Binance Lost $6.4 Billion in One Afternoon. Its First Explanation Is an Engineer's Laptop, and No Perimeter Sensor Sees That.
On October 29, an attacker moved about $6.4 billion out of Binance wallets on ten blockchains. Most of it left in the first half hour. It is the largest crypto theft on record, roughly four times the $1.5 billion Bybit heist of February 2025.
The part worth your attention is not the number. It is Binance's first explanation of how it happened.
What the researchers say happened
Two blockchain analytics firms published within hours, and they agree on the shape. They disagree slightly on the total: Elliptic says $6.43 billion, TRM Labs says $6.36 billion, Binance has said about $6.3 billion. Early reports that night said $5.8 billion. Treat all of these as estimates that were still moving.
The preparation started at least 36 hours earlier. Three small withdrawals from the Tornado Cash mixer funded an operator wallet on October 28. On October 29 the attacker tested code on two wallets, rehearsed the final version on a third, and installed it on a Binance hot wallet about four hours later.
The Ethereum side used a recent feature. EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025, lets an ordinary wallet temporarily run contract code. TRM reports that one transaction carried 50 pre-signed authorizations, each covering a different transaction count, which guaranteed that one of them would still be valid when it executed. The result was a sweeper contract on the Binance hot wallet that took instructions only from the attacker. One sweep took 167,464 ETH and 63 tokens, including about 1.6 billion USDT.
Other chains did not need the trick. Another Binance Ethereum wallet sent funds out with no delegation at all, and the Bitcoin, Tron, XRP Ledger and Solana wallets were simply drained. That is why TRM's assessment, which it labels as an assessment, is that the attacker gained the ability to make Binance's signing system sign transactions of the attacker's choosing across chains.
The part a perimeter cannot see
Binance's initial investigation, as quoted by Elliptic, says the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container." Binance reports no evidence of a private key leak.
Read that as a defender. The attacker did not break a blockchain, a smart contract or a cryptographic primitive. The chain behaved exactly as designed. The attacker got into the place where the company's own signing authority lives and asked it nicely. Elliptic names the open question precisely: how the engineer's laptop was first compromised is, in its words, the most diagnostic fact still missing.
We do not know that answer, and nobody outside Binance does yet.
Who, and how sure
Both Elliptic and TRM attribute the theft to North Korea. TRM names TraderTraitor, the unit the FBI named for the Bybit theft, and says it makes the call with high confidence. Elliptic points to the same preparation pattern as Bybit and the April KelpDAO theft: small mixer withdrawals funding the operator, staging well ahead of time, and signatures prepared in advance and executed in one burst.
Elliptic is also careful in ways worth repeating. It says no government or law enforcement agency has confirmed the attribution. It notes that an address overlap between Binance funds and funds from the Bitget exploit may point to a launderer rather than the thief, that only about $39,000 of Binance funds reached that address, and that the laundering speed and methods differ from Bybit. Strong signals, not a verdict.
What it means for the rest of us
Elliptic cites the FBI's warning that TraderTraitor goes after staff with social engineering, and notes that the same route, a fake recruitment coding test, was used against DMM Bitcoin in 2024. We have written about North Korean crypto operations before: Famous Chollima got Claude to co-author a crypto stealer, and DPRK read our math.
On October 1 two template recruiters wrote to our own inbox within three hours of each other, both from free mail accounts. We make no attribution for those and have no evidence tying them to this group. We mention them because the lure shape is the one the FBI describes: a job that does not exist, aimed at someone who holds access.
Four things follow, and we want to be clear about whose advice each one is.
TRM's recommendation: monitor for EIP-7702 delegations, meaning code at an address that should have none, and treat a request for many authorizations across a range of transaction counts as an indicator of compromise.
Ours, for anyone who signs transactions: an engineer's laptop that can reach a signing service is part of the signing system. Segment it like one.
Ours, for anyone who is recruited: run a stranger's coding test on a disposable machine that holds no credentials and has no route to anything you own.
Ours, for any exchange's customers: custodied does not mean insulated. Binance says it will cover losses and that user funds are safe, which is a statement about its balance sheet, not about the next incident.
What we hold, and what we don't
We hold nothing from this theft in our feed, and we are not going to pretend otherwise. Neither Elliptic's nor TRM's report publishes a single IP address, domain, file hash or malware name. The only hard indicator in Elliptic's report is one Ethereum address, 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7, the shared address with the Bitget funds that it caveats as possibly a launderer. BleepingComputer, citing an Etherscan label, points to a second address, 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c, labeled "Binance Hot Wallet Exploiter 2." We looked both up in our corpus and found nothing, and our feed does not carry wallet addresses as an indicator type, so there was nothing to ingest. An unvetted crowd label and an address the publisher itself hedges are not something we would put on a blocklist.
We also checked our own edge, because the question deserves a measurement. We scanned for wallet-file probing, meaning wallet.dat, .bitcoin, .ethereum, keystore, .solana and metamask paths, across 39,597 edge blocks, 25,011 edge honeypot records and 1,377 origin captures since October 1. Zero matches. That is a measurement and not a reassurance: this attack happened inside the victim's signing infrastructure, which no sensor on our edge can see.
Limits
Every figure here is from Elliptic, TRM Labs and BleepingComputer, read on October 30 while the reports were still being updated. We did not independently verify any on-chain movement. A CNN report on the heist was unavailable to us, so nothing in this post rests on it. The root cause is Binance's preliminary statement and may change. Attribution is two firms' high-confidence assessment, not a government finding.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments