Binance Traces $6.3B Hack to Compromised DevOps Laptop and EIP-7702

Between 20:04 and 20:09 UTC on October 29, 2026, the first of nine chains began emptying Binance wallets. Within four hours, $6.3 billion had left the exchange’s custody, and Binance says no private key was stolen. Its preliminary findings point to a compromised laptop belonging to a DevOps engineer. On-chain analysts describe a mechanism built on EIP-7702 delegations and a race against stablecoin freezes.

What Binance says, and what it doesn’t

The official notice, published on Binance’s help center on October 29, 2026 at 22:23 UTC, is deliberately cautious. It refers to an “initial investigation” and preliminary conclusions, repeats that user funds are safe, and says Binance will cover all losses using its SAFU fund (Secure Asset Fund for Users) and its own resources. A new Proof of Reserves is to be published after remediation.

Three immediate measures were taken: a temporary suspension of deposits and withdrawals during security checks, revocation of the authorization held by the affected address, and mobilization of competent authorities and on-chain analytics partners to trace and recover funds.

Three points remain unclear, and they are the most important:

That selective silence defines the situation. The exchange has communicated a technical hypothesis, the most plausible one but still unproven, and has refrained from attributing the attack to any actor. Neither Lazarus, North Korea nor any other group has been officially named by Binance at this stage.

Timeline: four hours, nine chains

On-chain reconstructions published by TRM Labs and Bitquery give a precise picture of the night. The attack began on the XRP Ledger between 20:04 and 20:09 UTC, when five Binance wallets sent 233.46 million XRP to an address that did not exist a minute earlier. Solana followed five minutes later, then Base and Optimism. A quarter of an hour after the first transfers, the three largest drains began within minutes of one another.

Binance’s main Bitcoin wallet sent 18,270 BTC in a single block, immediately split into round tranches of 1,000 BTC and 100 BTC, a method known as a “peel chain” designed to complicate tracing. The TRON hot wallet, meanwhile, transferred 612.7 million USDT and 46.4 million TRX.

EIP-7702: the key mechanism

Since Ethereum’s Pectra upgrade in May 2025, an ordinary account can sign an EIP-7702 authorization that delegates its behavior to a smart contract. Every call to the account then executes that contract’s code, and the delegation persists until a new authorization is signed.

The attacker submitted a transaction containing 50 authorizations, all signed by Binance 14, the most active hot wallet on Ethereum, each pointing to a “sweeper” contract that accepted instructions only from the operator. Each authorization is valid only for a specific nonce, meaning a particular transaction counter of the wallet. Because that wallet processes a continuous flow of withdrawals, its counter kept advancing. By preparing signatures for 50 consecutive nonces, the attacker ensured that one would still be valid at execution. One was enough.

The critical point lies here: the blockchain shows that every drain carried a valid signature from Binance’s system. The record does not show who asked the system to sign, or how. That is precisely what Binance implicitly confirms by stating it found no evidence of a private key leak.

A compromise of the signing infrastructure?

Binance’s announcement points to a compromised laptop, a reading consistent with the on-chain data but not demonstrated. TRM Labs considers the most likely scenario not a key theft, but a compromise of the signing infrastructure itself: the attacker would have gained the ability to have Binance sign transactions of its choosing, across several chains and key types, in less than half an hour. The batch of 50 pre-signed authorizations suggests either time-limited access or signatures obtainable only through a given system.

“It looks like a compromise of the signing infrastructure. We don’t think a key leaked.”

Ido Ben-Natan, CEO, Blockaid

Blockaid’s CEO describes a key “misuse” rather than a theft, meaning a signing system deceived or compromised into authorizing malicious transactions without the underlying key being extracted. He told Cointelegraph that this is a preliminary assessment.

Another reading deserves mention: the chronology points to preparation of at least 36 hours. The attacker’s operator wallet received three small withdrawals from Tornado Cash as early as the morning of October 28. On October 29 the code was deployed and tested on two wallets, then repeated on a third, before being installed on a Binance hot wallet four hours later. This pattern of testing and repetition matches North Korean attack patterns already documented.

The race against freezes: $2.7 billion locked, 729 million converted

Stablecoins have a kill switch: their issuers can freeze an address and block any movement. The attacker therefore had to move fast. The first freeze came at 21:01 UTC, 37 minutes after the main Ethereum drain, but 700 million USDT had already left the main recipient for two new wallets.

The tally is harsh for the attacker: six of Tether’s eleven freezes hit wallets that were already empty. Of the $1.76 billion in USDT blocked, 71% was immobilized. Yet 729 million USDT was converted before the freezes landed, through UniswapX, 1inch Fusion, Uniswap pools and SunSwap on TRON. Part of it was also posted as collateral on Aave, where 60 million USDT enabled borrowing of roughly 19,760 ETH before the relevant markets were frozen.

The price paid was high: according to available data, the attacker accepted about 15% above market price for its stablecoins on swap platforms, and up to 10% of extra cost on some routes through market makers. That premium reflects an immediate and non-negotiable need for liquidity.

What the attacker still controls

This is the most important figure in the case. According to TRM Labs, the attacker still controls more than 420,000 ETH and the 18,270 BTC, roughly $2.4 billion beyond the reach of any stablecoin issuer. Bitquery, for its part, measured about $3.1 billion still held by the attacker at 03:54 UTC, mostly in ETH and BTC.

The attacker has even exceeded its initial haul. It stole about 200,000 ETH but held 490,361 according to Bitquery, the surplus having been bought with the stolen stablecoins. Two-thirds of the ETH has never moved, nor have the XRP and SOL. The 18,270 BTC are spread across 19 addresses, most holding exactly 1,000 BTC, and have not been spent. No sum had reached an exchange, a mixer or a bridge, at least as of Bitquery’s reading of the chains.

TRM Labs anticipates the next step: based on previous thefts, funds should pass through cross-chain bridges, swap services and OTC desks. The firm highlights that 325 million USDT was sold to market makers and solvers by a wallet that had just received the funds. Real-time counterparty screening would have been enough to block the operation.

Attribution, markets and precedents

Three firms have converged on the same answer, without Binance adopting it. TRM Labs attributes the attack to TraderTraitor, a North Korean unit, with “high confidence”. Its arguments: three small Tornado Cash withdrawals to fund the operator wallet, preparation predating the theft, and signatures obtained in advance then executed in a single burst. The FBI had already named this group for the $1.5 billion Bybit theft in February 2025. TRM notes one difference, however: the laundering observed here relies on large swaps through market makers and lending protocols, not on the bridge-centered pattern seen after Bybit.

ZachXBT and Blockaid also point to North Korea, as does Pangolin Intelligence according to the Wall Street Journal. Binance, by contrast, has attributed the attack to no one and says it is working with authorities to confirm the identity of those responsible.

The incident also sits within a broader series. In September, Bitget suffered a $387.5 million theft, also attributed to North Korea through zero-day flaws in third-party security appliances; only $1.1 million could be frozen. On the same day as the Binance attack, CoinDCX lost $16 million and Polymarket about $2.6 million via a third-party provider.

On the market side, Bitcoin fell 4.5% to a six-week low of $76,368 before rebounding around $78,434. Ether dropped 5.2% to $2,178 and BNB more than 4.7%. Liquidations exceeded $1.5 billion over 24 hours. Coinbase lost 4.8% and Strategy nearly 6% in extended trading. Standard Chartered believes prices could remain under pressure before finding a floor.

For depositors, the absence of loss on user funds rests on the SAFU. Co-CEO Yi He indicated that withdrawals should resume within 48 hours, with deposits already functioning again. There is a precedent: in 2022, Binance had already suffered the minting of two million BNB, and the platform’s intervention had reduced the loss from $570 million to about $115 million.

Conclusion: a working version, a real-world stress test

The decisive question remains open. The full technical report must establish what really happened on that laptop, what authorizations the service container held, and why the EIP-7702 authorization was not revoked until 00:10 UTC, although withdrawals had been suspended since 22:33. Until that document is published, Binance’s conclusions remain consistent with on-chain data, plausible, but provisional.

With an estimated impact of $6.3 billion and about $2.7 billion already frozen, the incident far exceeds Bybit’s $1.5 billion theft, which had held the record since February 2025. Central scenario: a North Korean attribution confirmed by authorities would clarify the case without changing the situation of the funds still under the attacker’s control. Alternative scenario: a broader compromise of the signing infrastructure, revealed by the full report, would force centralized platforms to rethink controls over automated signatures. In both cases, this is no longer only a question of exchange security: it is a real-world test of the sector’s ability to freeze, trace and seize assets at the scale of traditional finance.

Sources

• Binance, help center, official notice of October 29, 2026 (22:23 UTC)
• TRM Labs, on-chain analysis of the night of October 29 to 30, 2026
• Bitquery, on-chain reconstruction of transfers and remaining balances
• Blockaid, statements by Ido Ben-Natan to Cointelegraph, October 2026
• ZachXBT and Pangolin Intelligence, attributions reported by the Wall Street Journal, October 2026

Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.