The Binance hack of 29 October 2026: what the chain shows
On 29 October 2026, about US$6.3 billion in crypto was taken from Binance's hot wallets on ten blockchains, mostly within about twenty minutes. It is reported to be the largest crypto theft on record. Binance says it will cover user losses and reopened withdrawals on 1 November. We read the Ethereum part of the attack on the public chain. In short: one transaction carrying 50 EIP-7702 authorizations at 20:20:59 UTC turned a Binance hot wallet into a sweeper, and about three and a half minutes later a second transaction moved 63 tokens, including 1,615,409,498 USDT, to one new address. The chain shows how the funds left. It does not show how the signing keys were compromised, and it does not show who is behind it.
What has been reported
- Total: TRM Labs puts the outflow at about $6.36 billion across ten blockchains; Chainalysis says about $6.4 billion. Other reports give lower dollar figures valued at the time of the theft, so estimates run from about $5.9 to about $6.4 billion.
- Timing: funds started leaving at 20:05 UTC on 29 October (first transaction on the XRP Ledger, per TRM), and the main attack lasted about 20 minutes. Binance says containment was complete at 00:10 UTC on 30 October.
- Binance's account of how it began: in a media briefing (reported by CoinDesk on 3 November) Binance's chief security officer said a software engineer was approached through a legitimate job platform by someone posing as a project director, interviewed on video by a fake HR representative, and then downloaded a coding assignment that contained malware. On 20 October the attackers used that machine and an internal AI tool to reach two wallet engineers' computers; on 29 October they used stolen credentials to deploy a container and run a malicious script.
- Who: TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korea-linked group, with "high confidence". Chainalysis cites real-time mixing of the stolen funds with proceeds of the earlier Bitget exploit. These are private firms; as of 30 October, Decrypt reported no government attribution. Later reports mention an FBI notice that we could not read. North Korea has denied involvement.
- Binance's response: it halted trading and withdrawals, says it will cover all losses, and reports having replaced 90% of the stolen assets by 31 October and 98% by 3 November. Withdrawals reopened on 1 November. Within nine hours, users withdrew about $4.65 billion against about $1.01 billion deposited, according to figures compiled on Wikipedia.
By chain, as reported
| Chain | Reported value (US$ billions) |
|---|---|
| Ethereum | 3.8 |
| Bitcoin (18,270 BTC) | 1.5 |
| Tron | 0.628 |
| XRP Ledger | 0.296 |
| Solana | 0.096 |
| Arbitrum, Optimism and Base | 0.039 |
| Avalanche | 0.028 |
| Polygon | 0.010 |
These rounded figures are as compiled on Wikipedia from press reports and the analytics firms. They are not our readings, and they do not add up exactly to the totals above because the sources value the assets at different times.
What the chain shows on Ethereum
Ethereum is where Binance's wallet 0x28c6c06298d514db089934071355e5743bf21d60
(commonly labelled Binance 14) lost most of its holdings. What we read, with times in UTC:
| When | What happened |
|---|---|
| 29 Oct, 02:28:59 | First activity of the address 0x7c8601d4645b93cea45f71e118a729332e6b5ca0, which later sends the attack transactions. TRM reports that the attackers began staging at least 36 hours before and funded an operator wallet through Tornado Cash. |
| 29 Oct, 20:16:19 | First activity of the address 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c, which will receive the funds. |
| 29 Oct, 20:20:59 | One transaction from 0x7c86…5ca0 to Binance 14 with 50 EIP-7702 authorizations (block 26,300,753). Transaction 0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b. |
| 29 Oct, 20:24:23 | A second transaction from 0x7c86…5ca0 to Binance 14 succeeds (block 26,300,770). It emits 63 token transfers, all to 0x5227…2f8c, among them 1,615,409,498 USDT and about 82.54 WBTC. Transaction 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3. |
| 30 Oct, 00:10:35 | Binance 14 sends a transaction to itself that removes the delegation (block 26,301,896). Transaction 0xafbf94c92a8d749988411669fa14d4f8866d9b4420b4ebd299f28e958dac7209. The address has no delegated code today. |
The ether itself and the USDC left in other steps that we did not add up ourselves. Protos reports 167,464 ETH and 1.62 billion USDT paid out to the collector, about 823 million USDC pulled in a second step, and a further 28,005.6 ETH moved from another Binance wallet by ordinary transfers. Our reading of the USDT matches Protos.
On 3 November the receiving address 0x5227…2f8c has made over 2,400 transactions since
it was created, holds almost no ETH, and our security data flags it (reason "Phishing"). The sending
address 0x7c86…5ca0 is flagged as well (reason "Stealing Attack"). You can look
both up on Hopchain:
receiving address and
sending address. A flag is a
signal from a third party's data, not a verdict.
What EIP-7702 is, and why it matters here
An ordinary Ethereum address can only sign transactions. EIP-7702, activated in the Pectra upgrade,
lets such an address also sign an authorization that makes it run the code of a
smart contract. That is useful for batching actions in a wallet. It also means that whoever holds
a valid signature from the address can point it at code they wrote. According to the analyses by TRM and Protos, the attacker
deployed a sweeper contract (0x63e842b054bd624a465454d533c33f573e9c6fae,
which has code on chain today), prepared 50 authorizations with different nonces and sent them in
one transaction, so that exactly one applied. After that, calling the sweeper made Binance 14 hand
over everything it held.
The key point: an authorization has to be signed with the key of the address it applies to. TRM therefore concludes that the attacker had control of Binance's hot-wallet signing system. Binance says its hot wallets use multiparty computation, so no single key could revoke the permission, which delayed containment. How the signing system was reached is not visible on the chain; Binance's account is the one above.
Freezes and laundering, as reported
- Stablecoin freezes: TRM says Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins; Binance puts the total frozen at about $3 billion, and CoinDesk reports about $2.85 billion. Wikipedia reports that Tether froze wallets at 21:01 UTC, Circle three minutes later. The Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB (TRM).
- What cannot be frozen: Bitcoin has no issuer. TRM expects the attacker to hold over 420,000 ETH and 18,270 BTC, about $2.4 billion, beyond any issuer's reach.
- Racing the freezes: TRM reports that the attacker sold USDT to market makers and borrowed ETH against USDT on Aave. Chainalysis describes thousands of automated transactions in a pattern it had not seen before.
- Tether's blacklist, our reading: on 3 November Tether's USDT contract on Tron had added 389 addresses to its blacklist since 9 October, including 12 on 29 October and 63 on 30 October. The contract does not say which incident an address belongs to, so we do not tie those numbers to Binance.
What it means for users
- If your funds are on Binance: Binance says user losses will be covered. Read its own statements and be wary of messages about "compensation", "claims" or "verification". Expect scammers to use the news. See crypto scam recovery: what works and what is a scam.
- If you keep your own wallet: you are not directly affected. The same mechanism exists at small scale, though: a wallet prompt that asks you to delegate or "upgrade" your account to an unknown contract can hand it control. Do not sign it. See unlimited token approvals and fake airdrops and spam NFTs.
- The lesson on custody: an exchange holds your keys for you, so its security is your risk. A self-custody wallet shifts the risk to you. Neither is risk-free. See hot wallet vs cold wallet vs hardware wallet and what a seed phrase is.
What we cannot see
- How the signing system was reached. We rely on Binance's account. The chain only shows the signed authorizations.
- Who controls these addresses. Attribution comes from private firms. We name no person and no state as a fact.
- The other nine chains and the Bitcoin. We did not read them. The per-chain figures are reported, not ours.
- A confirmed total and where the money is now. Figures differ by source and by the price used, and the funds are still moving.
- Which freezes or blacklist entries belong to this attack. The contracts do not say.
Found a mistake or have new information? Write to info@hopchain.io and we will correct this page. This is general information, not financial, legal or security advice. We will update this page as the facts change.
Sources we read
- Wikipedia: 2026 Binance hack (compiled from press reports, last edited 3 November)
- CoinDesk, 3 November: Binance's account of how the attack began
- Decrypt, 30 October: TRM and Chainalysis attribution
- Cointelegraph, 30 October: attribution and the Bitget link
- Protos: how the hack happened on Ethereum
More case files and guides
Frequently asked questions
Was Binance hacked in October 2026?
Yes. On 29 October 2026 about US$6.3 billion in crypto was taken from Binance hot wallets on ten blockchains, mostly within about twenty minutes. Binance says it will cover user losses.
How much was stolen from Binance?
TRM Labs puts it at about $6.36 billion and Chainalysis at about $6.4 billion. Some reports give lower figures valued at the time of the theft. The total depends on the source and the price used.
How did the Binance hack happen?
Binance says the attack began with a fake job interview that led an engineer to install malware, and that the attackers then reached its hot-wallet signing systems. On Ethereum, the chain shows 50 EIP-7702 authorizations signed by Binance's own hot wallet, followed by a sweep of 63 tokens to one address.
Who is behind the Binance hack?
TRM Labs and Chainalysis attribute it to TraderTraitor, a North Korea-linked group, with high confidence. These are private analytics firms and North Korea denies involvement. The chain shows addresses, not people.
Are my funds on Binance safe?
Binance says user losses will be covered and it has replaced most of the stolen assets. Read its own statements, and be careful with messages about compensation or verification, which scammers are likely to copy.
Can the stolen crypto be frozen?
Stablecoins can be frozen by their issuers, and about $2.7 to $3 billion was reported frozen. Bitcoin and ether have no issuer that can freeze them, so they are harder to stop.
What is EIP-7702?
An Ethereum feature that lets an ordinary address sign an authorization to run the code of a smart contract. It is useful for wallets, but anyone with a valid signature from the address can point it at code they wrote.
Keep reading
- The Ledger wallet drains of 9 October 2026
- Crypto scam recovery: what works and what is a scam
- Hot wallet vs cold wallet vs hardware wallet
- Unlimited token approvals: what they are and how to revoke them
- All case files