Binance hot wallets (October 2026) hack — October 2026

Starting at about 20:05 UTC on 29 October 2026, wallets belonging to Binance sent their balances to attacker-controlled addresses, in the largest crypto theft on record. TRM Labs traced $6.36 billion on ten blockchains at the price of each asset when it was taken. Elliptic counts $6.43 billion on 11 chains, adding NEAR, and leaves out a further $169 million that left after withdrawals were suspended and appears to be Binance moving its own funds. Binance puts the loss at about $6.3 billion. By TRM’s count Ethereum accounts for about $3.79 billion, including 200,630 ETH, 1.875 billion USDT and 823 million USDC; Bitcoin for 18,270 BTC, about $1.47 billion; Tron for about $628 million; the XRP Ledger for 233.46 million XRP, about $296 million; and Solana for about $96 million.

The attacker’s operator wallet received three 0.1 ETH withdrawals from Tornado Cash from 28 October and rehearsed a sweeper contract on other wallets. At 20:20 UTC it submitted one transaction carrying 50 EIP-7702 authorisations signed by the hot wallet Binance 14, one for each upcoming nonce, so that one would match when the transaction landed. About three and a half minutes later the sweeper emptied the wallet of 167,464 ETH and 63 tokens, including 1.6 billion USDT. The delegation stayed in place, so funds arriving later were swept too, the last time at 23:56 UTC, and the wallet’s owner rights over another Binance wallet yielded the 823 million USDC. On the other chains Binance wallets sent funds in ordinary signed transfers. TRM and Elliptic both read that as access to Binance’s signing systems rather than stolen keys.

Binance first said the incident may have started with a compromised DevOps engineer’s laptop that gave access to a service container, then said it had found additional points of breach and no evidence of a private-key leak. Co-CEO Richard Teng said the delegation did not pass through normal approval controls and that a self-destruct mechanism destroyed tooling and traces. Binance had not published its post-mortem when this was recorded.

Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC and Circle froze the 823 million USDC three minutes later. Ripple, World Liberty Financial, Paxos and First Digital froze further stablecoins, Arbitrum’s Security Council moved 8,426 ETH and 74.6 million ARB out of the attacker’s reach, and Elliptic says Optimism’s governance appears to have moved 44 million OP on 31 October. Elliptic has verified $2.85 billion frozen or seized on-chain as of about 04:30 UTC on 31 October; Binance’s own figure is about $3 billion. The recovered figure here is Elliptic’s, under this registry’s method, and those funds have not yet been returned to Binance. Elliptic says the attacker still controls about $3.21 billion that no issuer can freeze, including 519,104 ETH, the 18,270 BTC and 233 million XRP.

TRM attributes the theft to North Korea’s TraderTraitor with high confidence, and Chainalysis’s chief executive and Elliptic call that likely; Elliptic confirmed some funds were laundered alongside proceeds of the September 2026 Bitget exploit, as ZachXBT first reported. No government has confirmed the attribution and Binance has not named anyone. Binance says it will cover all losses from its SAFU fund and corporate treasury and has set aside more than $6.34 billion, $5 billion of it in the affected tokens. Teng said only Binance’s own hot wallet was hit; CoinDesk and Bitquery note that the drained wallets appeared on the proof-of-reserves list backing customer balances. Withdrawals were still suspended when this was recorded, with a proof-of-reserves report promised by 2 November.