Can you imagine a single compromised computer becoming an entry point for stealing billions of dollars from one of the largest cryptocurrency platforms on the planet?
That’s exactly what Binance began investigating after the October 29, 2026 attack.
But the story is much more complex. And what’s truly unsettling isn’t just the money stolen, but how the attackers got legitimate systems to authorize fraudulent transactions.
I'm going to reconstruct what happened, step by step, following the technical investigations and the transactions recorded on the blockchain.
// Times are in ARGENTINA time //
OCTOBER 28. PREPARATIONS BEGIN.
At least 36 hours before the theft, the attackers were already preparing their infrastructure.
They funded an operational wallet through small withdrawals from Tornado Cash, a protocol that makes it difficult to trace the origin of cryptocurrency.
On October 29, they deployed malicious code and ran tests using wallets under their own control.
They weren't improvising. They had rehearsed the method they would later use against Binance.
BUT HOW DID THEY GET INTO BINANCE'S INFRASTRUCTURE?
Here we come to one of the most important details.
Binance officially acknowledged that its initial investigation pointed to a possible compromise of a DevOps engineer's laptop.
And what does that mean?
A DevOps engineer works with systems that make it possible to manage, run, and automate IT services.
According to Binance's initial hypothesis, the compromise of that computer may have allowed the attacker to access a service container and send unauthorized withdrawal instructions.
A container is an environment where a program or service runs. In this case, the issue may have been that the criminals managed to use internal infrastructure to request transactions that should never have been authorized.
However, Binance has not yet confirmed how the computer was compromised or when it happened. It has also not publicly identified the malware, credentials, or vulnerability that may have been used.
And Binance later acknowledged that it had found other points of intrusion...
OCTOBER 29. 17:05. THE THEFT BEGINS.
Five wallets linked to Binance transfer approximately 233 million XRP to an address controlled by the attackers.
At 17:10, transactions appear on Solana and other networks.
But the worst was yet to come.
17:20. THE ATTACK MULTIPLIES.
A Binance Bitcoin wallet transfers 18,270 BTC to an attacker-controlled address.
At the same time, on Ethereum, the criminals use a legitimate feature called EIP-7702.
It allows a wallet to authorize the execution of code from a smart contract.
And what did they do?
They submitted 50 cryptographic authorizations previously signed by a Binance wallet.
Each authorization corresponded to a different number in that wallet's transaction counter, known as a nonce.
They prepared 50 consecutive values because that counter kept changing.
When they submitted the authorizations, one matched the current value....
ONE WAS ENOUGH.
The wallet was delegated to a smart contract controlled by the attackers, designed to transfer funds according to their instructions.
17:22. ANOTHER NETWORK COMPROMISED.
On Tron, approximately 612 million USDT and 46 million TRX were transferred out.
And then came the decisive moment.
17:24:23. THE MAIN DRAIN.
Just 3 minutes and 24 seconds after the delegation on Ethereum, the attackers executed a transaction transferring 167,464 ETH and 63 different tokens, including more than 1.6 billion USDT.
All in a single transaction.
Seconds later, another Binance wallet made further unauthorized transfers.
But something was even more concerning... The malicious delegation was still active.
That meant that if new funds entered that wallet, the criminals could withdraw them again.
And that's exactly what happened.
At 17:41, another contract execution was recorded, followed by further transactions over the next few hours.
WHAT DOES ALL THIS TELL US?
That the incident cannot be explained simply as the theft of a password.
The transfers made across different blockchains had valid cryptographic signatures.
TRM Labs' investigation concludes that the attackers likely managed to get Binance's hot wallet signing infrastructure to authorize transactions of their choosing.
This is fundamental.
Stealing a private key is one thing. Getting the legitimate system responsible for using it to sign fraudulent transactions is another.
Binance says it has not yet found evidence of private key leaks.
17:57. THE RESPONSE BEGINS.
World Liberty Financial carries out an initial freeze of WLFI tokens.
At 18:01, Tether freezes USDT funds linked to the attack.
At 18:04, Circle blocks approximately 823 million USDC.
The criminals try to get ahead of these measures by converting stablecoins into other assets, mainly ETH.
Why?
Because issuers of certain stablecoins can freeze their tokens. Bitcoin and Ether, on the other hand, have no central issuer with that same power.
19:33. BINANCE SUSPENDS WITHDRAWALS.
According to reports compiled by Bitquery, the platform halts withdrawals while it investigates the incident.
However, the malicious activity was not over yet.
At 20:05, transactions from a second wave appear on Avalanche and Polygon.
And at 20:56, the last documented execution of the malicious contract on the main Ethereum wallet is recorded.
21:10. BINANCE REVOKES THE DELEGATION.
Finally, Binance manages to cancel the malicious authorization used on Ethereum.
Nearly four hours had passed since the attackers gained that execution capability.
During the response, assets across different networks were also frozen and recovered. Binance later reported that approximately $3 billion had been immobilized on the blockchain.
OCTOBER 30. THE FIRST OFFICIAL EXPLANATIONS EMERGE.
Binance confirms the hypothesis that the DevOps engineer's laptop was compromised, but in a second update acknowledges other points of intrusion.
It also announces that it will cover the losses using corporate funds and its SAFU protection fund.
TRM Labs' investigation attributes the attack, with high confidence, to the North Korean group TraderTraitor. Binance, for its part, has not yet officially confirmed who was responsible.
And that brings us to the most important conclusion.
THE ATTACKERS DID NOT NEED TO BREAK THE BLOCKCHAINS' CRYPTOGRAPHY.
They obtained valid authorizations and signatures to execute transfers that should never have been allowed.
We still don't know exactly how they got from the compromised systems to that authorization capability.
🧠 But the case leaves us with a devastating lesson:
YOU CAN PROTECT YOUR PRIVATE KEYS, USE ADVANCED CRYPTOGRAPHY, AND INVEST MILLIONS IN SECURITY.
BUT IF A CRIMINAL GETS YOUR OWN AUTHORIZATION SYSTEM TO WORK FOR THEM, THEY DON'T NEED TO BREAK THROUGH YOUR SECURITY FROM THE OUTSIDE.
THEY CAN MAKE YOUR OWN INFRASTRUCTURE CARRY OUT THE THEFT....
Sources:
https://www.binance.com/es-LA/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751
https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
https://bitquery.io/investigations/binance-hack