On 29 October 2026, the world’s largest cryptocurrency exchange was drained of approximately $6.3 billion. And not through a cracking of elliptic curve cryptography, or a nation-state quantum computer, or an evil genius in a hoodie feverishly banging on his keyboard. No, through… a laptop. A DevOps engineer’s laptop.
It is roughly four times the size of the Bybit hack in 2025, the previous record-holder for the greatest loss of crypto money while everyone insisted the technology was maturing.
The Attack: A Masterclass in “It’s Not the Keys, Stupid”
The following is the story of the attack according to on-chain analysis and Binance’s preliminary statements.
At 20:20:59 UTC, someone—presumably sitting somewhere comfortable, possibly with a beverage—submitted a transaction containing 50 EIP-7702 authorizations aimed at Binance 14, a hot wallet. EIP-7702 is a perfectly legitimate Ethereum feature introduced with the Pectra upgrade that lets a regular wallet delegate execution to a smart contract. It was designed for greater speed and batch operations. It was also, as it turns out, designed for a nightmare like this.
The attacker was unable to obtain Binance 14’s exact counter value because the wallet was busy processing withdrawals, so they sprayed 50 authorizations at the wallet covering a range of possible nonces. One hit.
Four minutes later, the attacker’s contract executed. Binance 14 voluntarily, lawfully, and with a valid signature gave up 167,464 ETH and a little more than 60 other tokens. The network fee was $0.93.
Over the next hour, the contagion spread to Binance 16 and then to other hot wallets across Ethereum, Arbitrum, Avalanche, and beyond. By the time anyone at Binance noticed—about 1 minute 55 seconds after the first large sweep, according to Blockaid’s monitoring—billions had already been lost.
According to Binance’s official explanation, a compromised DevOps engineer’s laptop gave an attacker access to a service container, which was then used to submit unauthorized withdrawal transactions. The most important thing is that no private keys leaked. The keys were fine, and they obeyed the orders. The problem was that the system around the keys was apparently less secure than a hotel mini-bar.
As Hacken put it with admirable bluntness: “A stolen key lets a stranger sign. A compromised signing system lets the real key sign whatever a stranger asks, and on the blockchain the two look the same: a valid signature.”
The Freeze: $3 Billion Rescued, $3.3 Billion Still on the Lam
, Tether, Circle, and other blockchain partners managed to freeze about $3 billion of stolen assets, most of them stablecoins that issuers can blacklist on command. The bad news is that in the minutes between the sweep and the freezes, the attacker was frantically converting freezable stablecoins into non-freezable assets like ETH and BTC, accepting losses of over 10% to do so. About $786 million in stablecoins was laundered into ETH and TRX before the blockers caught up.
Binance pledged to cover all losses through its SAFU fund and corporate treasury, setting aside $6.34 billion, with about $5 billion already in the specific stolen tokens. Co-CEO Richard Teng promised a detailed technical post-mortem once the investigation was complete. The crypto community is holding its breath, presumably not for the post-mortem but for the next exchange to discover its hot wallet has been delegated to a contract with a sweep function.
The Suspect: North Korea, Because Of Course It Is
Two firms, TRM Labs and Chainalysis, attributed the attack with high confidence to TraderTraitor, a subunit of North Korea’s Lazarus Group. The same group was linked to the $1.5 billion Bybit hack in February 2025.
North Korea denies any involvement. North Korea always denies involvement. The US Secret Service is said to be involved in the investigation, which is encouraging in the same way that a fire department arriving three hours after a house fire is encouraging.
The Takeaway
Binance’s official statement said that user funds are safe, deposits remain operational, and withdrawals have been temporarily suspended. Binance promised an updated Proof of Reserves by November 2.
The deeper truth is less comforting. The crypto industry has spent years building vaults so impregnable that no one even considered checking whether the door was actually locked. A single compromised laptop, running on an operating system no one has named and infected by malware no one has described, was enough to convince the world’s largest exchange to sign away six billion dollars over a coffee break.
The blockchain performed perfectly, the cryptography held up perfectly, and the decentralized consensus did what it was supposed to do. A hot wallet was drained in 24 seconds because someone clicked the wrong thing, installed the wrong extension, or left a credential where it shouldn’t have been.
Ethereum’s EIP-7702 specification explicitly warns that delegated code receives unrestricted access to the authorizing account. Someone at Binance read that warning. Someone else apparently did not.
The 2019 Binance hack involved 7,000 BTC, but the 2026 hack involved $6.3 billion, a compromised laptop, and a convenience feature. Progress, it turns out, goes in both directions.
BY KATE JONAS
SOURCES
-
Hacken (detailed on-chain timeline, EIP-7702 mechanics, freeze race):
https://hacken.io/insights/binance-hack/ -
Blockchain News (Fireblocks analysis on EIP-7702 delegation):
https://blockchain.news/news/binance-exploit-eip-7702-delegation-preliminary-losses -
Fireblocks Official Blog (structural risk analysis and attack flow):
https://www.fireblocks.com/blog/binance-hack-eip-7702