The Binance hack: 20 minutes, $6.3 billion, and a recovery that isn’t over

At 20:05 UTC on Thursday 29 October, five Binance wallets on the XRP Ledger began emptying. Twenty minutes later, the thief had moved billions of dollars across several blockchains. By the end of the night, Binance had a problem no exchange wants to explain to its users: its own hot wallets had authorized the withdrawals.

The first retelling was deceptively simple: one engineer’s compromised laptop, one attacker, roughly $6.3 billion gone. The emerging evidence is more uncomfortable. This was not simply a password reset that failed, and it does not look like a flaw in Bitcoin or Ethereum. The systems Binance used to produce valid withdrawal signatures did what they were asked to do — for the wrong person.

A week later, the FBI has attributed the theft to North Korea’s TraderTraitor group. Around $2.85 billion has been frozen or seized, withdrawals are reopening in stages, and Binance says it has replenished 95% of the affected assets using its own money. But the laundering is not over, the final 5% is still being sourced, and the detailed technical post-mortem has not yet been published.

Here is what actually happened, and what all those numbers mean.

First, the numbers are estimates — and they differ

Binance puts the impact at approximately $6.3 billion. The two analytics firms tracking the transfers have slightly different totals:

TRM’s list covers XRP Ledger, Ethereum, Bitcoin, Tron, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. Elliptic also includes NEAR. The firms used their own address attributions, token prices and valuation times, so the small difference is not evidence that one of them is necessarily wrong.

Elliptic also excluded another $169 million that left Binance after withdrawals were suspended. Those transfers went to long-established addresses with no known link to the attacker and appear to be Binance moving its own funds.

The broad picture is not in doubt: this is the largest cryptocurrency theft on record, roughly four times the $1.46–1.5 billion Bybit hack of February 2025. Most of the money left in approximately 20 minutes, with a second wave of suspicious withdrawals around 23:05 UTC.

The attack timeline

Investigators now have a remarkably detailed public timeline. The important moments are these:

That last point matters: service restoration is still a rollout, not a single switch that has already returned every token on every network.

The laptop is only the beginning of the story

Binance’s initial incident update said the breach may have involved a compromised DevOps engineer’s laptop. That access reportedly allowed the attacker to reach a service container and submit unauthorized withdrawal transactions.

In its second update, the company said investigators had found additional points of breach. Co-CEO Richard Teng later said the attackers used a self-destruct mechanism to remove tooling and traces, complicating the investigation.

Two cautions are important here. First, Binance has not attributed responsibility to the engineer. A compromised machine is an entry point, not evidence that its owner did anything wrong. Second, the company has repeatedly said it found no evidence that wallet private keys were leaked.

That does not make the incident less serious. A private key can remain safely inside a signing system while an attacker abuses that system as an oracle: submit a transaction, receive a perfectly valid signature, and broadcast it to the network. There is no need to steal the underlying key if the machine holding it will sign for you.

TRM’s cross-chain evidence points in that direction. Wallets using different cryptography and signing schemes produced valid transfers for the attacker in the same short window. The most plausible explanation is a compromise of the withdrawal-signing infrastructure, not ten unrelated cryptographic failures.

The complete attack sequence is still unproven. Until Binance publishes its post-mortem, “a laptop led to a broader compromise of signing infrastructure” is a more honest summary than “a single laptop caused everything.”

What EIP-7702 did — and did not do

The most technical part of the attack happened on Ethereum, using EIP-7702. Introduced in Ethereum’s Pectra upgrade in 2025, it lets a regular externally owned wallet delegate its behaviour to a smart contract by signing an authorization. In effect, calls to that wallet can then execute the contract’s code.

This is a legitimate feature. It was not an Ethereum vulnerability being exploited in the way a smart-contract bug might be.

At 20:20 UTC, the attacker submitted one transaction containing 50 valid authorizations, all signed by a Binance hot wallet. Each authorization covered a different consecutive nonce — the transaction counter an Ethereum account increments as it sends transactions.

Why fifty? A busy exchange wallet’s nonce advances constantly as customers withdraw. By preparing signatures for a range of future positions, the attacker made it highly likely that one authorization would still be valid when the transaction landed. One was enough.

That authorization delegated the wallet to a sweeper contract controlled by the attacker. About three and a half minutes later, the contract emptied the wallet of 167,464 ETH and 63 tokens, including approximately 1.6 billion USDT. Because the delegation persisted, the attacker could sweep later deposits without asking for another signature. The compromised wallet’s owner rights over another Binance account also allowed the attacker to pull 823 million USDC, which Circle subsequently froze.

On other networks, the money moved through ordinary signed transfers. Another Ethereum hot wallet also sent funds directly, without EIP-7702 delegation. So the story is not “EIP-7702 caused the Binance hack.” It is “a broader signing compromise included a particularly effective use of EIP-7702 on one wallet.”

The freeze was fast. Some assets cannot be frozen at all.

The first defensive wins came from centralized issuers. Tether, Circle, Ripple, World Liberty Financial and others blacklisted affected addresses. Arbitrum’s Security Council moved 8,426 ETH and 74.6 million ARB out of the attacker’s reach; Optimism governance later secured 44 million OP.

Elliptic’s latest total is $2.85 billion frozen or seized, about 44% of its estimated theft and close to Binance’s “around $3 billion.” Almost all of it was stablecoins. Arbitrum and Optimism were the only networks on which Elliptic says everything stolen was secured.

This creates an obvious but essential distinction:

• USDT, USDC and other issued tokens can often be frozen by their issuer.
• BTC, ETH, XRP, SOL and similar native assets cannot be frozen by a central issuer. They can generally only be stopped when they reach an exchange or another service willing and able to intervene.
• Freezing a DeFi market is different again. Aave froze affected markets, blocking new activity, but that did not seize the attacker’s existing loan.

The attacker understood this. Elliptic estimates that about $786 million in stablecoins was rapidly converted into ETH and TRX, in some cases accepting prices 12–26% below the market. Speed mattered more than execution quality. The 18,270 BTC was split into 19 addresses, mostly holding 1,000 BTC each. The 233 million XRP remained in place.

Frozen is not the same as recovered. An issuer can immobilize tokens without having yet returned them to Binance. And Binance replenishing customer assets with company money is a separate process from recovering the original coins from the attacker.

Why investigators blame TraderTraitor

On 31 October, the FBI, working with the US Secret Service and IRS Criminal Investigation, formally attributed the theft to North Korea’s TraderTraitor. The bureau published associated Bitcoin, Ethereum and Solana addresses and asked virtual asset services to block transactions linked to them.

The attribution is not based only on the scale. Elliptic found Binance funds being laundered alongside proceeds of September’s Bitget exploit, which it had already assessed as likely North Korea-linked. It also found common service usage with earlier TraderTraitor thefts. TRM cited both on-chain and off-chain intelligence, while the preparation, staff targeting and abuse of legitimate signing systems resembled the Bybit operation.

The FBI says the group is converting assets primarily into ETH before moving them through DeFi and instant swap services.

And “laundering” here does not mean a few people manually clicking through wallets. Between 30 October and 1 November, Elliptic counted 1,113 transfers from the main Tron laundering wallet, with a median gap of 90 seconds. Tokens were sold in dozens of small slices, fresh wallets received templated amounts for fees, and activity continued through two nights in Pyongyang.

That strongly suggests conventional automation. It does not prove that an AI agent was responsible. Elliptic explicitly says on-chain evidence cannot currently distinguish an AI agent from an ordinary laundering script.

What “user funds are safe” means now

Binance has promised to absorb the loss through its SAFU fund and corporate treasury, rather than reduce customer balances. By 30 October it said it had set aside more than $6.34 billion, including $5 billion in the same token types that were stolen, covering roughly 80% at that point.

Its 1 November recovery update raised that to approximately 95%. The remaining 5% consists of less liquid tokens outside the top ten, which are taking longer to acquire at scale.

The same update said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were 100% backed. On 2 November, Binance completed the zero-knowledge proof for its 31 October snapshot, allowing users holding those ten tokens to verify that their balances were included and backed at least 1:1.

That is meaningful evidence, but it has limits. It is a snapshot of backing for those assets, not an explanation of the breach, not a recovery of stolen coins, and not proof that the remaining 5% has already been acquired.

Withdrawals began reopening on 1 November, with deposits having remained open. More network-asset pairs resumed on 3 November. Availability still depends on the specific asset and network, and Binance warns of delays while demand is high. The first reopening also brought a visible confidence test: Business Insider reported about $3.64 billion in net outflows in under ten hours.

In short: users are being made whole with Binance’s resources, but the recovery operation and the criminal investigation are still running.

The lessons that matter

For exchanges and treasury teams, the technical recommendations are unusually concrete.

Turn signing into a narrowly scoped privilege. Separate approval paths by chain and wallet tier. A single compromise should not produce valid signatures across an entire multi-chain withdrawal system.

Alert on EIP-7702 delegations. Treasury systems should detect code appearing at an address that should have none, reject unexpected authorization types, and treat batches covering many future nonces as a possible compromise. A revocation procedure needs to be prepared and rehearsed before an incident.

Design for a compromised endpoint, not just a stolen key. Container access, service-to-service permissions, signing policies and approval boundaries all need independent limits. Tamper-resistant logs matter when attackers actively try to erase their tracks.

Prepare the issuer and governance relationships before you need them. The first freezes arrived within tens of minutes. Knowing exactly whom to call at a stablecoin issuer or network security council is a real defensive control.

Screen continuously. Static address lists age quickly when software can create hundreds of wallets and send transfers every ninety seconds. A wallet that looked clear yesterday may be part of the laundering cluster tomorrow.

For individual users, the useful action is less dramatic: use official Binance channels, check availability for the exact network and token, and expect lookalike “support” accounts to exploit the incident for phishing.

The part still missing

We do not yet have Binance’s complete root-cause analysis. We do not know every additional point of breach, how the attacker reached the signing paths, or the final amount that will eventually be recovered rather than frozen. The last 5% of less liquid assets is still being sourced. And billions of dollars in native assets remain beyond an issuer’s direct reach while the laundering continues.

The headline is the $6.3 billion. The more durable lesson is the trust path: an attacker did not need to break the cryptography securing ten or eleven blockchains. They needed the systems around those blockchains to say “yes” on their behalf.

That is why this attack will matter long after the market has moved on. The cryptography worked. The approval system did not.