In the early hours of October 30, Beijing time, an attack occurred that may go down in the history of cryptocurrency security.
Multiple Binance hot wallets made abnormal transfers involving approximately $6.3 billion in assets across several blockchain networks.
This was no ordinary wallet theft.
The most alarming part is that the hackers seemingly didn’t break into the blockchain directly. Instead, they managed to exploit the exchange’s own transaction signing and execution systems.
I retraced the on-chain records and public investigations into this incident, and found several details worth paying close attention to.
1. Binance 14 was quietly taken over at 4:20 a.m.
The attacker targeted Binance's main hot wallet, Binance 14.
This wallet had long been responsible for moving large amounts of funds.
The attacker used Ethereum's EIP-7702 mechanism.
Simply put, a regular Ethereum wallet can use an authorization to delegate some of its execution capabilities to a smart contract.
Once authorization is granted, the contract can execute wallet operations according to its predefined logic.
At around 4:20 a.m., the attacker submitted a transaction containing 50 pre-signed authorizations.
Why 50?
Each authorization corresponded to a different nonce (transaction sequence number). Since the attacker could not accurately predict the wallet's current nonce, they prepared 50 possible options at once.
In the end, only one matched.
That was how execution control of Binance 14's account was delegated to the attacker's malicious contract.
2. Four minutes later, approximately $2.5 billion was transferred out in a single sweep
At 4:24 a.m., the attacker called the malicious contract to execute a sweep operation.
In a single transaction, they transferred:
167,464 ETH
Approximately $1.615 billion in USDT
More than 60 other tokens
Worth approximately $2.5 billion in total.
Even more shocking, 24 seconds later, another hot wallet, Binance 16, transferred approximately 28,005.6 ETH and a large amount of other assets to the same attacker address.
This transaction was also a normally signed transfer, not simply a copy of Binance 14's authorization operation.
This suggests that the attacker may have been able to access more than one wallet.
3. The most outrageous part: the automated sweeping system kept working even after the wallet was compromised
The attacker did not stop draining funds.
Because users' deposits continued to be swept into the hot wallet through the existing process, Binance 14—which had already been maliciously authorized—continued to receive funds.
On-chain investigations also recorded a subsequent top-up of approximately 200 million USDT.
Seventy-two seconds later, the attacker swept away that money too.
This is the most alarming part of the entire incident:
The wallet had shown signs of suspicious activity, but the funds-sweeping mechanism was not promptly shut down.
This was not just a single crypto theft transaction; the attacker used an automated system to keep draining funds.
4. How much was actually lost in this incident?
At first, many people focused only on the funds moving on Ethereum.
But subsequent cross-chain investigations by TRM Labs and Bitquery showed that the attack extended far beyond Ethereum.
Public investigations currently indicate that:
Approximately $6.3 billion in assets flowed out of 17 Binance hot wallets.
The incident involved 9 to 10 blockchain networks (figures vary slightly depending on how different organizations count them).
Approximately 18,270 BTC were transferred out of the Bitcoin network.
Approximately 613 million USDT were transferred out of the TRON network.
Large amounts of ETH, USDT, and other tokens were also stolen from Ethereum.
The XRP, Solana, Base, Optimism, Avalanche, and other networks were also affected.
This was no longer a case of one wallet being compromised; multiple exchange fund channels were affected at the same time.
5. Stablecoins can be frozen, but ETH is not so easy to freeze
Another unusual aspect of this incident is that issuers of centralized stablecoins can freeze the affected assets.
Tether froze approximately $1.57 billion in related assets, Circle froze more than $800 million, and organizations including Ripple and World Liberty also took part in freezing funds.
Binance later announced that it had frozen approximately $3 billion in assets with its partners.
But keep in mind:
Frozen does not mean recovered, nor does it mean that all affected assets have been returned to Binance.
ETH does not have an issuer-managed blacklist mechanism like USDT, so no centralized organization can directly freeze accounts on the mainnet.
In Bitquery's subsequent on-chain snapshot, the attacker still held approximately 508,600 ETH, as well as approximately 18,270 BTC. The ETH total includes some ETH the attacker acquired by converting stolen assets; it was not all transferred directly from Binance.
6. There is a key difference between Binance's preliminary explanation and the on-chain details
On October 30, Binance published a security incident announcement:
The preliminary investigation suggested that the attack may have been related to a DevOps engineer's laptop being compromised. The attacker allegedly used it to access a service container and submit unauthorized withdrawal transactions.
Binance said it had found no evidence that wallet private keys were leaked.
Binance also pledged to:
Suspend the relevant deposit and withdrawal services for a security review.
Revoke authorizations for the affected addresses.
Cover all losses using the SAFU fund and company funds.
Publish an updated proof of reserves later.
There is a very important distinction here:
On-chain data can prove that a transaction was validly signed, but transaction records alone cannot prove exactly how the private key was used.
So we cannot simply conclude that Binance's private keys were leaked.
The investigation is more likely to need to determine which part of the security controls failed—between internal devices, service containers, transaction approvals, and signing infrastructure.
TRM Labs also attributed the attack to the North Korean hacking group TraderTraitor, with a high-confidence assessment. However, this remains an attribution by a third-party security firm, not a final conclusion announced by Binance.
7. This incident has sounded an alarm for the entire crypto industry
In my view, the most important thing to consider is not how sophisticated the hackers were, but whether exchanges' security systems are still stuck in the past.
In the past, people believed that:
If the private key isn't leaked, the assets are safe.
But that logic is no longer enough.
Devices can be compromised, internal services can be taken over, signing systems can be abused, and even automated sweeping can become a tool for hackers.
Going forward, exchanges need to revisit at least a few key questions:
Do signing authorizations require independent, multi-party approval?
Can large transfers be stopped by real-time anomaly detection?
Should hot wallets have an automatic circuit-breaker mechanism?
If a wallet shows signs of suspicious activity, can deposit sweeping be paused immediately?
Are permissions truly isolated across different chains and wallets?
One more thing worth noting:
EIP-7702 itself is not a vulnerability, and AI has not been confirmed as a cause of this attack. The real concern is that attackers are using increasingly sophisticated techniques to find weak points in traditional security systems.
One final thought:
The crypto industry has long talked about decentralization, code as law, and asset ownership.
But exchanges remain responsible for the custody of assets belonging to hundreds of millions of users.
When a hot wallet is taken over and the automated sweeping system keeps sending funds to the hackers, this is no longer just a technical issue.
$6.3 billion bought us an extraordinarily expensive security lesson.
In the next round of industry competition, exchanges will have to compete not only on trading depth, liquidity, products, and user base, but also on one more thing:
Who can truly protect users' assets?
The faster technology advances, the more important it is that security systems keep up.
This incident is not over yet. The real answers will have to wait for Binance's full technical investigation report.
Key sources consulted:
Binance Official: Security Incident Update (October 30) — Preliminary intrusion path, $6.3 billion impact, frozen assets, and compensation commitment.
TRM Labs: Investigation into North Korea's TraderTraitor and the Binance attack — 50 authorizations, cross-chain attacks, and attacker attribution.
Bitquery: On-chain investigation of the Binance hot wallet attack — 17 hot wallets, fund flows, freezes, and the attacker's balance.
Cointelegraph: Analysis of EIP-7702 and signing infrastructure — 50 authorizations and the difference between private key abuse and private key leaks.
CoinDesk: Analysis of Binance reserves and hot wallet assets — The relationship between Binance 14 and proof of reserves.
Reuters: TRM's attribution of the attacker's identity — Attribution to a North Korean hacking group.