$6.3 Billion Left Binance in 20 Minutes. The Ethereum Trick Explains One Chain of Ten

On Thursday, October 29, roughly $6.3 billion in crypto left Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC, according to TRM Labs. Binance suspended withdrawals, says user funds are safe, and says it will cover the losses. It has not published a post-mortem. Both firms that have traced the theft call it the largest on record, about four times the roughly $1.5 billion taken from Bybit in February 2025.

This desk has not read Binance’s own posts directly. Binance’s account below comes from CoinDesk; the on-chain detail comes from TRM and Elliptic, whose published reports this desk read in full.

What Binance says

Per CoinDesk, Binance’s initial investigation suggests a compromised DevOps engineer’s laptop may have let an attacker reach a service container and submit unauthorized withdrawals. “We have found no evidence of any wallet private key leak,” Binance said. It put the impact at about $6.3 billion and, in a late Thursday update, said about $3 billion had been frozen, including $2.3 billion in USDT and USDC. Co-CEO Yi He said the exchange would cover all hacking losses; CoinDesk reports Binance will draw on its SAFU fund, which it says holds roughly $1 billion in bitcoin, along with company money. Binance says withdrawals will resume once the security issue is resolved.

What the chains show

TRM’s reconstruction begins a day early. On October 28, an operator wallet received three small Tornado Cash withdrawals. Early on the 29th the attack code was deployed and tested on two wallets, then rehearsed in its final form on a third, about four hours before it was installed on a Binance hot wallet. At 20:05 UTC five Binance XRP Ledger wallets sent 233.46 million XRP out, leaving each at its minimum balance. Solana and Optimism wallets followed, and at 20:20 a Bitcoin hot wallet sent 18,270 BTC, which the attacker split into 1,000 BTC and 100 BTC pieces.

Ethereum is where the method is clearest. TRM says the attacker submitted one transaction at 20:20 carrying 50 pre-signed EIP-7702 authorizations, a feature added in Ethereum’s May 2025 Pectra upgrade that lets an ordinary wallet hand its behavior to a smart contract. The 50 signatures covered 50 consecutive transaction counts, so whichever one matched when the transaction landed took effect. About three minutes and 24 seconds later the hot wallet’s balance went to an attacker-controlled sweeper contract, and the delegation stayed live for at least six more sweeps through 23:56.

Related Ten Minutes of AI Tracing, and a North Korea Verdict With the Working Left Out

Why one chain does not explain ten

Both firms make the same observation. The delegation trick works only on Ethereum-style accounts. Wallets on the other chains sent funds in ordinary signed transfers within the same window, with no delegation, and TRM notes they use different chains, key types and signing schemes. A second Ethereum hot wallet also sent 28,006 ETH, 55.7 million USDT and 25.9 million RLUSD without any delegation.

TRM’s inference is that the attacker most likely gained the ability to make Binance’s hot-wallet signing system sign arbitrary transactions. Elliptic reaches a similar reading: the other chains suggest the attacker was instructing the signing infrastructure. That is an inference from transaction patterns, not a finding from inside Binance, and it is broadly consistent with Binance’s description of a compromised service container. Neither firm has seen the container, the laptop or the engineer’s access, and TRM says plainly that Binance has published no root cause.

The numbers do not agree

Some of the gaps are timing. The counts were taken at different hours, and Elliptic excludes $169 million that left after withdrawals were suspended, which it believes was Binance moving its own funds. The gap on funds still out of reach is wider, roughly $0.9 billion between the two firms, and neither report explains it. Treat all of these as estimates that will move.

What froze and what could not

The frozen money is almost all stablecoin, because stablecoin issuers can block their own tokens. By TRM’s timestamps Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC and Circle froze 823 million USDC at 21:04; Elliptic puts the Tether freeze 37 minutes after the USDT arrived and Circle’s three minutes later. Ripple froze 40.5 million RLUSD, World Liberty Financial froze 27.8 million USD1, and the Arbitrum Security Council forced transfers out of the attacker’s Arbitrum wallet, moving 8,426 ETH and 74.6 million ARB.

Native assets have no issuer. Elliptic says nothing on Bitcoin, the XRP Ledger, Solana or NEAR was frozen. Both firms describe the attacker as holding well over $2 billion beyond any freeze, including the 18,270 BTC, which Elliptic says was split across 19 addresses with none yet sent to a service.

Before the freezes landed, the attacker sold. TRM says about 325 million USDT was swapped through UniswapX and other intent contracts into roughly 122,300 ETH, a discount of more than 10% to the market price. Elliptic counts about $786 million of stablecoins converted to ETH and TRX, with swap losses of 12% to 26%, which it reads as speed over value. Aave froze affected markets after a 59.9 million USDT deposit was used to borrow 19,762 ETH.

The attribution, and its caveats

TRM attributes the theft to TraderTraitor, the North Korean unit the FBI tied to Bybit, with “high confidence,” citing on-chain and off-chain intelligence and parallels with Bybit and the April 2026 KelpDAO hack: small Tornado Cash withdrawals, preparation well in advance, and signatures obtained early and executed in one burst.

Elliptic attributes it to North Korea too, but shows its working and its doubts. Its strongest link is that some Binance proceeds reached an Ethereum address that also received proceeds of the September Bitget exploit, about $39,000 of Binance funds against about $510,000 of Bitget funds. It says that overlap is small and could reflect a shared launderer rather than a shared thief, that laundering has been slower than typical for the group, and that the methods differ from Bybit’s. No government has confirmed attribution and Binance names no one.

What is still open

Binance has not said how the engineer’s laptop was compromised, how long the attacker had access, how a container could reach signing systems on ten chains, or when withdrawals return. It has not published a loss figure from its own ledgers beyond “about $6.3 billion.” Whether the pre-signed authorizations mean access was time-limited, as TRM floats, is unknown. A post-mortem is pending.