Attackers drained most of roughly USD 6.3 billion from Binance's hot wallets in about 20 minutes, and the full sequence of the heist is now available as a timeline. According to blockchain analytics firm TRM Labs, the thieves had the exchange's own signing system sign the transactions for them.

A crypto exchange holds customer funds partly in hot wallets that stay online to process withdrawals, while the rest sits offline in cold storage. Every withdrawal first passes through a signing infrastructure that checks requests against internal policies; only then does it sign them with the hot wallet keys. Whoever controls this layer consequently needs no private key at all. Binance reported the theft on October 29, 2026, and cited further points of entry the following day.

The pattern closely resembles the Bybit hack of February 2025, in which the approval layer likewise failed and no contract bug played a role. TRM attributes the attack to North Korea with high confidence. In its reconstruction of the attack, it puts the loss at USD 6.36 billion across ten chains. Elliptic, by contrast, arrives at USD 6.43 billion across eleven chains, with each asset valued at the time of transfer. A root cause report promised by the exchange should clarify the exact cause.

36 hours of preparation via Tornado Cash

The groundwork began at least 36 hours before the theft. Starting October 28, 2026, a newly created operator wallet received small amounts through the mixer Tornado Cash — three withdrawals of 0.1 ETH each, according to Elliptic. Around 16:00 UTC on October 29, 2026, the attackers deployed the sweeper contract to the blockchain. The program drains balances in bulk and accepts commands only from the operator wallet. According to security firm Immunefi, it consists of just around 130 lines of code.

Earlier that same day, the attackers had tested a first version of the code on two wallets. Roughly four hours before the attack, they rehearsed the final version on a third wallet, after which the test funds flowed back to the operator. The attackers thus checked the code twice and rehearsed it once. TRM sees the same pattern as in the Bybit hack and the attack on KelpDAO in April 2026.

How the Binance hack unfolded, minute by minute

In an initial statement, Binance named a possibly compromised laptop belonging to a DevOps engineer as the entry point. Through this machine, the attackers had allegedly reached a service container and submitted unauthorized withdrawals; according to this account, there was initially no sign of leaked private keys. On October 30, 2026, however, the exchange reported further points of entry and described a complex attack that no single person had carried out. Binance has not yet disclosed which points these are, so the laptop remains an unproven first claim.

The outflows began at 20:05 UTC on October 29, 2026, on the XRP Ledger. By 20:09, five Binance wallets there had sent 233.46 million XRP — worth around USD 296 million — to a single address, with each wallet stopping at its minimum balance. Shortly after 20:10, Solana followed with 970,500 SOL, along with Optimism. At 20:20, the Bitcoin hot wallet sent out 18,270 BTC worth around USD 1.47 billion; a so-called peel chain split the amount into chunks of 1,000 and 100 BTC within the same block. At the same time, the Tron hot wallet lost 612.7 million USDT and 46.4 million TRX within two minutes. With the Ethereum sweep at 20:24, the main phase had lasted about 20 minutes. Finally, a second wave hit Avalanche and Polygon around 23:05.

TRM draws its central conclusion from this sequence. On its own, the Ethereum delegation could look like phishing. Yet the attackers drained nine other chains with ordinary signed transfers, without any delegation. TRM therefore concludes that the hot wallet signing system itself signed for the attacker. Data from Elliptic backs this reading: a second Ethereum hot wallet called "Binance 16" has its own key, and it sent 28,006 ETH and other tokens directly to the attacker, together worth USD 174 million at the time of the theft.

How 50 authorizations unlocked the sweeper

On Ethereum, the attackers used a feature that arrived with the Pectra upgrade in May 2025. Under EIP-7702, a regular wallet signs an authorization that points to a smart contract and then runs its code. The signature covers only the chain ID, target address and nonce — not the individual transaction. The nonce is the account's counter. Neither the recipient nor the amount is part of the signature, and anyone may submit such an authorization. The specification itself warns that delegation gives the code unrestricted access to the account.

At 20:20:59 UTC, the attackers submitted a transaction with 50 authorizations. Each carried a signature from the "Binance 14" wallet key and pointed to the sweeper. That many were needed because the nonce must match exactly while the high withdrawal rate kept advancing the counter. The series covered nonces 18,914,775 to 18,914,824; in the end, only nonce 18,914,809 hit, and the network discarded the other 49. TRM reads the series as a sign of time-limited access or of a route through a request system.

At 20::23 UTC, the attacker then called the sweeper via Binance 14. A single transaction drained 167,464 ETH and 63 tokens — including about 1.6 billion USDT — together worth around USD 2.5 billion.

The delegation remained active afterward, because EIP-7702 keeps it in place until the next authorization. The specification justifies this with convenience, since users should not have to set up new contracts all the time. Here, however, the same property enabled further sweeps of new deposits without a new signature. These followed at 20:41, 21:04, 22:39 and 23:56 UTC, among others. Binance 14 revoked the delegation only at 00:10 UTC on October 30, 2026 — almost four hours later.

Through the compromised wallet, the attackers also instructed another Binance wallet and drained 823 million USDC from it. According to TRM, this second wallet is a separate smart account. In total, Binance lost USD 3.79 billion on Ethereum by TRM's count.

The race against stablecoin freezes

Stablecoins such as USDT, USDC and RLUSD have a central issuer that can freeze individual addresses. Bitcoin and Ether lack such an authority, so only an exchange that freezes incoming funds or authorities with access to the keys can stop them. Yet Tether and Circle froze the first addresses only about an hour after the outflows began.

According to Elliptic, the attackers swapped 434 million USDT into 160,451 ETH via Uniswap, 1inch and market makers, accepting a discount of 12 to 26% below market price — which Elliptic reads as speed taking priority over value. By the time of the first freezes, around USD 786 million in stablecoins had already moved into ETH and TRX.

A second attacker wallet also turned to the lending protocol Aave. It deposited 59.9 million USDT as collateral and borrowed 19,762 ETH worth around USD 44 million. As a result, the freezable USDT now sits in the Aave pool, while the ETH stayed with the attacker. Aave froze the affected markets as a precaution and has since reopened them; the positions remain fully collateralized.

On Tron, the attackers swapped 234 million USDT on SunSwap into 638 million TRX. According to Elliptic, the main laundering wallet there executed 546 TRX transfers at a median interval of 96 seconds. In its own analysis, Chainalysis classifies the transaction pattern on Tron as automated: many addresses first receive exactly 1 TRX, then the amount they subsequently forward. Elliptic, though, cannot judge whether AI agents play a role.

TRM puts the non-freezable remainder at around USD 2.4 billion in Bitcoin and Ether. Including XRP and TRX at current prices, Elliptic arrives at USD 3.21 billion. The bitcoin sits spread across 19 addresses via a peel chain and has not yet reached any service. Analysts therefore expect bridges, swap services and OTC desks as the next stage.

The controls exchanges need to add

TRM's recommendations target exactly these weak points. Exchanges should reject EIP-7702 authorizations unless they expect them, and they should treat requests for many authorizations across a nonce range as a sign of compromise. TRM additionally recommends separating signing infrastructure and approval paths by chain and wallet tier. On treasury wallets, any delegation is an immediate alarm, because an address that should hold no code suddenly carries some.

At Binance, according to the exchange, the delegation did not pass through the normal approvals, and the revocation came only after almost four hours. For precisely this scenario, TRM advises a tested, pre-approved revocation process. Immunefi Vice President Simone Imbrescia likewise sees the weakness in the operational layer, since the attack required little on-chain code.

Binance has not yet disclosed the initial point of entry. The exchange keeps withdrawals paused, plans a gradual reopening and is overhauling its withdrawal system. Alongside the root cause report, it is also targeting a proof-of-reserves report for November 2, 2026.

Based on reporting by Crypto Valley Journal.