Arbitrum

Tornado Cash

Grayscale

DevOps

Ethereum

<p>The Binance hack has exposed how an attacker used a single successful Ethereum wallet authorization to gain control of a major exchange wallet, as Binance estimates that the October 29 security breach affected approximately $6.3 billion in cryptocurrency.</p>
<div id="cn-block-summary-block_2b5c8b2fb0a7f5e2d338182e15d2b6cf" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Binance estimates the October 29 security incident affected roughly $6.3 billion in cryptocurrency.</li>
   <li>Blockaid traced the attack to 50 EIP-7702 authorizations, with one successfully targeting the Binance 14 hot wallet.</li>
   <li>Binance’s initial investigation points to a compromised DevOps engineer’s laptop, but the exchange found no evidence of a leaked private key.</li>
   <li>Tether and Circle froze more than $2.3 billion in stablecoins linked to the attack, while Binance reported approximately $3 billion frozen across assets.</li>
   <li>Binance suspended deposits and withdrawals during security checks and pledged to cover losses through its SAFU fund and company reserves.</li>
  </ul>
 </div>
</div>
<p>According to blockchain security firm <a href="https://blockaid.io/blog/binance-55b-hack-using-advanced-ai-models-blockaid-detects-the-biggest-theft-in-crypto-history" rel="noopener noreferrer nofollow">Blockaid</a>, the attacker exploited Ethereum’s EIP-7702 authorization mechanism to redirect Binance’s heavily used Binance 14 hot wallet to a malicious smart contract. The attacker submitted 50 authorizations in one transaction, but only one matched the wallet’s transaction counter and successfully activated the contract.</p>
<p>Binance’s October 30 security update <a href="https://www.binance.com/es/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7" rel="noopener noreferrer nofollow">identified</a> a potentially compromised DevOps engineer’s laptop as the initial entry point. The exchange said approximately $3 billion in affected assets had been frozen and pledged to cover customer losses.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… <a href="https://t.co/5REncAI77y" rel="noopener noreferrer nofollow">pic.twitter.com/5REncAI77y</a></p>— Binance (@binance) <a href="https://x.com/binance/status/2115993361517891592?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 30, 2026</a>
  </blockquote>
 </div>
</figure>
<p>You might also like: <a href="https://crypto.news/binance-coinbase-west-africa-scam-crackdown/" rel="noopener noreferrer nofollow"> Binance, Coinbase join West Africa scam crackdown as 28 arrested </a></p>
<h2 class="wp-block-heading" id="strong-binance-hack-used-50-authorizations-to-take-control-of-hot-wallet-strong"><strong>Binance hack used 50 authorizations to take control of hot wallet</strong></h2>
<p>Blockaid’s investigation identified an Ethereum transaction submitted at 20:20:59 UTC on October 29, containing 50 EIP-7702 authorizations targeting Binance 14.</p>
<p>EIP-7702 allows an ordinary Ethereum wallet to delegate transaction execution to smart contract code. Each authorization must match the wallet’s current nonce, a transaction counter that changes as the account processes transactions.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>The biggest theft in crypto history: an attacker used a stolen key to drain $5.5B from Binance’s hot wallets.<br><br>Using advanced AI models and our industry-leading exploit detection engine, Blockaid detected it in under two minutes.<br><br>Read more: <a href="https://t.co/lc2vjNhL1S" rel="noopener noreferrer nofollow">https://t.co/lc2vjNhL1S</a><a href="https://t.co/HCl1BL5bvF" rel="noopener noreferrer nofollow">pic.twitter.com/HCl1BL5bvF</a></p>— Blockaid (@blockaid_) <a href="https://x.com/blockaid_/status/2115967067707097110?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 30, 2026</a>
  </blockquote>
 </div>
</figure>
<p>Because Binance 14 was actively handling withdrawals, the attacker could not reliably predict its nonce. The submitted authorizations covered consecutive values between 18,914,775 and 18,914,824, increasing the chance that one would match when Ethereum processed the transaction.</p>
<p>Only one authorization succeeded. It directed the wallet to an unverified contract that permitted an attacker-controlled address to execute a function called sweep(), transferring ETH and ERC-20 tokens while retaining 1 ETH for transaction fees.</p>
<p>The malicious delegation could have exposed subsequent deposits until Binance removed it. The exchange later confirmed that it had revoked the affected authorization.</p>
<p>Previous <a href="https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/" rel="noopener noreferrer nofollow">EIP-7702 wallet attacks</a> had demonstrated similar risks, including an October 14 incident in which a compromised Ethereum account lost approximately $22,770 in ETH.</p>
<h2 class="wp-block-heading" id="strong-binance-says-compromised-laptop-may-have-enabled-unauthorized-withdrawals-strong"><strong>Binance says compromised laptop may have enabled unauthorized withdrawals</strong></h2>
<p>Binance’s preliminary investigation identified a possible compromise of a DevOps engineer’s laptop, which may have given the attacker access to an internal service container used to submit withdrawal transactions.</p>
<p>The exchange said investigators had found no evidence that any wallet private key had leaked, although they had not established precisely how the attacker obtained the authorizations needed to redirect Binance 14.</p>
<p>Blockchain records examined by Blockaid showed preparations beginning before the main theft. The attacker funded an operating address through three Tornado Cash withdrawals and deployed the malicious contract several hours before using it against Binance.</p>
<p>At approximately 20:24 UTC, the attacker drained Binance 14 of cryptocurrency worth roughly $2.5 billion. The transfers included 167,464 ETH, more than 1.6 billion USDT and dozens of other tokens.</p>
<p>Additional transfers involved Binance 16 and another Ethereum hot wallet holding USDC. The operation spread across several blockchain networks, including Bitcoin, Tron, Arbitrum and Avalanche.</p>
<p>Previous research into <a href="https://crypto.news/ethereums-pectra-upgrade-facing-mounting-exploit-concerns/" rel="noopener noreferrer nofollow">malicious wallet delegations</a> had identified automated contracts designed to transfer assets from compromised accounts following Ethereum’s Pectra upgrade.</p>
<h2 class="wp-block-heading" id="strong-tether-and-circle-freeze-billions-linked-to-binance-hack-strong"><strong>Tether and Circle freeze billions linked to Binance hack</strong></h2>
<p>Following the attack, cryptocurrency issuers began restricting access to assets associated with suspicious addresses.</p>
<p>Tether CEO Paolo Ardoino <a href="https://x.com/paoloardoino/status/2115918000373346709" rel="noopener noreferrer nofollow">confirmed</a> that the stablecoin issuer had frozen more than 1.567 billion USDT connected to the suspected breach. Circle CEO Jeremy Allaire separately <a href="https://x.com/jerallaire/status/2115916207463481846" rel="noopener noreferrer nofollow">reported</a> freezing more than 800 million USDC while coordinating with law enforcement.</p>
<p>Ripple’s stablecoin executive Jack McDonald <a href="https://x.com/_JackMcDonald_/status/2115928859854221744" rel="noopener noreferrer nofollow">said</a> the company was working with relevant parties to freeze affected RLUSD holdings.</p>
<p>Meanwhile, the Arbitrum Security Council <a href="https://x.com/arbitrum/status/2115961730920841644" rel="noopener noreferrer nofollow">reported</a> transferring 74,559,805 ARB and 8,425 ETH from an address linked to the attack into a restricted intermediary wallet. The organization said the assets could only move following further council action or an Arbitrum DAO governance decision.</p>
<p>The coordinated response left approximately $3 billion frozen across affected assets, according to Binance’s latest estimate.</p>
<h2 class="wp-block-heading" id="strong-binance-promises-to-cover-losses-as-investigation-continues-strong"><strong>Binance promises to cover losses as investigation continues</strong></h2>
<p>Binance temporarily suspended deposits and withdrawals while conducting security checks and working with blockchain intelligence firms and law enforcement.</p>
<p>In a subsequent service update, Binance co-founder Yi He <a href="https://x.com/heyibinance/status/2116021551262740985" rel="noopener noreferrer nofollow">clarified</a> that deposits remained unaffected and were operating normally. She said the exchange was improving its withdrawal systems and address controls, with withdrawals expected to resume within the next 48 hours.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>**Service Update**<br><br>Deposits remain unaffected and continue to operate as normal.<br><br>Our team is currently working on enhancements to the withdrawal service and related address controls. We expect to begin resume withdrawal services in the next 48 hours.<br><br>We will continue to share…</p>— Yi He (@heyibinance) <a href="https://x.com/heyibinance/status/2116021551262740985?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 30, 2026</a>
  </blockquote>
 </div>
</figure>
<p>The exchange said it would use its Secure Asset Fund for Users (SAFU) and company funds to cover losses. An updated Proof of Reserves will follow once remediation is completed.</p>
<p>Binance founder Changpeng Zhao publicly acknowledged the suspected breach, saying, “User funds are safe!” He added that he no longer managed the exchange but expected customers to be fully covered.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  https://twitter.com/cz_binance/status/2115993068507897936
 </div>
</figure>
<p>The exchange’s U.S. affiliate separately <a href="https://x.com/BinanceUS/status/2115922119972491559" rel="noopener noreferrer nofollow">stated</a> that its operations were not affected by the incident.</p>
<p>Binance said investigators were continuing to establish how the attacker accessed its internal systems and obtained the wallet authorizations. The company plans to publish a detailed technical post-mortem after completing its investigation.</p>
<p>Read more: <a href="https://crypto.news/grayscale-us-crypto-activity-bitcoin-hashrate-midterms/" rel="noopener noreferrer nofollow"> Grayscale puts US crypto activity at 15–20% ahead of midterms </a></p>

Binance hack: How one wallet trick led to a $6.3 billion breach

Table of Contents

crypto.news

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!