On October 29, 2026, at roughly 4:20 p.m. Eastern, funds started leaving Binance hot wallets that nobody at Binance had approved. by the time the dust settled the next morning, Chainalysis put the theft at about $6.4 billion and Binance at $6.3 billion. That makes it the largest crypto theft on record, roughly four times the size of the Bybit hack that held the title since February 2025. the headline nubmer is brutal. The more interesting number is the other one: close to $3 billion of it was frozen on chain within hours, and almost all of that came from a single source. Stablecoin issuers pressed a button.
That button is the part of crypto most crypto natives love to complain about. This week it was the only thing that worked.
What happened in the Binance hack?
Binances initial investigation points to a compromised DevOps engineers laptop. From there, the attacker reached a servce container and submitted withdrawal transactions that the system treated as legitimate. Binance later said it had found additional points of breach beyond the laptop, and that it had seen no evidence of a wallet private key leak..... A full post mortem is promised once the facts are verified. Then again, Co CEO Richard Teng described something more surgical than a smash and grab. He said the attack was not a one click actiom, that the attacker used a self destruct mechanism to clean up traces.... And that an EIP 7702 delegation gave the attacker execution authority over a hot wallet, bypassing the normal approval controls. Blockaids Ido Ben Natan put it plainly: the upgrade gave attackers a way to do this in one sweep. Without it, the same drain would have needed many seperate transactions, each one a chance for monitoring to trip.Chainalysis and TRM Labs both attribute the theft to TraderTraitor, the North Korean unit the FBI named for the Bybit hack. TRM says it holds that view with high confidence. On chain investigator ZachXBT and Chainalysis both found Binance proceeds commingled with funds from last months Bitget exploit, arriving at the same addres via THORChain. Same actor, second exchange in about four weeks.
How did EIP 7702 make the drain faster?
EIP 7702 shipped with Ethereums Pectra upgrade.. It lets an ordinary externally owned account delegate its execution to smart contract code, so a normal wallet can batch transactions, sponsor gas, or follow custom spending rules. , Under the EIP-7702 specification, that delegation is set by a signed authorization and stays in force until it is replaced or cleared.
For users, that is a convenience feaure. For an attacker who gets a valid authorization signed from inside an exchanges infrastructure, it is a master key with a built in batch processor.. Instead of pushing withdrawals one at a time through approval queues, the delegated code can sweep a wallet in a single flow. Ambires Ivo Georgiev flagged the follow on risk: engineers who regain controle of a compromised account may not realize a malicious delegation is still attached to it.
None of this means EIP 7702 is broken. It means exchange signing infrastructure now has a new class of permission to monitor. And at least one of the biggest operators in the industry was not watching it closely enough.
Who froze what, and how fast?
Chainalysis timed the first freezes at 5 14 p.m. Eastern, about 54 minutes after the first outflows.... Tethers Paolo Ardoino and Circles Jeremy Allaire were posting freeze totals before Binance had even halted withdrawals.. Here is what the issuers and protocols reported.
| Freezing party | Asset | Amout frozen | Freeze mechanism |
|---|---|---|---|
| Tether | USDT | More than $1.567 billion | Issuer blacklist in token contract |
| Circle | USDC | More than $800 million | Issuer blacklist in token contract |
| Arbitrum Security Council | 74...6M ARB and 8,425 ETH | About $30.5 million | Emergency governance acton on Arbitrum |
| World Liberty Financial | USD1 and WLFI | $27 million USD1, $2 million WLFI | Issuer blacklist |
| Ripple | RLUSD | Undisclosed | Issuer blacklist |
| First Digital | FDUSD | Undisclosed | Issuer blacklist |
| Nobody | ETH on mainnet, BTC | $0 | None exists |
Binances own runnng total reached about $3 billion frozen. Chainalysis puts it closer to $2...8 billion, and Elliptic estimated that about 44 percent of the stolen assets were frozen, with stablecoins accounting for nearly all of that. tether and Circle alone account for roughly $2..37 billion. Strip out the stablecoin issuers and the industrys collective freeze effrot comes to a few tens of millions of dollars, most of it from a single emergency action by Arbitrums Security Council.
Why could the hackers keep the other $3 billion?
Because the other $3 billion was, or quickly became, assets that nobody controls. Native ETH and BTC have no admin key and no blacklist function.... Once stolen vaule sits there, the only tools left are tracing, exchange cooperation, and luck. Granted, The attackers knew this and moved accordingly.... chainalysis traced roughly $500 million in stablecoins into a wallet built for one job, converting freezable assets into unfreezable ones. Over about 20 minutes, $325 million in stablecoins became $285 million in ETH. About ten minutes laetr, the remaining $175 million was pushed out to stopover wallets. , TRM Labs says the attackers also sold USDT to market makers and borrowed ETH against stablecoin collateral.Interestingly, that last tactic hit Aave directly. Around 40 minutes before the freezes landed, the exploiter deposited 60 million USDT and borrowed about 19,762 WETH, worth roughly $44.6 million..... LlamaRisk confirmed the positoin was overcollateralized and posed no risk to suppliers. Aave still froze 175 V3 reserves across 16 networks and 117 V4 reserves across four networks as a precaution, then re enabled lending and borrowing on October 30... The trade logic is grimly clever: post USDT that might get frozen, walk away with ETH that cannot be, and let the lending protocol hold the bag of blacklisted collateral.
Our analyisis of the Chainalysis flow data shows what speed was worth to the attacker. Swapping $325 million of stablecoins into $285 million of ETH cost about $40 million, a 12.3 percent haircut from slippage and rushed execution. Paying more than one dollar in eight to escape the freeze list tells you how seriously North Koreas operators take Tethers and Circles repsonse time. Chainalysis also flagged thousands of automated transactions, with many fresh addresses first receiving exactly 1 TRX, and Levin said large sums were moved to Tron addresses.
Binance hack vs Bybit hack what changed?
| Metric | Bybit (February 2025) | Binance (October 2026) |
|---|---|---|
| Amout stolen | About $1.5 billion | $6.3 to $6.4 billion |
| Attributed to | TraderTraitor (FBI) | TraderTraitor (Chainalysis, TRM Labs) |
| Entry point | Compromised developer machine at a wallet provider | Compromised DevOps engineer laptop, plus further breach points |
| Stolen asset mix | Mostly ETH and staked ETH | Large stablecoin share plus ETH, BTC and other tokens |
| Frozen share | A small fraction | About 44 to 48 percent |
| First issuer freezes | Liimted, few freezable assets | About 54 minutes after first outflows |
The contrast is the story.. Bybit lost almost entirely unfreezable ETH, and the recovery effort was mostly an exercise in watching it get laundered.. binance lost a far bigger pile, but a far bigger slice of it sat in tokens with an issuer behind them. , The more of an exchanges hot walltet is held in centrally issued stablecoins, the more of a theft can be clawed back.... , That is an uncomfortable lesson for anyone who sold stablecoins as crypto without the volatility and skipped the with a kill switch part.
Are Binance customers covered?
Binance says yes. Co founder Yi He said the exchange will cover all losses, and Changpeng Zhao posted that he expects user funds to be fully covered. Binance says it has set aside more than $6.34 billion in company funds, about $5 billion of which is allready held in the same tokens that were stolen. It is buying the rest over the counter and on exchanges, warning that thin liquidity may slow some purchases.
Surprisingly, deposits kept working... Withdrawals were paused at 6:55 p.m. Eastern on October 29, and the latest guidance targets a phased restart within about 40 hours of Binances October 30 updaet, which lands this weekend... An updated proof of reserves is due by Monday.. Binance is reportedly working with the FBI.
Just so you know, counterparties disclosed their exposure quickly. Wintermute said its exposure was less than 20 percent of net equity, and GSR said less than 5 percent. Bybit confirmed it was not affected.
How did the crypto makret react?
Badly, though the hack landed on an already shaky day after a Fed hold and weak tech earnings.... By October 30, CoinGecko data showed Bitcoin down 4...9 percent over 24 hours to about $76,937.... Ether fell 5...7 percent to around $2,211. BNB dropped 8 percent to roughly $693, AAVE lost 11...3 percent and UNI 10.7 percent.... The Bitcoin Fear and Greed Index fell to 30, its lowest redaing since August.
What this means for anyone holding crypto on an exchange
A few practical takeaways, none of them new, all of them freshly underlined. More importantly, Exchange balances are an IOU. Binance appears able to absorb a $6 billion loss. Very few operators on earth could.... Withdrawal pauses happen even when the exchange is solvent, and they happpen exactly when you most want your coins.Stablecoin freezes cut both ways. The same blacklist that saved roughly $2.4 billion here is the one that can lock an innocent wallet that happened to receive tainted funds. if you receive USDT or USDC from an unknown source after a major hack, check the sending address against public trackers before you move it on.
Keep idle funds in self custody. This applies to trading accounts and gambilng balances alike. Platforms such as CryptoCasino.Vegas that pay winnings straight back to the players own wallet make the principle easy to follow: the less time your coins sit in someone elses hot wallet, the less a compromised laptop half a world away can cost you.
The final recovery figure will move as tracing continues, and history says it moves down, not up. Levins own summery of the laundering phase is the right one to remember: the further funds travel, the fewer the seizure opportunities... The freeze button bought back nearly half within an hour... Everything after that is a chase.
