Binance hack, October 29, 2026: how the hot wallet was drained via EIP-7702
Probably the largest crypto theft on record. One authorization handed a Binance hot wallet to an attacker's contract, and about 50 pre-signed backups made sure it could not be undone. Here is what happened, why it worked, and what to do now.
What happened
On the evening of October 29, 2026 (UTC), on-chain investigators noticed huge outflows from Binance-labelled hot wallets on Ethereum, followed by transfers on other networks. Binance paused withdrawals on several networks, then deposits too, and confirmed it was investigating a security incident. Tether froze more than 1.5 billion USDT and Circle about $800 million USDC. Ripple, World Liberty Financial, Arbitrum's Security Council and Aave also froze assets. By 00:52 UTC Binance reported $3 billion verified as frozen.
Chainalysis estimated the theft at about $5.9 billion at the time it happened. Etherscan-based tallies of the core Ethereum addresses put it near $2.8 billion. Investigators including ZachXBT and Blockaid said North Korea is the likely culprit.
How it worked, step by step
Since Ethereum's Pectra upgrade in May 2025, EIP-7702 lets a normal wallet sign an authorization that makes it run a smart contract's code. Exchanges use this to batch transfers efficiently. The same mechanism is also a master key.
- Preparation. On October 28 the attacker's address received 0.1 ETH from Tornado Cash. The next afternoon it deployed a sweeper contract that only accepted calls from that address.
- The authorization. At 20:20:59 UTC a transaction carried a valid EIP-7702 authorization for the hot wallet "Binance 14", delegating it to the attacker's contract. Blockaid's preliminary view is "key misuse": Binance's signing infrastructure was manipulated into producing the signature, rather than a key leaking. A stolen key or insider involvement have not been ruled out.
- Revocation-proofing. The same transaction reportedly carried about 50 authorizations, one for each upcoming nonce. Had Binance signed a revocation, the attacker could simply replay the next one.
- The sweep. At 20:24:23 UTC, 3 minutes and 24 seconds later, one call emptied Binance 14: 167,464 ETH and 63 tokens including 1.615 billion USDT. Minutes later 28,005 ETH left "Binance 16".
- Laundering. The attacker sold stablecoins on decentralized exchanges and borrowed WETH on Aave against stolen USDT, racing the freezes. Ether, which cannot be frozen, was moved to fresh addresses.
Timeline (UTC)
- Attacker address funded with 0.1 ETH from Tornado Cash.
- EIP-7702 authorization delegates Binance 14 to the attacker contract.
- Binance 14 swept in a single transaction.
- Analyst Spreek flags the outflows publicly.
- Attacker deposits 60M USDT on Aave and borrows about $44.6M of WETH.
- Tether and Circle freeze about $2.36B. Aave freezes markets across V3 and V4.
- Binance says it is investigating and pauses withdrawals.
- Deposits suspended.
- Chainalysis estimates $5.912B stolen.
- Binance reports $3B frozen. Arbitrum freezes $30.5M.
Why it worked: three missing controls
This was not a failure of cryptography. It was a failure of process, the same one that cost Bybit $1.5 billion in February 2025:
- One signature had unlimited authority. A single authorization could hand over the entire wallet.
- Nothing independent checked what was signed. A delegation of a hot wallet to a freshly deployed, mixer-funded contract is trivially detectable, if something outside the signing system looks.
- Nothing slowed it down. No time-lock or velocity limit stood between the authorization and a multi-billion-dollar sweep.
An independent co-signer, a second system that must agree before any signature is produced, closes all three gaps. That is what CryptGuard's Co-Signer does. You can replay this attack pattern and see it blocked.
What you should do now
- Ignore every "compensation" or "refund" link. Real compensation appears inside your Binance account. Paste anything you receive into the scam checker.
- Never type your recovery phrase anywhere. No support agent, claim site or airdrop needs it.
- Check your own wallets for unexpected EIP-7702 delegations and risky approvals with the wallet scanner.
- When withdrawals reopen, move long-term holdings to self-custody, ideally a hardware wallet. Keep on exchanges only what you trade.
- Never sign a 7702 authorization with chainId 0. It hands over your account on every EVM chain at once.
- Lower leverage. About $628 million was liquidated within an hour as prices fell.