Binance Hack Explained: How $6.3 Billion Vanished in 20 Minutes

An attacker drained an estimated $6.36 billion from Binance hot wallets on the evening of October 29, 2026, pushing unauthorized withdrawals through the exchange’s own infrastructure across about 10 blockchains in roughly 20 minutes, according to TRM Labs’ analysis of the public blockchain transactions. It is now the largest crypto theft on record, more than four times the $1.5 billion Bybit theft. 

Binance paused deposits and withdrawals, froze a large share of the stolen assets with partners, and said users will not bear the loss. 

Additionally, markets moved fast on the news. The exchange’s native token fell sharply, and Bitcoin dropped as the hack sparked more than $1.5 billion in liquidations across the broader market.

What Was Taken

The first visible blow landed on a single wallet. At 20:24 UTC, an attacker emptied one of Binance’s largest hot wallets in a single transaction, sending 167,464 ETH and 63 different tokens, including 1.615 billion USDT, from the wallet labeled “Binance 14” to a freshly created address. Two minutes later, 28,005.6 ETH from the wallet “Binance 16” followed the same path.

The outflows crossed ten blockchains, including Ethereum, Bitcoin, and Tron. Binance’s own systems then widened the damage before anyone could intervene. A separate Binance smart contract wallet lost $823 million in USDC because it held a standing approval to the hijacked wallet, and about 80 minutes later the exchange’s automated deposit sweepers were still feeding another $204 million of USDT into the trap.

How the Attack Happened

The mechanism on Ethereum rested on a feature called EIP-7702. Introduced with the Pectra upgrade in May 2025, it lets a standard wallet address temporarily delegate its execution to a smart contract. The specification itself carries a blunt warning that wallets and apps should never expose the delegation process directly to users, because delegated code can drain all funds in an account.

The attacker tied Binance 14 to their own contract through an EIP-7702 delegation, then used it to turn the wallet into a sweeper that drained it three times as Binance’s systems kept refilling it. 

Etherscan recorded the delegation from Binance 14 to the attacker’s contract. TRM Labs concluded that the exploit pointed to a compromise in Binance’s internal hot wallet signing infrastructure rather than a vulnerability in Ethereum itself. 

In Richard Teng’s account, the attacker obtained on-chain execution approval over a hot wallet, and the delegation did not pass through Binance’s normal approval controls, which is why the exchange paused withdrawals to rebuild and retest the system.

In Simple Terms

Binance keeps the keys that move money on a set of internal machines, and the attacker got control of that signing process. With that control, they made one of Binance’s own wallets sign a permission slip handing execution rights to a malicious contract. From that point, the wallet obeyed the attacker instead of Binance, emptying itself while the exchange’s automated systems, not realizing anything was wrong, kept topping it back up. The theft needed no stolen private key in the usual sense, because the attacker made Binance’s infrastructure authorize the transfers for them.

The root cause is still being worked out, and the early picture has shifted. Binance first pointed at a single entry point, citing a compromised laptop belonging to a DevOps engineer and finding no evidence of a wallet private key leak. Teng later described a wider breach, saying the attack was not the work of one person, that subsequent investigation uncovered additional points of breach, and that the attacker used a self-destruct mechanism to destroy tooling and traces as it ran.

Who Is Behind the Hack

Binance has not named the attackers, so the attribution rests on third-party blockchain analysis. TRM Labs attributes the attack to TraderTraitor, a North Korean state hacking unit, with high confidence, and ZachXBT separately named the Lazarus Group as the likely attacker.

ZachXBT: Stolen Funds from the $6.3B Binance Exploit and $388M Bitget Exploit Commingled at Same Address, Suspected Same North Korea-Linked Attacker

ZachXBT posted that stolen funds from the $6.3 billion Binance exploit and the $388 million Bitget exploit arrived via THORChain… pic.twitter.com/Fgt4u0BtGL

— Wu Blockchain (@WuBlockchain) October 30, 2026

Chainalysis CEO Jonathan Levin said his firm reached the same conclusion, citing links to a previous attack, though no government has issued a formal attribution.

Chainalysis CEO Jonathan Levin on CNN: the $6.36B @binance hack reused laundering wallets from the @bitget hack just 5 weeks ago.

That reuse is how Chainalysis ties both attacks to North Korea "with high confidence."

The hackers are now swapping USDT and USDC, which @tether and… pic.twitter.com/2UFXDFsCep

— Milk Road Crypto (@milkroaddaily) October 30, 2026

TraderTraitor is a unit within the wider Lazarus Group, and the same unit was tied to the February 2025 Bybit theft. Some investigators still counsel caution, noting that only a handful of groups could execute a theft of this size while the evidence stops short of conclusively naming Lazarus.

What Richard Teng Said

Co-CEO of Binance Richard Teng addressed the incident in a video posted to social media, framing the response around user protection and recovery. He said Binance will cover all hacked losses through company funds, and drew a line between the exchange’s money and its customers’

“We never use any customer funds, so they are not impacted,” said Teng

An update on the security incident. pic.twitter.com/qn2804fO5z

— Richard Teng (@_RichardTeng) October 30, 2026

He also stated that Binance has reserved over $6.34 billion of company funds to cover the stolen assets, with $5 billion already held in the exact token types impacted, such as USDC, USDT, BTC, ETH, and BNB. User assets, he said, sit mostly in cold wallets and move into a hot wallet only when a customer withdraws. Binance is buying the remaining tokens through market and OTC channels.

On timing, Teng said the withdrawal service is being rebuilt and will not be restored until it passes testing, with users hopefully able to withdraw before a Sunday deadline falling within roughly 40 hours. He said Binance is running a full security review across endpoints, cloud, key management, and signing, targeting a full proof of reserves report by Monday with an initial view before then. On the pursuit of the attackers, he was unequivocal.

“We will do everything within our power to make sure that these bad actors will be held accountable,” Teng added. 

Independent reporting matches parts of his account. Circle froze 823 million USDC in the main receiving wallet at 21:04 UTC in coordination with law enforcement, and Binance put verified frozen value at $2.54 billion late Thursday, rising toward $3 billion. That recovered share leaves a gap against the total, which is the gap Teng says company funds will close.

What Retail Users Should Know

CIM reached out to Dr. Shobhit Navani, an advisor to government and law enforcement agencies, for his read on what the hack means for ordinary users. The first rule, he said, is not to panic. Binance leadership has said these thefts usually hit only a small percentage of the exchange’s total assets, and the company holds deep reserves and dedicated emergency funds, such as the SAFU fund, to absorb them. Ordinary retail balances are generally protected. 

The harder damage, in his view, is to trust. “Without trust, this space cannot grow,” Dr. Navani said, returning to a point he has made before. When users get scared, the effect cascades across the industry: prices fall quickly, and people rush to pull money off other platforms as well. He traces most major failures back to the same weak point. FTX collapsed because too much power sat with one individual, and the Binance incident traces to human error, an allegedly clicked malicious link. The human in the middle, he argues, will always be the vulnerable link, and AI and quantum computing are likely to make attacks more frequent and more sophisticated.

That framing shapes how he reads the advice to move everything into self-custody. Cold storage and hardware wallets are essential, Navani said, but being your own bank is neither easy nor foolproof.

“Beyond technical exploits, being your own bank means zero margin for error: click a malicious link or misplace your seed phrase, and your funds are gone forever with no customer support to call,” added Dr. Navani.

Hardware is no clean escape either. He points to Ledger’s past breaches, from a customer database leak that exposed users’ home addresses and phone numbers to the Connect Kit compromise that tricked users into signing malicious transactions. Risk sits on both sides of the exchange-versus-cold-storage choice.

The practical takeaway, in his telling, is to match the method to your own competence. Users confident in their security habits can self-custody, provided they treat the seed phrase as the single point of failure and verify every transaction they sign. Those who are not should not force it. For people who want price exposure without managing keys at all, regulated products such as crypto exchange-traded notes, which trade on standard stock exchanges like shares and track crypto prices, offer one route, and spreading funds across more than one venue limits how much any single failure can cost. 

The History of the Lazarus Group

TraderTraitor did not appear out of nowhere. The unit sits inside an operation with a 17-year record of state-run theft. Lazarus Group is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau, active since at least 2009 and reportedly responsible for the November 2014 wiper attack on Sony Pictures Entertainment. 

The name covers more than one team. Public reporting often uses “Lazarus Group” as an umbrella for multiple North Korean operators who share personnel, infrastructure, malware, and tradecraft across espionage, sabotage, and financially motivated campaigns.

Its chain of command runs through North Korea’s intelligence apparatus. The US Treasury identifies Lazarus as controlled by the Reconnaissance General Bureau, and the FBI has publicly named three North Korean hackers tied to the group, also known as APT38. Early operations targeted governments and infrastructure, from the Operation Troy denial-of-service campaign against South Korean government sites to the 2014 Sony attack, whose perpetrators called themselves the “Guardians of Peace.”

The group then moved into large bank theft. In February 2016, it stole $81 million from Bangladesh Bank, and the attempt was far larger than the amount that cleared. The Federal Reserve Bank of New York blocked a further $850 million in transactions after a misspelled instruction raised suspicion. The next year brought WannaCry, which Symantec assessed as “highly likely” Lazarus work and which hit hundreds of thousands of computers across 150 countries. In 2018, the FBI charged Park Jin Hyok over the Sony hack, the Bangladesh heist, and WannaCry.

The focus later shifted to crypto, where the thefts grew larger with each cycle. In March 2022, the US Treasury attributed the roughly $620 million Ronin Network bridge theft to Lazarus, calling it a sanctions-evasion funding source for North Korea. 

On February 21, 2025, the group drained $1.5 billion in Ethereum from Bybit, which held the record until this week. The group’s pivot from espionage to crypto theft has made it the industry’s most persistent threat, and the same cluster keeps resurfacing. In September 2026, Bitget’s CEO blamed North Korea for a $351 million breach at the exchange. 

The motive ties the cybercrime to state policy. A United Nations report suggests much of the stolen money funds North Korea’s weapons program. If the TraderTraitor attribution holds, the Binance theft becomes the single largest entry in that long ledger, and a test of how much even a $6 billion heist can be clawed back.

Interested in advertising with CIM? Talk to us!