On October 29 at 16:05 (US Eastern Time, UTC 20:05), a Binance hot wallet was attacked. TRM Labs put the stolen funds at $6.36 billion based on prices at the time of transfer (Chainalysis estimated about $6.4 billion; Arkham estimated $6.01 billion), surpassing the 2025 Bybit incident (about $1.5 billion) to become the largest single cryptocurrency theft in history. Within about 20 minutes, funds were drained from at least 10 chains, including XRP, Solana, Optimism, Bitcoin (18,270 BTC), Tron ($612.7 million USDT), and Ethereum (about 200,000 ETH + $1.615 billion USDT + $823 million USDC + 61 tokens). Ethereum accounted for about 60% of the total.

Attack path: The initial investigation pointed to a DevOps engineer’s laptop being compromised → the attacker gained access to a service container → an unauthorized withdrawal transaction was submitted. A subsequent investigation uncovered “more points of compromise,” and classified it as a complex, multi-layered attack. The attacker used the EIP-7702 delegation mechanism to have the hot wallet “itself” hand execution rights to a sweeper contract; 3 minutes and 24 seconds later, the balance was automatically transferred out, and the risk-control system did not stop it. The attacker also had a “self-destruct mechanism,” destroying the tools while carrying out the attack. On the other 9 of the 10 chains, funds were transferred out using ordinary valid signatures—the conclusion is that the signing infrastructure, not the private keys, was compromised.

Where the funds went: Approximately $3 billion has been frozen on-chain—Tether froze approximately $1.77 billion USDT, Circle approximately $825 million USDC, the Arbitrum Security Council forcibly transferred $30.5 million, Ripple froze $40.5 million RLUSD, and World Liberty froze $27.8 million USD1. But before the blacklists took effect, the attacker rushed to convert the funds into approximately 420,000 ETH + 18,270 BTC (approximately $2.4 billion). Native tokens cannot be frozen.

Impact on crypto (mildly bearish in the short term; a watershed moment for a structurally bearish medium-term outlook):
· The direct impact is limited, but the “trust discount” is far-reaching. Bitcoin itself was not attacked, and the network’s hashrate and operations remain normal. 21Shares noted that BTC fell only about 2% in the 24 hours after the incident (compared with 26% after FTX), indicating that the market did not price it as a “systemic risk to crypto.”
· But this is the biggest blow yet to the “exchange custody security” narrative. The warning from Matt Maley, strategist at Miller Tabak, is worth remembering: the real risk is not that Binance cannot afford to compensate users, but that institutional investors will exit the asset class because of counterparty risk. The core selling point behind ETFs attracting inflows in this cycle has been “you don’t have to trust an exchange”—this incident could instead reinforce the long-term trend of funds moving from exchanges to ETFs and self-custody.
· The regulatory landscape has shifted. There will be stronger calls in the U.S. to “bring offshore exchanges under regulation” (Lummis has already spoken on the issue), but the CLARITY Act was stalled in the Senate on September 15 by a 49–50 vote, leaving SEC/CFTC rules to fill the gap in the short term. A legislative vacuum means the risk premium cannot be eliminated. The outcome of the midterm elections on November 3 will determine whether legislation can be revived in 2027.
· The valuation impact on BNB and the Binance ecosystem is substantial: BNB fell 7% in three days, and Binance had to use approximately $6.34 billion in its own funds + SAFU (SAFU holds only 15,000 BTC, worth approximately $1.18 billion, covering about 36% of the unfrozen losses). This will eat into its expansion and buyback firepower, and also means the ETH reserve ratio in its proof of reserves temporarily fell from 100% to approximately 94%.