Binance has confirmed a security incident with an estimated impact of over $6 billion, marking the largest cryptocurrency theft in history according to the company’s own statements. The attack involved an attacker moving approximately USD 6.36 billion out of the exchange’s wallets across ten blockchains within minutes, an event that dwarfs the previous record set by North Korean hackers stealing $1.5 billion from Bybit in February 2025.
The Record Security Breach
The mechanics here reveal a sophisticated compromise of Binance’s hot wallet signing infrastructure. According to TRM Labs, an attacker known as TraderTraitor utilized an EIP-7702 delegation on Ethereum to turn a Binance hot wallet into a sweeper it controlled. This was supported by 50 pre-signed authorizations prepared in advance, allowing the theft to execute rapidly before defensive measures could react.
The timeline of the heist began at 20:05 UTC on October 29, 2026. In that initial window, Binance wallets on Ethereum, Bitcoin, Tron, Solana, and four other networks sent their balances to addresses controlled by a single attacker. A second wave of transfers hit wallets on Avalanche and Polygon around 23:05 UTC. The FBI has previously identified TraderTraitor as the group responsible for the Bybit hack, noting that features like small Tornado Cash withdrawals funding an operator wallet match earlier North Korea-linked heists.
The scale of the loss is staggering when compared to stablecoin reserves. Stablecoin issuers and partners froze approximately $2.7 billion in stolen assets immediately following the breach. This figure includes roughly USD 1.875 billion in USDT, 823 million in USDC, and significant amounts of RLUSD. The attacker raced these freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, totaling about USD 2.4 billion in assets beyond any issuer’s reach.
The attack was attributed by TRM Labs to TraderTraitor, North Korea’s elite hacking unit based on robust on and off-chain intelligence. The FBI named the same group as responsible for the Bybit hack, establishing a clear link between state-sponsored actors and this unprecedented financial exfiltration. On closer reading of the data, the theft represents about four times the value of the 2025 Bybit incident.
Solvency and User Fund Safety Guarantees
Binance assured users that their funds are completely safe despite the massive outflow of assets. A spokesperson for the crypto exchange stated, “We confirm a security incident and have temporarily suspended withdrawals on several networks as a precautionary measure.”
Following the breach, Binance confirmed it had frozen assets to cover user claims. The company has also pledged to pay back any losses suffered by customers due to the hack. This move is critical for restoring market confidence, as it demonstrates that while the exchange’s infrastructure was compromised, the legal and financial mechanisms to protect client assets remain intact.
The Path to Structural Reform
To restore market confidence following such a record-breaking loss, Binance must implement rigorous structural reforms. The catch is that hot wallet signing infrastructure proved vulnerable to delegation attacks like EIP-7702. Restoring trust requires a fundamental overhaul of how private keys are managed and signed, likely necessitating multi-signature schemes with geographically distributed validators or hardware security modules (HSMs) that cannot be easily delegated.
Regarding reserve proofs, the exchange must transition to a model where reserves are fully backed 1:1 by liquid assets held in cold storage, separate from operational hot wallets. The current incident highlights the danger of holding significant stablecoin balances on hot wallets accessible via smart contract interactions that can be exploited for delegation. Binance will need to provide transparent, real-time audits of its reserve holdings, proving that user funds are segregated and not commingled with the assets used for business operations.
The mechanics here suggest that the industry’s reliance on centralized custodians holding vast amounts of value is a single point of failure. While Binance has historically claimed to hold 100% of customer funds, this hack proves that “custody” does not equate to “security” if the signing infrastructure itself is compromised. The only viable path forward involves decentralized custody solutions or a radical shift in operational security protocols that eliminate the possibility of pre-signed authorizations being abused.
Market Reaction and Asset Valuation Shifts
The immediate market response to the confirmed breach involved significant volatility across major digital assets. As of 6:55 p.m. ET, Bitcoin dipped approximately 2.8% to $79,026, while Ether fell about 3.6% to $2,275. BNB experienced a sharper decline, dropping 6.9% to $704. These price movements reflected investor uncertainty regarding the full extent of the damage and the potential for further contagion within the broader cryptocurrency ecosystem.
Beyond the initial freeze of stablecoin reserves, the attacker executed a sophisticated strategy to liquidate assets before custodians could react. The group sold USDT to market makers and borrowed ETH against USDT on Aave. This maneuver allowed them to hold more than 420,000 ETH and 18,270 BTC, totaling about USD 2.4 billion in assets beyond any issuer’s reach. By converting stolen stablecoins into other cryptocurrencies, the attacker effectively removed a substantial portion of the funds from the control of original owners and stablecoin issuers.
Stablecoin issuers and partners responded by freezing approximately $2.7 billion in stolen assets immediately following the breach. This figure includes roughly USD 1.875 billion in USDT, 823 million in USDC, and significant amounts of RLUSD. Tether CEO Paolo Ardoino confirmed his company froze more than 1.567B USDT related to the potential hack, stating that protecting the industry was their main priority. Despite these efforts, the attacker’s rapid execution ensured that a massive value transfer occurred before defensive measures could fully engage.
Sources
- Binance estimates $6.3 billion hacked in crypto's biggest heist
- Binance
- North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History | TRM Labs
Photo: Christin Hume / Unsplash (Unsplash License)
