🔬 Technical breakdown: How they stole $6.3 billion from Binance in 20 minutes — without stealing a wallet key?
$BTC This isn’t an ordinary news post. It’s a step-by-step breakdown of the attack that happened on the night of October 29, based on official sources and on-chain analyses—with a clear distinction between what’s confirmed and what isn’t.
⏱ Timeline — in minutes, UTC
- At least 36 hours before the attack: preparations had begun, according to TRM Labs, and the attacker had taken control of Binance’s hot wallet
- 20:05: Funds began flowing out—most of them left in about 20 minutes
- 20:20: A single transaction contained 50 authorizations, each signed by Binance’s hot wallet, and each directing funds to a sweeper contract that accepted instructions only from the operator
- Initial result: around $6.36 billion left across 10 chains, according to TRM Labs. Binance estimates the impact at around $6.3 billion, while Chainalysis estimates the amount stolen at around $5.912 billion at the time of the theft—the difference comes down to calculation methods and timing, not two entirely contradictory figures
🔑 The vulnerability: a laptop, not a key
According to Binance’s preliminary investigation:
- A DevOps engineer’s laptop was compromised
- The compromise enabled access to a service container, which was used to submit unauthorized withdrawal requests
- The company says there is no evidence so far that a wallet’s private key was leaked
- Binance itself says it discovered additional points of compromise afterward, and that its findings are preliminary—the full technical report is promised after the investigation is complete
That’s an important distinction: the attacker didn’t break the wallet itself; they broke the path leading to it. The wallet carried out commands that looked legitimate because they were signed from within the system.
⚙️ Why was Ethereum hit hardest? EIP-7702
On Ethereum, the attacker used EIP-7702—a feature from the May 2025 Pectra upgrade that allows a regular wallet to hand control over to a smart contract.
Simply put: the regular wallet temporarily behaved like a smart contract, and that contract directed the funds. This doesn’t mean EIP-7702 itself was compromised—it means the attacker exploited their access to use a legitimate tool maliciously.
Ethereum took the biggest hit: around $3.79 billion, including around 200,630 Ether, $1.875 billion in Tether, $823 million in Circle, and $88.5 million in Ripple USD, according to TRM Labs’ tracking. Bitcoin: 18,270 BTC, worth around $1.47 billion.
🧊 Why were stablecoins frozen while Bitcoin and Ethereum weren’t?
Because centralized stablecoin contracts have an address-blocking function. The issuer can stop a particular address from moving tokens.
- Tether: 971.1 million USDT frozen at 21:01, and more than $1.567 billion in total by 21:25; TRM counts around $1.77 billion across several chains
- Circle: 823 million USDC frozen at 21:04
- Ripple: 40.5 million RLUSD frozen at 22:01, after the attacker sold 48 million on decentralized exchanges
- World Liberty: $27.8 million in USD1 frozen, along with 48 million World Liberty tokens
- Arbitrum Security Council: 8,426 ETH and 74.6 million ARB, worth around $30 million, moved to a frozen wallet by governance decision
As for native Bitcoin and Ethereum: there’s no issuer that can freeze them. A freeze here only works through a network or governance decision, as happened with Arbitrum.
The result: around $3 billion frozen according to Binance, and around $2.7 billion according to TRM’s count—with about $2.4 billion remaining out of control, including Bitcoin split into chunks of 1,000 and 100 BTC, and around 420,000 ETH.
🏃 The getaway race: why did the attacker pay more than a 10% premium?
The attacker swapped around 325 million USDT for Ethereum via UniswapX, paying more than 10% above the market price.
That wasn’t stupidity—it was the price of speed. Every minute of delay meant another freeze. Ethereum can’t be frozen, so it was the only way out before Tether and Circle caught up.
❓ Who is the attacker? Confirmed and unconfirmed
- Not officially confirmed by Binance: the company has not publicly named anyone, and no government has officially attributed the attack so far
- TRM Labs analysis: with high confidence, attribution to TraderTraitor, the North Korean unit linked to the Lazarus Group and APT38—the same entity accused of the $1.5 billion Bybit theft in February 2025
That’s an important distinction: this is an analytical attribution, not an official announcement from Binance. Don’t present it as a confirmed fact from the company.
🛡 What did Binance do afterward, and what does it mean for you?
- Temporarily suspended deposits and withdrawals, and revoked authorization for the affected address
- Expects withdrawals to resume within 48 hours, after securing the withdrawal service and associated addresses again
- Says users’ funds are safe, and losses are covered by the SAFU fund and company funds, with an updated proof of reserves after the fix
- Binance is buying alternative cryptocurrencies in amounts matching what was stolen in preparation for its proof of reserves, according to Yi He
The technical lesson in three lines:
- The most dangerous point of failure isn’t the cold wallet, but withdrawal permissions and the services connected to them
- Centralization is a double-edged sword: it enabled the rapid freeze, but it also made one laptop a gateway to $6 billion
- On-chain transparency is what made tracking and freezing possible in the first place—the theft was visible moment by moment
So what does all this mean? The theft wasn’t a break in encryption; it was a breach of access and permissions, and a race between a centralized freeze and a decentralized getaway—and the freeze won half the race, but the other half is still out of control.
Now that you know the freeze saved around $3 billion but can’t stop Bitcoin and Ethereum—which would you prefer: an exchange that freezes quickly, or a private wallet no one can freeze? Write “Exchange” or “Wallet” 👇
Source: Official Binance data, TRM Labs, Chainalysis, Tether, Circle, BleepingComputer, The Hacker News, Cointelegraph — October 30, 2026
#بايننس #CryptoNews