Binance hit by $6.3 billion theft as attackers exploit hot-wallet access

Binance says attackers stole about $6.3 billion in cryptoassets on Oct. 29, turning the exchange into the target of a record-scale theft after years of scrutiny over its use by criminals. The exchange says an employee’s compromised laptop may have provided an entry point, but its investigation has found additional breach points and no evidence that wallet private keys leaked. Elliptic’s on-chain analysis traced the theft across 11 blockchains and identified Ethereum’s EIP-7702 account-delegation feature as one mechanism used to drain a Binance hot wallet.

The distinction matters: the evidence so far points to attackers abusing the systems that authorize withdrawals, rather than breaking the cryptography protecting a private key. Binance has paused withdrawals while it reviews and rebuilds parts of that infrastructure. It says deposits remained open and that it will cover the losses with its Secure Asset Fund for Users, or SAFU, and company funds.

How did EIP-7702 give the attacker control of a Binance wallet?

On Ethereum, EIP-7702 lets an externally owned account delegate its behavior to a smart contract. Elliptic says the attacker used the feature against Binance 14, a hot wallet, by submitting a transaction with 50 authorizations signed by that wallet’s key. Each authorization covered a different nonce, the account’s transaction counter, so one could match the wallet’s current state when the transaction landed.

That delegation enabled a “sweeper” contract to empty the wallet. Elliptic says the wallet sent out 167,464 ETH and 63 tokens, including 1.6 billion USDT. The attacker later used Binance 14’s owner rights over another Binance wallet to take about $823 million in USDC. The delegation persisted, so the attacker could continue using those rights without obtaining new signatures.

Elliptic’s analysis describes the Ethereum path; it does not explain every chain’s transactions with EIP-7702. On the other ten affected networks, it says, Binance wallets sent funds in ordinary signed transactions. The evidence suggests a compromise of access to Binance’s signing infrastructure, rather than a private-key leak. Binance says it has not yet established the full attack path.

How much was stolen, and what can be frozen?

Binance’s estimate is about $6.3 billion. Elliptic counted $6.43 billion in transfers from Binance wallets, including $3.80 billion across 186 tokens on Ethereum and 18,270 BTC. The figures differ because they come from separate estimates and analyses. Elliptic says its total excludes some later transfers it assessed as Binance moving its own funds.

Token issuers can freeze some assets by blacklisting addresses under their control. Elliptic verified about $2.84 billion frozen on-chain, close to Binance’s estimate of roughly $3 billion. It says most frozen funds were USDT and USDC. Ether and bitcoin lack a central issuer with the same ability to freeze them, so those assets could not be frozen through that mechanism.

The Associated Press reported that TRM Labs assessed TraderTraitor, a North Korean hacking unit, as the most likely attacker. That attribution remains an assessment, not a confirmed government finding. Elliptic also attributed the theft to North Korea-linked actors based on its analysis.

Who bears the loss while withdrawals are paused?

Binance says users will not bear losses and that SAFU and company resources will cover them. The exchange has not published its full post-mortem. In its Oct. 30 security update, it said its investigation found multiple entry points and that the attack could not have been completed from one employee’s machine or with one engineer’s permissions “in one click.”

The attack’s remaining route through Binance’s systems is still under investigation. Until the exchange publishes the signing path and explains how its controls failed, the precise sequence that let unauthorized withdrawal transactions pass remains unresolved.

Sources and documents

• on-chain analysis — elliptic.co
• reported that TRM Labs assessed TraderTraitor, a North Korean hacking unit, as the most likely attacker — apnews.com
• Oct. 30 security update — binance.com