.pptx%20(54).png)
On the evening of Thursday 29 October, between about 20:05 and 23:56 UTC, Coordinated Universal Time (01:35 to 05:26 on Friday in Sri Lanka), an attacker moved roughly $6.3 billion in crypto out of Binance's hot wallets on ten blockchains. That makes it the largest theft the industry has recorded, about four times the $1.5 billion taken from Bybit in February 2025. Around $3 billion of it is frozen, Binance says it will cover every loss, and withdrawals are expected to reopen in the early hours of 1 November (UTC).
This is what was established as of 11:00 UTC on 30 October, and what is still open. All times below are UTC, with Sri Lanka time (UTC+5:30) where it matters.
The figures so far
| Item | Figure | Who says so |
|---|---|---|
| Taken in total | about $6.3 billion | Binance |
| Taken, valued at the moment of each transfer | $6.36 billion | TRM Labs |
| Taken, second estimate | about $6.4 billion | Chainalysis |
| Frozen, all parties | about $3 billion "verified" | Binance, 00:52 on 30 October |
| Tether (USDT) frozen | more than 1.567 billion USDT | Paolo Ardoino, Tether's chief executive |
| Circle (USDC) frozen | 823 million USDC | TRM Labs |
| Ripple's RLUSD frozen | 40.5 million, confirmed on-chain | TRM Labs |
| World Liberty Financial's USD1 frozen | 27.8 million | TRM Labs |
| Arbitrum Security Council | about $30 million in ARB and ether | TRM Labs |
| Still in the attacker's hands | over 420,000 ether and 18,270 bitcoin, about $2.4 billion | TRM Labs, 00:30 on 30 October |
The issuer freezes in the table add up to about $2.5 billion. Binance has not broken down the rest of its $3 billion figure; its co-chief executive Yi He has credited Ripple with stopping about $200 million, which is more than the 40.5 million TRM Labs could confirm on-chain.
Four hours, step by step
| UTC | Sri Lanka | What happened |
|---|---|---|
| 28 Oct | 28 Oct | The attacker's operating wallet is funded through the Tornado Cash mixer (TRM Labs) |
| about 16:00 | 21:30 | A "sweeper" contract that only the attacker can operate is deployed on Ethereum (CoinDesk) |
| 20:05 to 20:09 | 01:35 to 01:39 | 233.46 million XRP leaves five Binance XRP Ledger wallets |
| 20:20 | 01:50 | 18,270 bitcoin leaves a Binance hot wallet; 612.7 million USDT and 46.4 million TRX leave a Tron hot wallet within two minutes |
| 20:20:59 | 01:50 | One Ethereum transaction carries 50 signed permissions for the hot wallet Etherscan labels "Binance 14" |
| 20:24:23 | 01:54 | Binance 14 sends out its whole balance: 167,464 ether and 63 tokens, including about 1.6 billion USDT |
| 21:01 | 02:31 | Tether freezes 971.1 million USDT in the main receiving wallet |
| 21:04 | 02:34 | Circle freezes 823 million USDC |
| 23:35 | 05:05 | Binance says $2.54 billion is frozen |
| 00:10:35 | 05:40 | Binance removes the attacker's permission from Binance 14 |
| 00:52 | 06:22 | Binance raises the frozen figure to $3 billion |
| 08:37 | 14:07 | Binance reports more points of breach and says withdrawals should reopen in about 45 hours |
The 20:20:59, 20:24:23 and 00:10:35 entries come from the Ethereum transactions themselves, read from a public node (the permissions, the sweep and the removal); the rest are from TRM Labs, CoinDesk and Binance's posts on X. Withdrawals were paused that evening; Binance briefly suspended deposits too, and by 04:17 on 30 October said deposits were working normally.
What Binance says went wrong
Binance's first finding, posted overnight and repeated by co-chief executive Richard Teng at 07:37 on 30 October, is that a DevOps (development and operations) engineer's laptop was compromised and may have given the attacker access to a service container that submitted the unauthorised withdrawals. Binance says it has found no evidence that any wallet private key leaked. Teng added that the attack was a multi-step process rather than a single action, and that no individual has been blamed.
At 08:37 Binance said investigators had found further points of breach beyond the laptop, without describing them. It has promised a full post-mortem once the investigation ends, and an updated proof of reserves.
How one Ethereum permission emptied a wallet in minutes
Ethereum's Pectra upgrade, live since 7 May 2025, added EIP-7702 (Ethereum Improvement Proposal 7702). It lets an ordinary account sign an "authorisation" that points it at a smart contract. Once any transaction carrying that authorisation is mined, the account runs the contract's code, and whoever controls that code controls the account's funds.
Each authorisation names the account's next transaction number (its nonce), and the network accepts it only if that number is exactly right. Binance 14 was busy, sending about 630 transactions in the hour before the attack, so its number kept moving. The attacker's transaction therefore carried 50 authorisations, for nonces 18,914,824 down to 18,914,775, all pointing at the sweeper. The network skips any authorisation whose number is wrong, and the one that matches moves the counter on, so with the list in descending order exactly one could succeed. Public node data shows Binance 14's counter at 18,914,808 before that block and 18,914,810 after it: a transaction Binance 14 sent earlier in the same block used 18,914,808, and the attacker's authorisation took 18,914,809. The wallet's code changed to the 23-byte marker that points at the sweeper.
Three minutes and 24 seconds later, the attacker called the wallet through the sweeper and it paid out everything. The permission stayed in place for almost four hours, and TRM Labs counts several more sweeps of customer deposits that kept arriving, the last at 23:56. Binance cleared it at 00:10:35 by sending its own authorisation to the zero address, which wipes the code.
Two points follow. The attacker never needed the wallet's private key, only valid signatures over those 50 authorisations. And the other nine chains have no such feature: there the money left as ordinary signed transfers. TRM Labs reads that as a compromise of Binance's hot-wallet signing system, possibly for a limited window. How the signatures were obtained is the question the post-mortem has to answer.
Who is blamed
TRM Labs attributes the attack, with high confidence, to TraderTraitor, the North Korean hacking unit that the US Federal Bureau of Investigation (FBI) named for the Bybit theft. Chainalysis reached the same conclusion after watching the stolen funds mix with money from the September theft at the Bitget exchange, which had been attributed to North Korean actors. Binance has not named the attacker, and none of the coverage cited here reports a government attribution yet.
Where the money is going
Stablecoins could be frozen within the hour because their issuers can block addresses. Bitcoin has no issuer: the 18,270 bitcoin were split into 19 addresses, 17 of them holding exactly 1,000 each, and none had moved by 04:23 on 30 October, according to CoinDesk. The attacker also turned about 325 million USDT into ether at a discount of more than 10%, and borrowed about 19,760 ether on the Aave lending protocol against 60 million USDT before Aave froze the affected markets (TRM Labs). After Bybit, the same group took about ten days to convert stolen ether into bitcoin, so the next steps are likely to run through bridges, swap services and over-the-counter brokers.
For anyone with money on Binance
- Losses: Binance says it will cover all of them from its Secure Asset Fund for Users (SAFU) and company funds. At 10:55 on 30 October it said it had set aside more than $6.34 billion, about $5 billion of it already in the affected tokens, and was buying the rest on the market.
- Access: deposits work; withdrawals are expected back in the early hours of 1 November (UTC), about 45 hours after the 08:37 update. Expect queues when they reopen.
- Scams: Binance has told users to watch for scams. A hack this size brings fake "compensation", "wallet verification" and "withdrawal unlock" messages. Use only the official app and binance.com, and give nobody your password, two-factor codes or recovery phrase.
- Prices: bitcoin fell below $77,000 and BNB dropped 7.1% to $698.65 in the hours after the theft, and $1.55 billion of leveraged positions were liquidated in 24 hours (The Block, citing CoinGlass, at 02:00 on 30 October). These figures move by the minute.
The next 48 hours for Binance users
There is nothing to do on Binance itself until withdrawals reopen except ignore unofficial messages. When they do, the useful checks are the updated proof of reserves, to see that the gap has been refilled, and the post-mortem, which should say how an attacker obtained signatures from a hot-wallet system without its keys. Until that is published, the question of how safe exchange hot wallets are after EIP-7702 stays open.
