Live incidentOct 29, 2026 · Ethereum, Bitcoin, Tron + 8 more chains
The $6.3 billion Binance heist
An attacker got Binance's own signing system to approve an EIP-7702 delegation on a hot wallet, then emptied it in one transaction. It's the largest crypto theft on record, and investigators point to North Korea. 197,460 ETH sits in a wallet nobody can freeze. This page watches it on-chain.
Total stolen · per Binance
$6.3B
The largest crypto theft on record, more than 4× Bybit's.
Exploiter 8 · can't be frozen
197,460ETH
≈ $440M · 0 transactions sent
Frozen in tracked wallets
$2.0B
Read live from Tether's and Circle's blacklists. Binance says ~$3B in total.
Since the delegation
—
Signed at 20:20:59 UTC, Oct 29. Withdrawals due to resume about 45h after Binance's 08:47 update.
Exploiter 11 · still accumulating
78,415ETH
Suspected attacker
TraderTraitor, North Korea
TRM Labs says "high confidence"; Chainalysis and Elliptic agree. The same unit the FBI blamed for Bybit. No government has confirmed it.
Latest
The newest verified developments, most recent first. Times UTC. Last updated Oct 30, 2026, 12:30 UTC.
- Oct 30 11:07
Binance is buying back the stolen altcoins. Co-founder Yi He says Binance is buying "all the stolen altcoins in fully matching amounts" through OTC and on-exchange. @heyibinance ↗
- Oct 30 10:55
Binance sets aside $6.34B. "Reserved over $6.34B of company funds… $5B of these funds are already held in the exact token assets." @binance ↗
- Oct 30 08:47
"Additional points of breach." Binance says its later investigation found more than the compromised laptop. Withdrawals are "on track" to resume in about 45 hours. @binance ↗
- Oct 30 07:37
CEO Richard Teng explains the entry point. It "may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions… So far, we have found no evidence of any wallet private key leak." Binance says it has revoked the affected address authorizations. @_RichardTeng ↗
- Oct 30 05:24
The attacker moves ETH. Arkham: "just sent $38.82M ETH to a new wallet… He still holds $1.12B ETH." @arkham ↗
- Oct 30 04:51
THORChain exit spotted. ZachXBT finds Binance funds commingled with proceeds of the $388M Bitget hack at one address after arriving via THORChain. Elliptic traces about $39K of Binance funds there through a 28-hop peel chain from Tron. @zachxbt ↗ Elliptic ↗
- Oct 30 04:14
Chainalysis CEO points to North Korea. Jonathan Levin: "likely done by DPRK group TraderTraitor due to links to previous hack." Chainalysis now puts the total near $6.4B. @jony_levin ↗
- Oct 30 ~02:10
TRM attributes it to TraderTraitor "with high confidence" and counts $6.36B across 10 chains, including 18,270 BTC and 612.7M USDT on Tron. TRM Labs ↗
- Oct 30 00:04
"User funds are safe." Yi He: "Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended." Deposits have since resumed. @heyibinance ↗
- Oct 29 21:15
CZ: "It does look like a hack on Binance." He thanked Tether (~$971M) and Circle (~$823M) for their fast freezes. @cz_binance ↗
Interactive
Follow the money
Every wallet in the operation and how funds moved between them. Drag to rearrange, scroll to zoom, click a wallet for live details.
Recorded every 5 minutes
Live balances
ETH held by the attacker's two biggest stashes. A sudden drop means the money is moving.
The first points come from figures documented on Oct 29–30; after that the site records the chain itself.
Where the money went
Ethereum leg only, in USD at 21:15 UTC on Oct 29. Hover a band for its amount.
Approximate. "Other tokens" is the long tail of 60 smaller tokens. Circle's freeze is shown at the 780M USDC that moved through Exploiter 2; Circle reported more than 800M frozen in total.
How it worked
Every step below is visible on Etherscan. Links open the transaction.
Funding through Tornado Cash. The attacker funded three wallets with 6 Tornado Cash withdrawals (1.48 ETH in total), starting the day before. What is Tornado Cash?
A rehearsal. From 13:51 UTC on Oct 29, the attacker gave three fresh wallets of its own an EIP-7702 delegation to a sweeper contract, loaded them with a few dollars of USDT and USDC, and swept them. The first two used a v1 sweeper. The third used the v2 contract later aimed at Binance. Test sweep ↗
The delegation. At 20:20:59 UTC, one transaction carried 50 authorizations signed for Binance 14, for nonces 18914775 to 18914824. Only 18914809 matched. Binance says it found no sign the private key leaked; it says the attacker reached a service container that could submit withdrawals. A batch of pre-signed future nonces fits that: the attacker got Binance's own signing system to sign for it. Why 50 signatures matter · Delegation tx ↗
The drain. 3 minutes 24 seconds later, one sweep() call moved 167,464 ETH and 63 different tokens out of Binance 14. The gas fee was about $0.93. Sweep tx ↗
Coming back for more. The delegation stayed live. Between 21:04 and 23:56 UTC the attacker swept another 5,160 ETH that landed in Binance 14 after the hack was public.
Staging. Stablecoins were frozen in place by their issuers. The attacker is swapping everything else into ETH through Uniswap and piling it into Exploiter 8. Why ETH can't be frozen
EIP-7702, explained
The Ethereum feature at the center of the attack, and why it made a single signature so dangerous.
What it is
EIP-7702 shipped in Ethereum's Pectra upgrade in May 2025. It lets an ordinary wallet, an "externally owned account", borrow a smart contract's code so it can batch actions, sponsor gas or add spending rules. The owner turns it on by signing an authorization naming the contract, the chain and the wallet's current nonce.
Why it was so dangerous here
A single authorization hands control of everything in the wallet to the named contract. Monitoring that watches for unusual transfers saw Binance 14 "sending its own transaction". The delegation also outlives the moment: Blockaid notes that rotating keys doesn't clear it. Only a new authorization pointing to the zero address does, which is why the attacker could come back for hours.
Key leak or signer abuse?
You can't forge an authorization without the wallet's key signing it. Binance says no key leaked; the attacker reached a service container that submits withdrawals. Blockaid says 11 Binance hot-wallet keys signed attacker transfers, "Binance's own signing infrastructure, under the attacker's control", and its CEO says he doesn't think a key leaked. Both fit a signing service that was made to sign, not a key that was copied.
What exchanges should take from it
Signing services should refuse to sign 7702 authorizations at all unless a human approves them, and monitoring should alert on any type 4 transaction that touches an exchange wallet. A hot wallet with a delegation set should be treated as compromised until it's reset to the zero address.
The MetaMask slip
First spotted by protocol engineer Justin Kalland and reported by PANews. We traced each hop on-chain.
- Exploiter 2sends 500M USDT to a relay walletblock 26300799 ↗
- Relay 0x9749…c762forwards 175M USDT to 0x811f…e84cblock 26300942
- 0x811f…e84cforwards all 175M USDT to Exploiter 21block 26300988
- Exploiter 21pays 127.67 USDT to the address Etherscan labels "MetaMask: Gas Station Swap", at 21:12:59 UTCblock 26301011 ↗
- Tetherblacklists Exploiter 21 with about 174.99M USDT still inside (checked live in the wallet table)
Why it matters
MetaMask's Gas Station lets a wallet pay network fees in a token like USDT: MetaMask's own service fronts the ETH and takes the fee in USDT. That means the transaction went through Consensys's servers, not just a public node, and services like that normally log the request. The wallet already held ETH for gas, so it looks like a rushed click on a default setting.
So what's the attacker's IP?
It isn't public, and it can't be read from the blockchain. Only Consensys holds those logs, and law enforcement can get them through legal process. The FBI and Secret Service are reported to be working with Binance. A state-backed group would likely route through a VPN or proxy, so the logged IP may lead to an exit server, not a person. Even then, timestamps, browser fingerprints and the provider's own records are useful leads.
A second MetaMask touchpoint: during the rehearsal at 13:59 and 14:02 UTC, the attacker's helper wallet bought its test USDT and USDC through the MetaMask Swap router. If Consensys has records of both sessions, they could tie the rehearsal operator to the 21:12 transaction.
Who did it?
Blockchain intelligence firms point to North Korea's TraderTraitor unit, part of the wider Lazarus Group. No government has confirmed it, and Binance hasn't named anyone.
| Who | Says | Confidence | Source |
|---|---|---|---|
| TRM Labs | "Attributes the attack to TraderTraitor"; same pattern as Bybit (2025) and KelpDAO (April 2026) | High | TRM ↗ |
| Chainalysis | "Likely done by DPRK group TraderTraitor due to links to previous hack" | Likely | @jony_levin ↗ |
| Elliptic | Has attributed the theft to DPRK | Attributed | Elliptic ↗ |
| ZachXBT | "It's likely Lazarus Group" | Likely | @zachxbt ↗ |
| Unnamed investigator | "Not definitively attributed to Lazarus yet"; laundering is slower than DPRK's usual | Doubts | CoinDesk ↗ |
| Binance | "Our investigation has not attributed responsibility to any individual" | None | @_RichardTeng ↗ |
| FBI / US government | Reported to be working with Binance, with the Secret Service; no attribution yet | None | Reuters via Yahoo ↗ |
Who is TraderTraitor?
A North Korean state hacking unit inside the cluster known as Lazarus Group. It targets crypto companies by compromising employees, often through fake job offers and malicious software, then using their access to the company's signing systems. The FBI named it for the roughly $1.5B Bybit theft in February 2025.
Why investigators think it's them
TRM lists the signature: small Tornado Cash withdrawals to fund the operator, staging well before the attack, and pre-obtained signatures executed in one burst. The entry point Binance describes, an engineer's compromised laptop, matches how the group got into earlier victims. TRM also notes a difference: this time the laundering leans on market-maker swaps, where Bybit's relied on bridges.
Timeline
All times UTC. Click a dot to jump to the event; toggle phases to filter.
Wallets to watch
Balances, outgoing transaction counts and freeze flags are read live from Ethereum.
Exchanges, bridges and OTC desks: screen deposits against these addresses. If funds from them reach your platform, contact SEAL 911 and Binance security.
| Wallet | Address | Stablecoin freeze | Status |
|---|
"Txs sent" is the wallet's nonce: how many transactions it has ever sent. Exploiter 8 at 0 means not one coin has left it. Contracts show no figures because they hold nothing themselves.
How big is it?
Binance's own figure is about $6.3 billion. Early on-chain estimates were lower because they counted fewer chains.
Loss estimates by source
Binance's figure is highlighted. Estimates rose as analysts found outflows on more chains.
Largest assets taken
USD at 21:15 UTC on Oct 29, per CryptoTicker. Red marks ETH, which no issuer can freeze.
Freezes by issuer
Binance says about $3B is frozen in total; Arkham counts $2.80B. First Tether freeze: 971M USDT at 21:01 UTC, later raised to 1.567B.
Tornado Cash withdrawals by the attacker
| Time (UTC) | Wallet | Pool | ETH |
|---|
The single 1 ETH pool withdrawal is the most distinctive lead for matching withdrawals to deposits.
Explainers
The pieces you need to follow this story.
What is EIP-7702?
An Ethereum feature added in the Pectra upgrade (May 2025). It lets an ordinary wallet point at a smart contract and run that contract's code as if it were its own. The wallet's owner turns it on by signing an "authorization". Here, Binance 14 was pointed at the attacker's sweeper contract, which then moved everything out in one call.
Why do 50 signatures matter?
Every authorization names the wallet's nonce, its running transaction count, and only works if that number is current when it lands. Binance 14 sends transactions constantly, so the attacker couldn't know the exact nonce in advance. Pre-signing 50 consecutive nonces guaranteed one would hit. Whoever produced those signatures could get Binance 14's key to sign arbitrary messages. Binance says the key itself didn't leak, which points to its signing system being abused from the inside.
What's a hot wallet?
An exchange wallet that stays online so withdrawals can go out automatically. It holds a small share of reserves; the rest sits in offline cold storage. Binance 14 was one of Binance's busiest, with more than 31 million transactions. Public trackers put this loss at about 2% of Binance's known on-chain holdings.
Why can USDT and USDC be frozen, but not ETH?
USDT and USDC are tokens issued by companies, Tether and Circle, whose contracts include a blacklist. Once an address is blacklisted, its tokens can't move. The "Stablecoin freeze" column above reads those blacklists live. ETH has no issuer and no blacklist, so only the holder's private key can move it. That's why attackers swap freezable tokens into ETH as fast as they can.
What is Tornado Cash?
A mixer on Ethereum. You deposit a fixed amount into a pool and later withdraw it to a fresh address, breaking the visible link between the two. The attacker used it to fund its wallets, so investigators have to match withdrawals to deposits by timing, amounts and habits. Small pools with fewer users, like the 1 ETH pool, are easier to analyze.
How does this compare to Bybit?
In February 2025, about $1.4–1.5B in ETH was stolen from Bybit after attackers tampered with the signing interface its staff used. The FBI attributed it to North Korea's Lazarus group. The FBI named the unit TraderTraitor. The proceeds were laundered within weeks, largely by bridging to Bitcoin. TRM Labs now attributes the Binance theft to the same unit with high confidence; Binance itself hasn't named anyone.
What is SEAL 911?
A volunteer emergency line run by the Security Alliance (SEAL), staffed by security researchers who coordinate with exchanges, stablecoin issuers and law enforcement during live incidents. If you run a platform and see these funds, they're the fastest route to the people who can act.
Why are strangers sending these wallets dust?
Since the hack, dozens of addresses have sent tiny amounts and on-chain messages to the attacker's wallets. Some are taunts or pleas to return the funds. Others are "address poisoning": scammers send from lookalike addresses hoping someone copies the wrong one from the transaction history. Never copy an address from a history list. Use the Copy buttons here or Etherscan's labeled address.
Latest coverage
Headlines from the last three days, refreshed every five minutes.
- Loading headlines…