The Binance hack didn’t break the cryptography. It broke the controls

On October 29, 2026, at around 20:05 UTC, approximately $6.3 billion in crypto left Binance’s hot wallets across about ten chains. It is the largest cryptocurrency theft recorded to date.

Binance has confirmed that it will absorb 100% of the impact. It has already set aside more than $6.34 billion in its own funds and the SAFU fund. Of that, $5 billion is already in the same affected assets, and around $3 billion was frozen on-chain. Users will not lose their balances.

But the most important detail isn’t the amount. It’s how it happened.

According to Binance’s own investigation, there is no evidence that the wallets’ private keys were leaked. The initial investigation pointed to a compromised laptop belonging to a DevOps engineer, but other points of access were later identified. What was confirmed on-chain is that Binance’s signing system generated valid signatures that the attacker used.

On Ethereum, the attacker used EIP-7702, an upgrade activated in May 2025 with the Pectra update. This feature allows a regular account to temporarily delegate its execution to a smart contract. The attacker obtained 50 signed authorizations using the key of a Binance hot wallet, each with a different consecutive nonce. One of them matched. Three minutes later, a single transaction drained hundreds of thousands of $ETH and more than 1.6 billion USDT.

EIP-7702 isn’t the problem. It’s an amplifier. When the system that generates signatures is compromised, a tool designed to improve the user experience becomes a damage multiplier. The delegation remained active for hours, and Binance’s automated systems continued sending deposits to the same wallet while the attacker swept them away. $XRP

This pattern isn’t new. TRM Labs and Chainalysis have attributed the attack, with high confidence, to TraderTraitor, the Lazarus Group unit specializing in cryptocurrency. The FBI attributed the 2025 Bybit hack to the same group. Months earlier, Bitget suffered a similar attack (compromise of the signing backend, not the keys). The amount was around 387 million, not 6.3 billion. The difference wasn’t just a matter of scale: it came down to the control architecture and the ability to contain the damage across the hot, warm, and cold layers.

Binance’s cold wallets were untouched. The damage was concentrated where the signing system has to operate every day to process withdrawals. That’s the real weak point: not the cryptography, but the operational controls that determine what gets signed and when.

Binance has said it expects to share more technical findings and a post-mortem report. It also plans to resume withdrawals gradually and publish an updated Proof of Reserves. That data will help verify the backing. But the mechanism that made the attack possible is what will continue to matter months later.

The lesson isn’t that exchanges are inherently unsafe. It’s that the security of a centralized platform depends as much on its cold keys as on the controls protecting the system that uses them. When that system is compromised, the size of the balance and the speed of execution become the greatest risks.

Understanding this pattern is more useful than following the day’s figure.