Binance confirmed on Friday that attackers stole approximately $6.3 billion across several blockchains in what the exchange described as the largest theft in cryptocurrency history. The company has pledged to cover all losses.

On Ethereum alone, roughly $2.5 billion was drained from a Binance wallet in under four minutes using the network's EIP-7702 feature, and about $3 billion of the affected assets have since been frozen.

The exchange said its initial investigation suggested the security incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional points of breach.

Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU

— Binance (@binance) October 30, 2026

A Four-Minute Drain on Ethereum

The attacker used EIP-7702, a feature that went live in May 2025 as part of Ethereum's Pectra upgrade, to move about $2.5 billion in ether and tokens out of a Binance wallet in less than four minutes on Thursday.

Most Ethereum wallets are controlled by a single private key and cannot enforce rules such as spending limits. EIP-7702 lets an ordinary wallet borrow code from a smart contract by signing a short message known as an authorization. The feature was built to help wallets batch payments and to let third parties cover transaction fees.

Within weeks of the upgrade's launch, trading firm Wintermute found that most early delegations pointed to “sweeper” scripts — programs that forward a wallet's funds to a thief — an early sign that the feature was being abused for theft.

How the Binance hack worked: The attacker exploited EIP-7702 – an Ethereum Pectra upgrade That lets a regular wallet temporarily act as a smart contract with a valid private key signature. Hacker pre-collected 50 EIP-7702 authorizations with sequential nonces Not knowing the… pic.twitter.com/Cq5lv8Qwc7

— philarekt (@philarekt) October 29, 2026

How the Attack Unfolded

The attacker began funding their main wallet through Tornado Cash, a crypto mixing service, starting on Wednesday. They tested the plan on their own wallets and deployed a sweeper contract at about 16:00 UTC on Thursday, configured so that only the attacker's wallet could operate it.

At 20:20 UTC, the attacker sent a single transaction containing 50 authorizations. Each was signed by a wallet labeled “Binance 14” on Etherscan and carried a different transaction counter value, or nonce, so that one would match as the wallet kept sending withdrawals. Ethereum accepted the authorization numbered 18,914,809 and ignored the other 49.

At 20:24 UTC, the attacker moved about 167,464 ETH and 63 tokens, including roughly 1.6 billion USDT. More customer deposits were swept from the wallet at 21:04 and 21:44 UTC. According to TRM Labs, the attacker also used the wallet to order a separate Binance wallet to send out 823 million USDC. The permission was not revoked until 00:10 UTC on Friday — nearly four hours after the initial transaction.

The Theft Extended Beyond Ethereum

The operation was not limited to Ethereum. The attacker also moved 18,270 bitcoin, hundreds of millions of XRP, and funds on Solana and Tron. Those networks do not use EIP-7702, and the funds left through ordinary signed transfers, TRM Labs said.

Investigation Points to a Compromised Laptop

Binance co-CEO Richard Teng said early findings pointed to a compromised DevOps engineer's laptop. He said the attack was not a single “one-click” action and that there was no evidence private keys had leaked.

Binance later said investigators found additional breach points, but the company did not name them or explain how the attacker obtained the signatures.

Security Firms Weigh In

Security firms said the upgrade did not cause the hack but may have helped the attackers bypass checks. Ido Ben-Natan, CEO of security firm Blockaid, said attackers could have stolen the funds without EIP-7702, but that the feature let them do it in one sweep and may have helped circumvent some checks. Ivo Georgiev, CEO of wallet provider Ambire, offered a contrasting assessment, saying the feature made little difference because the hackers could already authorize transactions.

Because the operation also involved ordinary signed transfers on networks that do not use EIP-7702, the incident does not establish that the Ethereum feature alone accounted for the full theft. The additional breach points and the still-unpublished attack path leave the scope of any security changes unresolved.

Binance Pledges to Cover Losses

Binance said about $3 billion of the affected assets have been frozen. The exchange plans to use its SAFU emergency fund and company funds to cover the losses. The full attack path has not been published. Further clarity will depend on Binance's investigation, including an explanation of the additional breach points and how the signatures were obtained.