Cyberattack on Binance is Officially the Largest Single Theft of any kind in History

Cyberattack on Binance is Officially the Largest Single Theft of any kind in History

-----------------------------------------------------

In Feb. 2025, North Korean hackers stole $1.5 billion from a crptocurrency exchange called 'Bybit'. At the time it was the largest crpto heist ever. Now last Thursday, Oct. 29th, another crptocurrency exchange called, 'Binance' lost $6.5 billion to hackers. What do we know so far about this last crpto heist? 

The Thursday, October 29, 2026 cyberattack on Binance is officially the largest single theft of any kind in history. Draining approximately $6.36 billion to $6.43 billion in crypto assets across ten blockchains, the heist dwarfed the $1.5 billion stolen from Bybit in early 2025 by more than four times.

1. Who Did It?

Blockchain intelligence and cybersecurity firms (TRM Labs, Chainalysis, and Elliptic) have attributed the attack with high confidence to TraderTraitor, an elite North Korean state-sponsored hacking unit. The FBI previously named TraderTraitor as the group behind the February 2025 Bybit heist.

2. How the Attack Happened

The attack unfolded at high speed—draining the vast majority of the funds in just 20 minutes starting around 20:05 UTC.

• No Private Key Leak: Binance confirmed that main wallet private keys were not leaked.

• Attack Vectors: The exploit was traced to a compromised DevOps engineer's laptop, which allowed the attackers to access a service container. However, Binance co-CEO Richard Teng noted there were multiple, complex "additional points of breach" involving their hot wallet signing infrastructure.

• Ethereum Sweeper Exploitation: On Ethereum, the hackers used an EIP-7702 delegation (with 50 pre-signed authorizations prepared in advance) to transform a Binance hot wallet into an automated "sweeper" controlled by the hackers, draining funds continuously as they arrived.

3. Current Recovery Efforts & Asset Freezes

Out of the ~$6.4 billion stolen, roughly $2.7 billion to $3 billion in assets have already been frozen or seized.

• Issuers like Tether, Circle, and Ripple, along with decentralized protocol security teams (such as Arbitrum's Security Council), acted quickly to freeze centralized stablecoins (USDT, USDC) and tokens on-chain.

• In response, the hackers engaged in a frantic race against network freezes—selling stablecoins on decentralized exchanges, borrowing unfreezable assets like Ethereum (ETH) on lending platforms like Aave, and splitting 18,270 Bitcoin across automated peel-chain wallets.

4. Are Customer Funds Safe?

Yes. Binance confirmed that the breach only impacted its operational "hot wallets"—which hold funds used for immediate liquidity and active transactions—while the vast majority of user deposits remain secured in offline "cold wallets".

Binance co-CEO Richard Teng stated that the company will absorb the entire financial loss out of its own reserves. The exchange has pledged that no customer will lose funds and plans to release an updated Proof of Reserves report.

-------------------------------------------------

I assume that this story is still developing as we speak.

The situation is actively unfolding as blockchain intelligence firms (TRM Labs, Chainalysis, and Elliptic) track the stolen assets in real time.

Here are the critical updates that have emerged as of Saturday, October 31, 2026:

1. The "Smoking Gun" On-Chain Mistake

While blockchain analytics firms attributed the hack to North Korea’s TraderTraitor unit early on, investigators confirmed the link definitively when the hackers made a tactical slip-up. The attackers inadvertently sent a portion of the stolen Binance funds into the exact same automated laundering wallets holding proceeds from the Bitget hack.

2. Over $2.8 Billion Effectively Frozen

The total frozen or blocked funds has now reached $2.85 billion (~44% of the total heist).

• Stablecoin Issuers: Tether, Circle, and Ripple blacklisted addresses holding frozen USDT and USDC.

• DeFi Protocols: The Arbitrum Security Council and protocols like World Liberty Financial moved quickly to freeze additional tokens (including $74.6M in ARB tokens) before they could be bridged away.

3. Automated 24/7 Laundering Scripts

Because stablecoins can be frozen remotely by their issuers, the North Korean hackers have entered a high-speed race against network security teams. Elliptic reports that the hackers are using custom, automated scripts running around the clock to:

• Swap to Unfreezable Assets: Quickly trade stablecoins for native Ethereum (ETH) and Bitcoin (BTC) on decentralized exchanges. The hackers currently hold over 420,000 ETH and 18,270 BTC (roughly $2.4 billion in assets), which sit in raw addresses where no central issuer can freeze them.

• Peel Chains & Micro-Transactions: Scripted laundering wallets are firing off automated transactions every 30 to 96 seconds—routinely sending test transfers of exactly 1 TRX followed by irregular, randomized decimal amounts to obscure tracing algorithms.

4. Binance Operations & Proof of Reserves

Binance co-CEO Richard Teng reiterated that the loss will be entirely covered by internal exchange reserves. While hot wallet deposit and withdrawal services across several chains remain temporarily suspended or rate-limited for security checks, Binance confirmed it will publish an updated, audited Proof of Reserves report.

--------------------------------------

Explain how EIP-7702 delegation works and how the hackers used it in the 2026 Binance exploit.

The use of EIP-7702 in the October 2026 Binance hack marks a watershed moment in cyberattacks, representing the first time this specific Ethereum upgrade has been weaponized on a massive, multi-billion-dollar scale.

1. What is EIP-7702?

Proposed to bring smart-contract capabilities (like batching transactions and social recovery) to standard Ethereum accounts (EOAs—Externally Owned Accounts, or regular user/hot wallets), EIP-7702 allows a normal wallet to temporarily point to and execute smart-contract code.

When a wallet signs an EIP-7702 authorization tuple, it essentially attaches a piece of code to its address for a transaction. From that point forward, when the address is invoked, the Ethereum Virtual Machine (EVM) runs that external code inside the context of the victim's wallet.

2. How the Hackers Weaponized It Against Binance

During the exploit on Ethereum, the hackers leveraged a compromised signing environment (derived from the DevOps laptop breach) to deploy a precision attack using pre-signed EIP-7702 authorizations:

• The Delegation Pivot: The attackers had prepared 50 pre-signed authorization payloads in advance. They submitted a transaction that forced a primary Binance hot wallet to point its code slot to an attacker-controlled sweeper contract.

• Turning the Wallet Against Itself: Because EIP-7702 allows delegated code to execute using the wallet's own authority and storage permissions, the moment the delegation was active, the Binance hot wallet became its own robber.

• The Automated "Sweeper" Loop: The malicious code hard-coded a specific operator address and contained a sweep() function. When triggered, it instantly inventoried all token balances (ETH, stablecoins, and altcoins) and executed native transfer and transferFrom calls to push everything out to the hackers' address.

• Perpetual Draining: The scariest part of the EIP-7702 mechanism is its persistence. Because the code was written directly to the account's execution slot, the hackers did not need to re-sign anything. As users or automated systems continued to deposit fresh funds into the Binance hot wallet afterward, the malicious sweeper contract automatically vacuumed up the new arrivals in subsequent automated loops.

In short, EIP-7702 allowed the hackers to transform a standard exchange hot wallet into an automated funnel, bypassing the need for endless manual withdrawal requests and draining hundreds of millions of dollars in mere minutes.

----------------------------------------------

Source

Google Gemini