Binance hack: how the hot wallet theft worked

On October 29, 2026, an attacker drained about $6.3B from Binance hot wallets on ten blockchains, the largest crypto theft on record. TRM Labs assessed that the attacker most likely gained the ability to make Binance's hot-wallet signing system sign for it.

On Ethereum, the standard wallet feature EIP-7702 kept one wallet under the attacker's control for almost four hours. Stablecoin issuers and the Arbitrum Security Council froze about $3B by Binance's count. The stolen ETH, BTC, SOL and XRP have no issuer that can freeze them.

Figures are as of about 10:00 UTC on October 30, 2026.

Binance's figure dates from 02:23 UTC on October 30. Analysts' estimates ranged from $5.9B to $6.4B. Chainalysis called it nearly four times the next largest crypto theft, the roughly $1.5B Bybit hack in February 2025. Binance said it will cover all losses from its SAFU fund and company funds, and that user funds are safe.

Range, the platform for companies operating across stablecoins and fiat, traced the theft through the night. We turn regulators', auditors' and boards' requirements for wallets into operational controls on your transactions. We coordinate the custody, screening and compliance providers you already use, with monitoring, reconciliation and reporting on one record.

What happened in the Binance hack on October 29

Preparation started the day before. Range's Ethereum reads show the attacker funding its operator wallet through Tornado Cash from October 28, deploying its sweeper contract at 15:59 UTC on October 29 and testing the technique on fresh wallets that afternoon.

The first funds left on the XRP Ledger at 20:05 UTC. Solana followed from 20:10, and about 18,270 BTC left Binance in a single Bitcoin block at 20:20 UTC. According to TRM, Binance wallets on all ten chains produced valid signatures for the attacker within about half an hour, and a second wave reached Avalanche and Polygon around 23:05 UTC.

On Ethereum, at 20:20:59 UTC, the attacker submitted one transaction carrying 50 pre-signed authorizations for the hot wallet labeled Binance 14. Three minutes and 24 seconds later, a single transaction drained about 1.62B USDT and 62.6M RLUSD by Range's onchain count, plus 167,464 ETH as counted by onchain researchers including 0xQuit, and dozens of other tokens.

A second Ethereum hot wallet, Binance 16, sent about 55.7M USDT and 25.9M RLUSD through ordinary transfers 24 seconds later. Binance 14 also had permission to operate a separate Binance smart account. The attacker used that permission to pull 823M USDC in two transfers, at 20:41 and 20:59 UTC.

Public reports began at 20:32 UTC. Binance founder CZ, who said he no longer manages the exchange, wrote at 21:15 UTC: "It does look like a hack on Binance." Binance said at 21:29 UTC that it was investigating and suspended withdrawals that evening. The attacker kept calling its sweeper on Binance 14 until 23:56 UTC. Binance revoked the attacker's control at 00:10 UTC on October 30.

How did the Binance hack work?

Binance gave its first account at 02:23 UTC on October 30. Its "initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," the announcement said.

Binance later widened that account. At 04:36 UTC it described "multiple factors," with the compromised computer as what "may be the entry point," and at 08:47 UTC it said its investigation "has uncovered additional points of breach." Binance's Richard Teng wrote that "this was not a single 'one-click' action." Binance has not yet published a post-mortem.

In Range's analysis, Binance's account and the Ethereum transactions describe two steps of one attack. Binance identifies the compromised laptop as a possible entry into its withdrawal system. The Ethereum transactions show how the attacker used that access and how long control lasted.

The second step used EIP-7702, a feature Ethereum added in 2025 that lets an ordinary wallet authorize a smart contract's code to run, enabling batched payments or someone else to cover fees. The attacker submitted 50 pre-signed permissions at once to ensure one would be valid when the transaction landed. Binance 14 then ran the attacker's sweeper, which could pull new deposits without another wallet signature until Binance cleared the permission almost four hours later.

EIP-7702 worked as designed. Onchain researcher 0xQuit wrote that the drain would likely have happened without it, over more transactions. EIP-7702 turned temporary signing access into standing control. On the other nine chains, according to TRM, Binance's wallets signed ordinary transfers. Under the EIP-7702 specification, the permission belongs to the address, and only a new authorization signed by that address clears it. In Range's analysis, pausing withdrawals in an exchange's systems leaves that permission intact.

What did Tether, Circle and other issuers freeze, and how fast?

Tether and Circle froze stolen stablecoins at the attacker's collection wallet within about 40 minutes of the main sweep. Ripple, World Liberty and USDT0 froze their respective assets the same evening. Range measured Tether's and Circle's response from the arrival block to the freeze block, and the others from the main sweep or second wave:

• Circle froze 823M USDC at the attacker's collection wallet at 21:04 UTC, 24 minutes after the first USDC arrived.
• Tether froze about 971M USDT at the same wallet at 21:01 UTC, 37 minutes after it arrived. On TRON, Tether froze about 379M USDT between 21:09 and 21:21 UTC.
• Ripple froze 40.5M RLUSD at 22:01 UTC, about 97 minutes after the main sweep. At 22:20 UTC it also froze RLUSD inside the compromised Binance wallet, preventing further sweeps of new deposits.
• World Liberty Financial, with its custodian BitGo, froze about 27.8M USD1 at 22:10 UTC.
• USDT0 froze 6.18M USDT0 on Polygon at 23:25 UTC, about 20 minutes after the second wave.

TRM put Tether's total across Ethereum, TRON and Avalanche at about 1.77B USDT as of 00:30 UTC on October 30.

The Arbitrum Security Council used a separate governance action, so its timing is not directly comparable with the issuer freezes. At 00:08 UTC on October 30 it used emergency powers to move 8,425 ETH and about 74.56M ARB, worth about $30.5M, into a frozen wallet. Arbitrum says release will go through its governance.

Binance put the total frozen at around $3B as of 08:47 UTC on October 30.

The attacker's sweeper kept pulling USDT from Binance 14 after Tether acted. About 204M USDT landed in the already-frozen collection wallet, where Range's reads show it remains.

Why ETH, BTC, SOL and XRP could not be frozen

TRM counted about $2.4B in assets beyond any issuer's reach as of 00:30 UTC on October 30.

At 20:30 and 20:33 UTC the attacker moved 700M USDT from its collection wallet into two fresh wallets and swapped nearly all of it before Tether blacklisted both at 21:01 UTC. TRM reported that about 325M USDT went to professional fillers and market makers for about 122,300 ETH, at more than 10% over the market price. About 48M RLUSD was sold on decentralized exchanges before Ripple's freeze. On TRON, much of the stolen USDT Tether did not freeze had already been converted into TRX.

In Range's analysis, asset type determined whether an issuer could freeze funds, and speed determined how much remained. Tether acted 37 minutes after the funds arrived, but 700M USDT had already left the covered wallet. The first 500M left less than six minutes after arrival. For native assets, containment depends on limits on what a signing system can sign and how much it can reach.

Where is the stolen money now, and how is it being laundered?

This section is as of about 10:15 UTC on October 30, 2026. Amounts taken are TRM's count at 00:30 UTC.

Laundering began before the freezes, through the stablecoin swaps described above. Most unfrozen funds remain parked, with only part moving.

• Ethereum (about $3.79B taken): more than 386,000 ETH in four attacker wallets that have never sent a transaction, as of about 10:00 UTC. Range's wider trace puts the parked total at about 505,600 ETH across six wallets.
• Bitcoin (18,270 BTC, about $1.47B): split into 19 wallets in what CoinDesk described as a peel chain. The 18 wallets Range checked had not moved as of 10:13 UTC.
• TRON (612.7M USDT and 46.4M TRX, about $628M): Tether froze about 379M USDT. By Range's read of the chain, the attacker had already swapped about 234M USDT into roughly 638M TRX before Tether froze the wallet doing the swaps, and MistTrack traced stolen TRX through the Bitget Wallet Swap Bridge to an address used in the 2025 Phemex hack.
• XRP Ledger (233.46M XRP, about $296M): unmoved as of about 10:15 UTC.
• Solana (970,500 SOL, about $96M): in one attacker wallet, unmoved as of 10:01 UTC.
• Arbitrum, Optimism, Base, Avalanche and Polygon (about $77M together): partly frozen by the Arbitrum Security Council, Tether on Avalanche and USDT0 on Polygon.

The attacker converted its altcoins into ETH within hours, according to Lookonchain, and borrowed about 19,762 WETH against 60M USDT supplied as collateral, according to Aave. Range's trace shows the collection wallet funding 15 fresh wallets, one of which received 17,260 ETH at 05:15 UTC on October 30.

In a post at 04:51 UTC, ZachXBT reported that some stolen funds crossed THORChain and, by about 04:06 UTC, reached the same Ethereum address as proceeds of the September Bitget hack.

Who is behind the Binance hack?

TRM Labs attributed the attack to TraderTraitor, North Korea's state hacking unit, with high confidence. Chainalysis said it had a high degree of confidence North Korea was responsible after stolen funds mixed with proceeds of the roughly $387M Bitget hack in September, which it also attributes to North Korea. Its CEO named TraderTraitor. ZachXBT traced the same commingling through THORChain.

The FBI named TraderTraitor for the Bybit theft in February 2025. That attack also began with compromised credentials belonging to a developer at Bybit's wallet provider Safe, according to the forensic investigators Cointelegraph quoted at the time. Both thefts used valid signatures from the victim's own wallets. Range's analysis of the Drift exploit sets out defenses against North Korean threat actors.

What this means if you run hot wallets

The outcome of a signing compromise rests on controls you build before the incident. Five controls follow from October 29:

• Treat signatures that change what an address can do as privileged actions. Give EIP-7702 delegations, new token approvals and new smart-account roles their own approval path, separate from routine withdrawals. Use separate signers and infrastructure. An attacker inside the withdrawal system can reach policies hosted there too. A valid signature shows which key signed. It says nothing about whether the request behind it was genuine, the same gap Range examined in attacks that borrow a trusted channel.
• Monitor hot wallets for delegation changes. Your team owns Detection. Alert on a delegation at any address you control. Keep the transaction that clears it ready to sign, with authorized signers named in advance.
• Map everything each hot wallet can reach. Binance 14's permission over a separate smart account enabled the theft of 823M USDC. Include every role and operator right in a hot wallet's exposure.
• Size hot balances by whether they can be frozen. Stablecoins with active issuers had a backstop measured in tens of minutes on October 29. ETH, BTC, SOL and XRP have none. Smaller hot balances require more frequent cold-storage top-ups, each a signing event. Set per-asset limits that balance withdrawal speed against what a compromised signer can reach, with finance and security signing off together.
• Establish each issuer's freeze request process in advance. Name who contacts each issuer and confirm the evidence required. Records of where funds came from also reduce the risk of an issuer freezing your own funds.

Range does not prevent signing-system compromises. On October 29, our role was investigation and risk intelligence. Range's investigation agent confirmed the theft and the EIP-7702 mechanism onchain at 21:04 UTC, about 40 minutes after the main sweep. The first labels for the attacker's Ethereum wallets went live in Range's Risk API about 72 minutes after the sweep. Labels for the Arbitrum, Avalanche, Solana and Polygon legs followed overnight.

Assess how quickly you would detect a signing compromise and how much exposure sits in assets nobody can freeze. To discuss your controls with Range, contact our team.

This analysis is the work of Range's investigation team: Daniel Fiuza Dosil, Joao Crisostomo, Anupam Kumar, José Santos and Syed Choudhury, with Spidey, Range's investigation agent.