A hot wallet that signed itself away
On October 29, 2026, an attacker moved roughly $6.36 billion out of Binance hot wallets across ten blockchains, according to blockchain-intelligence firm TRM Labs — the largest crypto theft on record and about four times the $1.5 billion Bybit exploit of February 2025. Binance places its own estimate at about $6.3 billion, says about $3 billion has been frozen so far, and has pledged to cover losses from its SAFU fund and company reserves.
The first move was not a stolen key in the usual sense. At 20:24 UTC a single transaction carried about 167,000 ETH and roughly $1.6 billion in USDT out of Binance 14, one of the exchange’s most active hot wallets. Security firm Blockaid traced that sweep to Ethereum’s EIP-7702 feature, which lets an ordinary externally owned account delegate its transaction logic to a smart contract.
Fifty authorizations, one match
Minutes earlier the attacker had submitted a transaction carrying 50 signed authorizations aimed at Binance 14, one for each possible transaction counter. Because the wallet was still processing customer withdrawals, the attacker could not know which counter would be current. Forty-nine authorizations failed; one matched, and the wallet was handed to an attacker-controlled contract that drained it.
The detail that matters for custodians is that an EIP-7702 delegation belongs to the address, not to the private key. Rotating keys does not remove it; clearing it requires a fresh authorization from the same wallet pointed at the zero address. Binance says it has since revoked the affected authorizations, and its early investigation points to a compromised DevOps engineer’s laptop that gave access to a service container — with no evidence, it says, of a leaked private key.
Freezes only reach issuer-backed tokens
Stablecoin issuers moved fast. Tether froze more than 1.5 billion USDT and Circle more than 800 million USDC, contributing to Binance’s roughly $3 billion freeze total. But a freeze is a property of issuer-backed tokens: Bitcoin, Ether, TRX, and SOL have no issuer to call, and that is where the attacker’s remaining position sits.
TRM Labs attributes the operation to TraderTraitor, North Korea’s elite hacking unit, with what it describes as high confidence; Binance has made no attribution of its own. Withdrawals were paused for security checks, and the exchange expects to restore them within 48 hours, with a technical post-mortem and an updated proof of reserves to follow.
The lesson is policy, not just keys
The breach is a reminder that signing is now a policy problem as much as a key-management problem. A hot wallet signs constantly, and once a delegation is in place, every later call to that address runs the attacker’s logic with full access to its balances. The two controls that decide outcomes in this category are enforcing authorization policy before a signature is produced and continuously monitoring funds once they are in motion — the window between the first sweep and public awareness was measured in minutes.
Source: BlockchainReporter.