How Did the Binance Hack Happen? Detailed Investigation of the $6 Billion Heist
On October 29, 2026, an attacker drained about $6.15 billion from Binance in 31 minutes, one of the largest thefts in crypto historical past, or relatively, web historical past.
Binance first put losses at $6.3 billion; blockchain analytics agency BitOK’s transaction-by-transaction tracing places them at $6.15 billion throughout 9 blockchains.
The attacker by no means stole Binance’s non-public keys. Instead, they made Binance’s personal programs approve the theft. This information follows the heist so as and explains every technical time period alongside the manner. All occasions are UTC.
The Basics: How an Exchange Moves Money
Hot wallets are an alternate’s on-line wallets, stored linked so withdrawals exit shortly.
Signing. Every switch have to be permitted with a pockets’s non-public key, a secret quantity. Exchanges use automated programs to signal hundreds of payouts a day.
Nonces are an Ethereum pockets’s transaction counter. A busy pockets’s nonce rises continuously.
Freezable cash. Stablecoin issuers resembling Tether (USDT) and Circle (USDC) can freeze addresses. Nobody can freeze native cash like BTC, ETH or TRX.
October 28: Preparation Before the Hack
Every blockchain transaction prices a small price. To fund their wallets with out leaving a path, the attacker used Tornado Cash, a “mixer” that swimming pools many customers’ cash so withdrawals can’t be linked to deposits.
Six Tornado Cash withdrawals funded the operator’s pockets and two helpers.
October 29, 02:28–16:47 UTC: Two Rehearsals
Before touching Binance, the attacker practised on their very own wallets, the manner a burglar may check a lock-pick on their very own entrance door first.
The software was a wise contract: a program that sits on Ethereum and does precisely what its code says. This one was constructed to empty any pockets that offers it permission to behave on the pockets’s behalf. (Ethereum’s EIP-7702 characteristic permits that sort of permission; extra on it beneath.)
- 02:28 — the attacker publishes a check model of the draining program.
- 13:51–14:24 — first rehearsal. They put small quantities of USDT and USDC into two of their very own wallets, give the check program permission over them, and set off it. Both wallets are emptied. The software works.
- 15:59 — they publish the closing model, the one later used on Binance.
- 16:20–16:47 — second rehearsal, repeating the check with the closing model.
The closing model had one further energy: it might make a pockets do something, not simply ship tokens. That night time, this let it order a Binance pockets to launch 823 million USDC. A software this tailor-made suggests the attacker already knew how Binance’s wallets have been arrange.
“The distinction between the two variations was crucial. The major contract included a operate that would execute arbitrary calls on behalf of a pockets that had delegated management to it. The attacker later used that operate to empty 823 million USDC from a Binance sensible pockets,” BitOK defined.
October 29, 20:04 UTC: The 31-Minute Drain
From 20:04:52 to twenty:35:53, the attacker emptied Binance sizzling wallets on XRP Ledger, Solana, Bitcoin, Ethereum, Tron, Base, Optimism, Arbitrum and Avalanche. The haul included:
- 18,270.2 BTC,
- 197,540 ETH,
- 2.49 billion USDT,
- 823 million USDC,
- 233.46 million XRP,
- 970,522 SOL and dozens of different tokens.
Every switch was signed by Binance’s personal wallets. BitOK noticed them by their habits: charges 2 to 2.7 occasions increased than regular, transaction codecs Binance’s payout software program doesn’t use, and, on Ethereum, pretend transfers slotted between actual buyer payouts.
The attacker breached a DevOps engineer’s laptop computer, then used a service container (a packaged program working inside Binance’s programs) to submit pretend withdrawal orders.
20:20 UTC: The 50-key Trick
This was the cleverest transfer of the night time. The goal was a busy Ethereum sizzling pockets known as Binance 14.
The plan. Using EIP-7702, a pockets can signal a permission slip, known as an authorization, that lets a wise contract act on its behalf. If Binance 14 signed one naming the attacker’s contract, the attacker would management the pockets.
The downside. A slip solely works if it carries the pockets’s present transaction quantity, its nonce. Binance 14 was paying prospects continuous, in order that quantity stored altering. A slip with the incorrect quantity is just ignored.
The trick. At 20:20:59, the attacker had Binance’s signing system signal 50 slips without delay, every with a unique quantity. Think of it as making an attempt 50 keys on a lock at the similar second: just one wants to suit. One did. Binance 14 now took orders from the attacker’s contract, but stored working usually, so cash stored flowing in.
The payoff. Minutes later, a single transaction emptied 65 completely different tokens value greater than $2.2 billion, together with 1.615 billion USDT and 167,464 ETH. At 20:41 and 20:59, the contract additionally made one other Binance pockets ship out 823 million USDC.
Binance 16. A second sizzling pockets was robbed extra merely. Binance’s system was fed 9 pretend transfers, which it signed and despatched out alongside actual buyer payouts. They carried 28,005.6 ETH and 55.7 million USDT.
20:30–21:14 UTC: The Race to Unfreezable Coins
On Ethereum, 500 million USDT left the major receiving handle inside six minutes. Between 20:34 and 21:09, the attacker swapped 435 million USDT into ETH on Uniswap, a decentralized alternate run by code. They additionally deposited 60 million USDT into Aave, a lending protocol, and borrowed 19,762 ETH in opposition to it, leaving the freezable collateral behind.
On Tron, 612.7 million USDT left the Binance-Hot 7 pockets. In 16 swaps on SunSwap, Tron’s major decentralized alternate, the attacker turned 234 million USDT into 638.2 million TRX.
The Freeze Race
To freeze USDT, Tether wanted three approvals from its multisignature pockets, a setup that requires a number of sign-offs. Each freeze took as much as 2 minutes 36 seconds, and pending requests have been seen on-chain. The attacker might see a freeze coming and transfer first: one pockets shifted 130 million USDT simply 48 seconds earlier than its freeze. But at one handle the attacker hesitated and misplaced practically 175 million USDT.
All 823 million USDC nonetheless sat at one handle and was frozen in a single transaction.
| Frozen by Tether and Circle | Amount |
|---|---|
| Ethereum USDT | $1.38 billion |
| Ethereum USDC | $823 million |
| Tron USDT | $378.7 million |
| Avalanche USDt | $8.4 million |
| Total | $2.59 billion |
Other issuers froze USD1, XAUt, PAXG, wBETH and FDUSD, and BEAM’s issuer burned 984 million stolen tokens. Arbitrum’s Security Council, a 12-member emergency physique, seized 8,426 ETH and 74.56 million ARB.
In complete, about $2.79 billion was frozen, burned or seized. Still, 669 million USDT had already turn out to be ETH and TRX.
21:43–00:10 UTC: The Wallet That Kept Getting Robbed
Binance 14 was nonetheless beneath the attacker’s management.
- 21:43:59 — a routine Binance top-up sends 200 million USDT to Binance 14. Twelve seconds later, the contract sweeps it. The USDT lands at an already frozen handle, however practically 370 ETH will get away.
- 22:39 — one other sweep takes 128.49 ETH.
- 23:56 — 2,961.91 ETH is swept a minute after arriving.
- 00:10:35, October 30 — Binance lastly cancels the handover.
The attacker held the pockets for practically 4 hours.
Where the 18,270 BTC Went
At 20:20:06, 11 transactions moved 18,270.2 BTC from a Binance sizzling pockets, paying double the normal price. The cash have been cut up throughout 19 addresses, 17 of them holding 1,000 BTC every. As of October 30, none had moved. Bitcoin’s public ledger retains them traceable, however nobody can freeze them.
October 30, 04:02: The Bitget Connection
BitOK’s largest discovering: stolen Binance funds reached the similar Ethereum handle that was already accumulating proceeds from the September 2026 Bitget hack.
The attacker moved TRX and USDT by way of THORChain, a protocol that swaps cash throughout blockchains, and acquired ETH at 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7.
That handle had already acquired ETH traced to the Bitget hack. It got here from Bitcoin addresses on Bitget’s printed record of attacker wallets, energetic since October 23, and began out as ZEC, a coin by no means stolen from Binance.
By 06:20, it had taken eight Bitget-linked payouts (349.46 ETH) and 5 Binance-linked ones (13.63 ETH), then despatched the blended funds on to new wallets. A shared handle alone doesn’t determine who’s behind both hack.
Was it North Korea?
Both assaults concerned breaking into inner programs with out stealing non-public keys, and Bitget blamed North Korea for its hack. BitOK additionally notes traits it hyperlinks to North Korean teams: rehearsals, Tornado Cash funding, on the spot swaps out of freezable tokens and preparation throughout UTC+9 working hours.
“The newly recognized shared laundering handle is stronger proof of operational overlap than similarities in ways alone. BitOK assesses that the two thefts could also be linked to the similar North Korean group and that one operator managed the noticed laundering flows. That stays an analytical attribution, not proof of the real-world identification of each participant,” BitOK mentioned.
Binance’s Response
Binance paused withdrawals from its Bitcoin and Tron sizzling wallets round 20:36, whereas deposits continued. It pledged to cowl all buyer losses from its SAFU emergency fund and its personal assets.
Across the market, $1.58 billion in leveraged positions have been liquidated in 24 hours, in accordance with Coinglass.
What Are Attackers Holding Now?
As of 06:20 on October 30, BitOK linked the attacker to:
- 197,460 ETH,
- 18,270.2 BTC,
- 233.46 million XRP,
- about 970,500 SOL,
- 675.9 million TRX,
- and 1.61 million AVAX.
The ETH, BTC, XRP, and SOL alone have been value about $2.95 billion.
The attackers hijacked the system that indicators Binance’s withdrawals. BitOK shared classes to be taught from the Binance hack for the crypto trade.
“The Binance incident reveals why the safety of non-public keys alone is inadequate. Exchanges additionally want controls over signing authority, safeguards in opposition to suspicious withdrawal directions, immediate revocation of compromised permissions and steady monitoring of asset actions throughout networks.”
The publish How Did the Binance Hack Happen? Detailed Investigation of the $6 Billion Heist appeared first on BeInCrypto.