On October 29, 2026, approximately $6.36 billion moved from Binance-attributed wallets across 10 blockchain networks, according to TRM Labs. Most transfers occurred within roughly 20 minutes.
Binance's preliminary investigation points to a potentially compromised DevOps engineer's laptop, which may have exposed an internal service used to process withdrawals. The company says it found no evidence of wallet private-key leakage.
THE TECHNICAL MECHANISM
On Ethereum, TRM Labs identified EIP-7702 delegation involving 50 pre-signed authorizations. One matched Binance's hot wallet nonce, allowing an attacker-controlled smart contract to execute unauthorized transfers. This explains the Ethereum mechanism, not every affected chain.
THE RECOVERY
Circle froze more than $800 million in USDC linked to the incident. TRM Labs and Bitquery identified approximately $2.7 billion in assets frozen or rescued.
Bitquery also traced around $729 million in stolen USDT into ETH and TRX. At 03:54 UTC on October 30, it estimated that roughly $3.1 billion remained under the attacker's control. These are time-specific on-chain estimates, not Binance's final net loss.
THE BIGGER PICTURE
A valid cryptographic signature does not necessarily mean a transaction was legitimately authorized.
The evidence points to a potential compromise of Binance's internal signing and authorization controls, although the precise root cause remains under investigation.
Binance says it will cover the losses through SAFU and corporate funds.
PROOF OF RESERVES IS NOT PROOF OF SECURITY.
Holding sufficient assets does not, by itself, demonstrate that an institution can protect them.
Sources: Binance; TRM Labs; Bitquery Research; Reuters; Seeking Alpha | October 30, 2026.
Figures reflect source-specific estimates and observation windows. The investigation is ongoing.
#cryptocurrency #stockmarket #btcdump2026 $USDC $BTC $USD1