Hot Wallet, Cold Sweat: Binance Loses $6.3B

At around 20:05 UTC on October 29, about $6.3B left Binance’s hot wallets on Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Polygon, Optimism, Base, and NEAR, according to the exchange’s own estimate. It is the biggest theft in crypto history, several times larger than the 2025 Bybit hack. Most of the coins were gone within just 20–40 minutes.

Attack Details

Binance’s own preliminary account is that a DevOps engineer’s laptop was compromised. Through it, attackers gained access to a service container that could be used to send withdrawal requests. There are no signs that the hot wallets’ private keys leaked.

According to Binance, user funds are “safe,” and losses will be covered by SAFU and the company’s own money. The exchange promises to restore withdrawals within 48 hours, and deposits are mostly functioning.

The brunt of the attack fell on ether. Using Binance’s signing system, the attacker prepared 50 EIP-7702 authorizations in advance for one of the exchange’s hot wallets on Ethereum. Each authorization carried a different transaction sequence number to make sure at least one would match the wallet’s current state. One of them worked, and the wallet started executing the attacker’s contract code.

A single call drained about 167,000 ETH, $1.6B in USDT, and dozens of other tokens. Meanwhile, the exchange’s automation kept topping up this same wallet even after the drain began, and the attacker swept up the new funds. The delegation stayed active for several hours until it was revoked.

Analysts from TRM, Chainalysis, and others attribute the attack to North Korean hackers, specifically TraderTraitor / Lazarus, with high confidence.

Market and Exchange Response

Tether, Circle, Ripple, World Liberty, and the Arbitrum Security Council froze about $3B, mostly in stablecoins. The rest, mainly ether and 18,270 BTC, is still in the attacker’s hands. At the time of publication, the BTC is split across 19 wallets and so far hasn’t moved. Some of the stablecoins had already been converted into ETH before the freeze.

Binance’s SAFU (Secure Asset Fund for Users) holds about 15,000 BTC, worth around $1.16B right now. The exchange is covering the rest with its own funds. It has already set aside more than $6.34B, and $5B of that is held in the same tokens affected by the hack.

Binance is buying the missing amount on the open market and through over-the-counter deals. The process is moving more slowly because some assets have low liquidity. About $3B has already been frozen with help from blockchain partners, and Binance is working with law enforcement to get it back. Once the shortfall is covered, the exchange promises to publish an updated Proof of Reserves.

Editor-in-Chief’s Take

Everyone is talking about weak cryptography right now, but what really fails is the front-end infrastructure, which is easy to compromise. As in many other cases, the operational layer is what broke: access to a DevOps engineer’s laptop → access to a container that can request withdrawal signatures. That is how criminals with this access can control billions of dollars. It sounds like a dumb joke.

Another totally baffling detail is that, after the initial breach, other wallets kept sending funds to the compromised address automatically. In other words, a system built to keep the exchange running nonstop may have kept servicing the hacker’s wallets even after signs of compromise were detected.

And here’s the most interesting part: a kill switch to stop the money flow showed up yet again. Participants temporarily changed a system contract, and the infrastructure used centralized powers that let it interfere with operations without the address owner’s consent. That calls the whole philosophy of blockchain into question.

The bottom line

Hot wallets are online by definition, and automation runs them. When that automation keeps feeding an already compromised address, it’s not a blockchain bug but the classic operational continuity problem of centralized exchanges (CEXs).

For a CEX user, “your funds are safe” in a case like this means the exchange will absorb the loss itself (SAFU + profits/reserves) and won’t let clients get hurt. That works as long as the exchange is big enough and wants to protect its reputation. But the mere fact that billions can be pulled out through a compromised laptop and a service container shows how big the hot wallet risk really is.

The bottom line? Self-custody of large holdings is still the only way to make sure this kind of attack can’t touch you.

We have yet to assess the long-term fallout of this story, but the Binance hack looks more like a “gray duck” than a “black swan.” It’s just interesting to see centralization lose to centralization.

This post is for informational purposes only and does not constitute advertising or investment advice. Please do your own research before making any decisions.