The largest theft in crypto history confirms Binance’s limits and reminds the industry that custody is, first and foremost, technology and process.
On 29 October 2026, starting at 20:05 UTC, an attacker moved crypto-assets out of Binance’s wallets worth an estimated 6.3 billion dollars according to Binance (analysts’ estimates range between 5.5 and 6.4 billion), most of it in about twenty minutes and, according to TRM Labs, across ten blockchains. It is the largest theft ever recorded in the industry: roughly four times the one suffered by Bybit in February 2025, which held the previous record.
TRM Labs attributes the attack, with high confidence, to TraderTraitor, the North Korean group to which the FBI attributed the Bybit case. Binance has not yet confirmed the identity of the attacker.
How it happened
According to Binance’s first reconstruction, the entry point was the compromised laptop of a DevOps engineer. From there the attacker may have reached an internal service from which unauthorized withdrawal requests could be submitted. Binance states that it has found no evidence of stolen private keys: the prevailing hypothesis is that the keys never left Binance’s systems, but that the signing system signed whatever it was asked to sign.
On Ethereum the attack exploited EIP-7702, activated with the Pectra upgrade in May 2025, which allows an account controlled by a private key to delegate its execution to the code of a smart contract. The attacker sent a single transaction containing 50 delegation authorizations for one of the exchange’s main hot wallets, each with a different sequence number, because that wallet was processing withdrawals continuously and the correct value was unpredictable. One of the 50 succeeded: from that moment the wallet ran the attacker’s code, which drained it with a first operation of about 2.5 billion dollars, followed by others in the next hour.
The delegation, moreover, does not expire: it stays active on the address until the same key signs a revocation. Until the revocation, which Binance says it has carried out, any funds arriving at that wallet were exposed, and indeed the attacker drained it several times.
The attack was not limited to Ethereum: on the other blockchains Binance’s wallets directly signed transfers to the attacker. The outflows also include 18,270 bitcoin, about 1.45 billion dollars.
Where things stand
Binance has suspended withdrawals and, according to co-CEO Yi He, expects to start reactivating them within 48 hours of 30 October. It also states that it has frozen about 3 billion dollars thanks to the cooperation of issuers, blockchains and analytics firms. Almost all of the frozen amount is stablecoins, blocked by their respective issuers: Tether over 1.5 billion (up to 1.77 according to TRM Labs), Circle over 800 million. The rest, including all the stolen bitcoin, is still in the attacker’s hands.
The exchange has committed to fully covering users’ losses, drawing on its SAFU guarantee fund, which holds about 1 billion dollars in bitcoin, and on corporate reserves. It has also announced a technical report and a new Proof-of-Reserves at the end of the investigation.
Not a bolt from the blue
This is a serious matter, all the more so because it fits a consistent history. In 2023 Binance agreed to pay 4.3 billion dollars to US authorities for violations of anti-money-laundering rules, one of the largest penalties ever imposed on a company in the United States. Its founder, Changpeng Zhao, pleaded guilty to failing to implement an adequate anti-money-laundering program and served four months in prison in 2024, before receiving a presidential pardon in October 2025. This year, on 24 June, just ahead of the 1 July deadline, Binance withdrew its application for MiCAR authorization in Greece, after the press had reported the regulators’ resistance. From 1 July it has therefore suspended most of its services in the European Economic Area.
Anti-money-laundering penalty, the founder’s prison sentence, no MiCAR authorization and now the largest hack in history: to me these are different manifestations of the same poor quality of corporate culture.
Just as serious is that, despite all this, Binance remains the dominant market operator, with 38.7% of the spot volume of the ten largest centralized exchanges in the second quarter of 2026, according to CoinGecko. An ecosystem in which a single player with this history concentrates such a share of trading is a fragile ecosystem.
The real problem: custody culture
It would be convenient, however, to file the case as a problem of Binance alone. What the industry lacks is a technological and process culture around custody.
This attack did not require breaking cryptography, nor stealing a key. If Binance’s preliminary reconstruction is confirmed, all it took was for a single compromised device to be able to reach a system that signs automatically, with no independent check on what it was signing. Custody means designing the organization so that no single point (person, laptop or service) can move funds on its own; it means that whoever signs must know exactly what they are authorizing; it means treating every automated component as if it were already compromised, and limiting its powers accordingly.
This is not an issue that concerns only the most reckless operators. Even regulated companies, less buccaneering than Binance, today offer suboptimal custody services. We will see other serious incidents: they will be inevitable steps towards the maturity of the ecosystem, as has already happened in other financial sectors.
A note on Bitcoin
One detail deserves attention. The roughly 3 billion frozen is almost entirely stablecoins, blocked by their respective issuers. No one can intervene on bitcoin after the fact: there is no issuer to ask for a freeze. To hold bitcoin in custody, therefore, security must lie entirely in prevention. It is the principle CheckSig’s custody is built on: our setup has no single point of failure, as some highly respected technologists have recently acknowledged publicly.
