full wallet address, not just the first and last characters.

10. Follow official channels only. Binance said it will provide verified updates through official channels.

How to Protect Your Crypto After the Binance Hack

You cannot control an exchange’s internal signing infrastructure, but you can reduce your own exposure. The goal is not panic. It is removing avoidable single points of failure.

How Did Hackers Allegedly Breach Binance?

The leading hypothesis is that attackers compromised a Binance engineer’s laptop, then used that access to reach an internal service container and trigger unauthorized withdrawals. Binance has not yet published a complete forensic timeline, so this remains an initial explanation rather than a final conclusion.

Why a DevOps Laptop Matters

A DevOps engineer often has privileged access to deployment systems, infrastructure configurations, internal tools, containers, and operational services. If an attacker compromises that laptop, they may be able to move from the device into connected systems.

Security professionals call this lateral movement. The laptop is not necessarily the vault. It is the doorway.

From there, an attacker may seek credentials, session tokens, API permissions, deployment access, or a vulnerable service container. Binance said the attacker was able to submit unauthorized withdrawal transactions after accessing a service container.

What Is a Service Container?

A service container is a lightweight, isolated software environment used to run part of an application. Exchanges rely on containers to run trading engines, withdrawal services, monitoring tools, and internal APIs.

If an attacker gains control of a container with withdrawal permissions, they may be able to issue transactions that appear legitimate to automated systems. That is why privileged-access management, device security, network segmentation, and withdrawal controls matter so much.

Pro Tip: A compromised laptop can be more dangerous than a leaked password. It may contain saved sessions, browser cookies, SSH keys, VPN access, and authenticated internal tools. Security teams treat endpoint compromise as a full incident, not a minor IT issue.

Did Hackers Get Binance’s Private Keys?

Binance says it found no evidence that wallet private keys were leaked. Private keys control access to crypto wallets, so a leak would usually make asset recovery far more difficult and would represent a deeper compromise of custody infrastructure.

However, “no evidence of a private-key leak” is not the same as “no systems were compromised.” Binance itself said it later uncovered additional points of breach beyond the initial laptop theory.

The practical takeaway is simple: do not assume that exchange security depends only on private keys. Operational systems, employee devices, internal permissions, and withdrawal controls can also become attack surfaces.

Who Is Suspected of the Binance Attack?

Blockchain-intelligence firms have attributed the attack with high confidence to North Korea-linked hackers, specifically the group often called TraderTraitor. Reuters reported that TRM Labs, Chainalysis, and Elliptic all believed North Korea was responsible, though Binance said its own investigation had not yet attributed responsibility to any individual.

TRM said the attackers ordered Binance wallets to empty into hacker-controlled wallets, a method similar to the 2025 Bybit theft that the FBI attributed to North Korea.

North Korea has long been accused by U.S. and South Korean authorities of using state-linked cyber units for espionage and revenue generation. North Korea routinely denies those allegations.

What We Still Do Not Know

• The complete attack chain and every initial access vector.

• Whether the compromised laptop was the only entry point.

• The final amount stolen after tracing, freezing, and recovery efforts.

• Whether all affected assets can be returned.

• The full technical findings from Binance’s completed investigation.

• Whether regulators will require changes to Binance’s custody, access, or withdrawal controls.

  Expert Insight: In major breaches, early attribution is often directionally useful but incomplete. Treat “North Korea-linked” as a strong investigative hypothesis, not a courtroom verdict—especially while Binance says its own attribution process remains open.

Binance Hack Timeline: 2019 vs. 2026

Binance has faced a major security incident before. In May 2019, hackers withdrew 7,000 BTC, then valued at about $41 million, from Binance’s hot wallet. The company suspended withdrawals for about a week while it investigated.

The 2026 incident is different in scale and apparent method. The 2019 breach centered on compromised user credentials, API keys, and two-factor codes; the 2026 incident reportedly involved internal infrastructure and unauthorized withdrawal transactions.

What Did Michael Saylor Say About Binance?

Immediate Security Checklist

1. Verify your account activity, not just the headlines. Log in through the official Binance app or by typing the URL yourself. Check spot balances, transaction history, pending withdrawals, and recent account activity.

2. Do not share your seed phrase or private keys. No legitimate exchange, support agent, or recovery service needs them. Binance said it found no private-key leak, but phishing campaigns exploiting the news are already circulating.

3. Watch for recovery scams. Fraudsters exploit public panic by posing as “Binance support” or “recovery experts,” promising to retrieve funds for an upfront fee. Binance will not DM you first. Unsolicited recovery offers are secondary scams.

4. Review your withdrawal address whitelist. Confirm that whitelisted addresses are still correct. If you have not enabled whitelisting, consider setting it up once withdrawals resume.

5. Audit API keys and sessions. Delete unused API keys, remove withdrawal permissions you do not need, and sign out of unfamiliar devices.

6. Use stronger 2FA. Prefer an authenticator app or hardware security key over SMS-based codes.

7. Consider self-custody for long-term holdings. A hardware wallet gives you control of your private keys, at the cost of operational responsibility. The trade-off is real, but so is exchange custody risk.

8. Wait for the updated Proof of Reserves before making large new deposits. Binance has committed to publishing updated reserves after remediation. Combined with on-chain verification, that is the most meaningful independent confirmation that customer liabilities are backed.

   Expert Insight: If you are unsure whether a Binance-related message is real, close it and navigate to Binance’s official announcements page yourself. Do not click links in emails, DMs, or social posts—even if they appear to come from someone you trust. Follow-on scams exploit the credibility of the original event.

Case Study: A Sensible User Response

Maya, a long-term investor, held $40,000 in crypto: $25,000 on Binance, $10,000 in a hardware wallet, and $5,000 on another exchange. When the breach news spread, she resisted the urge to move everything at once.

First, she confirmed the story through Binance’s official announcements and reputable news outlets. Then she changed her password, reviewed active sessions, deleted an old API key, and verified that withdrawal whitelisting pointed only to her hardware wallet.

She left a small trading balance on Binance, moved part of her long-term holdings into self-custody, and waited for verified updates before making larger decisions. She also ignored a Telegram message claiming to be “Binance security support” and asking for her two-factor code.

Maya did not need to predict the investigation’s outcome. She needed to reduce avoidable risk—and she did.

What This Means for the Industry

The Binance incident is not merely a story about one exchange’s failure. It is a story about where the perimeter of crypto security now sits.

Attackers did not break encryption. They did not find a flaw in Ethereum itself. They found a path to make a legitimate signing system authorize illegitimate transactions—through a compromised laptop, a service container, or a manipulated workflow. As security researcher Tomas Sinicki of Coveron put it, “Criminals no longer break in, they log in.”

The defensive implications for exchanges and custodians are clear:

• Enforce withdrawal policy before signature generation, not after.

• Monitor signing behavior continuously, not just static key custody.

• Harden endpoints for developers and operators with privileged access.

• Segment signing systems from general internal infrastructure.

• Provide independently verifiable Proof of Reserves, not only assurances.

For users, the implication is equally direct: platform security is not binary. An exchange can be well-capitalized and well-run and still suffer a signing-layer compromise. Diversifying custody across exchanges, self-custody, and regulated custodians is not paranoia. It is portfolio hygiene.

What Happens Next?

The next phase will determine whether this becomes a temporary shock or a lasting trust crisis for centralized exchanges. Binance is working with the FBI and U.S. Secret Service, according to Reuters, while stablecoin issuers Tether and Circle froze portions of the affected assets.

Watch for four developments:

• A completed forensic report explaining the full attack path.

• Recovery updates showing how much of the $6.3 billion has been frozen, returned, or written off.

• Withdrawal restoration and any new withdrawal controls.

• Regulatory scrutiny, particularly from Abu Dhabi’s Financial Services Regulatory Authority, which said it was monitoring the incident.

The broader market reaction was immediate. Bitcoin fell to a six-week low of $76,368, ether dropped more than 3%, and BNB declined 5.3% over 24 hours, according to Reuters. Those moves reflect a familiar crypto pattern: security failures do not only affect one platform; they test confidence across the entire ecosystem.

Binance has committed its balance sheet, SAFU fund, and credibility to making users whole. Michael Saylor has publicly backed that commitment. Roughly $3 billion has been frozen. The investigation is ongoing, and Binance has promised a detailed technical post-mortem once facts are verified.

The most important lesson is not about Binance alone. It is about the class of attack this incident represents: signing infrastructure is the new crown jewel. If your security model assumes that a valid signature always means a legitimate transaction, you are already behind.

If you hold crypto on Binance, start with the checklist above today. Then decide—calmly—how much of your portfolio belongs on an exchange and how much belongs in self-custody.

FAQs

Was Binance hacked again in 2026?

Yes. On October 29, 2026, attackers drained an estimated $6.3 billion from Binance hot wallets across ten blockchains, in what analysts described as the largest crypto theft on record. Binance attributed the possible entry point to a compromised DevOps laptop and said it found no private-key leak.

Did EIP-7702 cause the Binance hack?

No. EIP-7702 amplified the loss by allowing a delegated hot wallet to be swept repeatedly. The root failure was the attacker’s ability to obtain valid signatures from Binance’s signing infrastructure—not a flaw in Ethereum’s feature itself.

Who is responsible for the Binance hack?

TRM Labs attributed the attack to TraderTraitor, North Korea’s elite hacking unit, with high confidence. The same group was linked to the $1.5 billion Bybit hack in February 2025, although Binance said its own attribution investigation remained ongoing.

Will Binance users get their money back?

Binance has committed to covering all losses through its SAFU fund and corporate balance sheet, reportedly reserving more than $6.34 billion, including $5 billion in matching assets. An updated Proof of Reserves is expected after remediation.

Can I withdraw from Binance right now?

Withdrawals were temporarily suspended as a precaution. Binance co-founder Yi He said withdrawal services were expected to begin resuming within 48 hours of the October 30 update, while deposits remained operational.

How much crypto was stolen from Binance?

Binance estimated that approximately $6.3 billion was impacted. It said about $3 billion had been frozen or located on-chain, while the status of the remaining assets was still being assessed.

Did hackers obtain Binance private keys?

Binance said it found no evidence of a wallet private-key leak. However, it reported that attackers may have accessed an internal service container and submitted unauthorized withdrawals.

What did Michael Saylor say about the Binance hack?

Michael Saylor backed Binance’s pledge to make customers whole, saying he expected the company to deliver on that commitment. His comments addressed market confidence rather than the technical cause of the breach.

Should I withdraw my crypto from Binance?

Not necessarily in a panic. Secure your account first, follow official Binance updates, and consider moving long-term holdings to self-custody if you want to reduce dependence on any single exchange.