Here’s how an Ethereum upgrade helped drain part of Binance’s $6 billion loss

On October 29, 2026, an attacker moved roughly USD 6.36 billion from Binance wallets across ten blockchains in a coordinated burst that began at 20:05 UTC and lasted about 20 minutes. The theft, attributed by TRM Labs to North Korea’s elite hacking unit TraderTraitor, represents the largest crypto heist on record. On Ethereum alone, the attacker exploited an EIP‑7702 delegation to turn a Binance hot wallet into a sweeper, draining about USD 3.79 billion. Stablecoin issuers and Arbitrum froze roughly USD 2.7 billion of the stolen assets, but the attacker still controls over 420,000 ETH and 18,270 BTC, valued at about USD 2.4 billion.

Background

The incident unfolded as Binance, the world’s biggest cryptocurrency exchange, reported a massive security breach affecting wallets on Ethereum, Bitcoin, XRP Ledger, Tron, Solana and four other networks. Within minutes, funds were transferred to addresses linked to a single attacker, prompting Binance to suspend withdrawals on several chains while assuring users that their funds remained safe. TRM Labs, a blockchain intelligence firm, traced every transfer and estimated the total loss at USD 6.36 billion, with current valuations slightly lower at USD 6.23 billion. The firm’s analysis points to a compromise of Binance’s hot‑wallet signing infrastructure, citing the use of pre‑signed authorizations executed in a single burst. The attack mirrors previous North Korea‑linked operations, such as the February 2025 Bybit hack and the April 2026 KelpDAO breach, which also featured staged preparations and advanced signatures. In response, major stablecoin issuers—including Tether, Circle and Ripple—froze about USD 2.67 billion, while Arbitrum’s Security Council locked 8,426 ETH and 74.6 million ARB. Despite these freezes, the attacker quickly sold USDT to market makers and borrowed ETH on Aave, amassing a sizable portfolio beyond the reach of any single issuer.

What happened

According to TRM Labs, the attacker began moving funds at 20:05 UTC on October 29, 2026, targeting Binance wallets on ten different blockchains. On Ethereum, the attacker employed an EIP‑7702 delegation, converting a Binance hot wallet into a sweeper under their control and executing 50 pre‑signed authorizations that had been prepared in advance. In the same window, Binance wallets on the other nine chains performed ordinary signed transfers that sent assets to the attacker’s addresses. A second wave around 23:05 UTC reached Binance wallets on Avalanche and Polygon. Binance confirmed the security incident, temporarily halted withdrawals on multiple networks, and asserted that user funds were safe. Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze approximately USD 2.67 billion in stablecoins, while Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB. The attacker countered the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave, ultimately holding more than 420,000 ETH and 18,270 BTC, valued at about USD 2.4 billion. TRM Labs traced the outflows, finding Ethereum accounted for about USD 3.79 billion, Bitcoin for USD 1.47 billion, Tron for USD 628 million, XRP for USD 296 million, Solana for USD 96 million, and smaller amounts on Arbitrum, Optimism, Base, Avalanche and Polygon.

Market impact

The theft removed roughly USD 6.36 billion from Binance’s hot wallets, with Ethereum alone representing about USD 3.79 billion of that total. Stablecoin issuers froze about USD 2.67 billion, yet the attacker managed to retain assets worth roughly USD 2.4 billion, including over 420,000 ETH and 18,270 BTC. The rapid sale of USDT to market makers and borrowing on Aave likely exerted pressure on stablecoin liquidity and borrowing rates. The freeze of 8,426 ETH and 74.6 million ARB on Arbitrum removed a notable amount of supply from that network, potentially influencing ARB price dynamics. Binance’s suspension of withdrawals on multiple chains may have temporarily reduced on‑chain activity and trading volume across those assets, while the broader market observed heightened volatility as participants reassessed risk on hot‑wallet security.

Why it matters

The breach underscores the vulnerability of hot‑wallet signing infrastructure at major exchanges, highlighting how pre‑signed authorizations can be weaponized in a single, high‑speed burst. The use of an EIP‑7702 delegation on Ethereum demonstrates a novel attack vector that could inspire similar exploits on other smart‑contract platforms. The scale of the theft, dwarfing previous hacks, raises concerns for custodial risk management and may prompt regulators and industry groups to tighten security standards. The rapid freezing actions by stablecoin issuers and Arbitrum illustrate coordinated defensive measures, yet the attacker’s ability to retain a large portion of the assets shows limits to such interventions. Overall, the event may accelerate adoption of multi‑signature and hardware‑based signing solutions, and could influence future policy discussions around exchange liability and cross‑chain monitoring.