Binance hack explained: $6.3B left Binance on 29 Oct 2026, and Binance says no private key was stolen. How Binance was hacked, step by step, with every term explained (hot wallet, signing key, EIP-7702, mixer, sweeper, stablecoin freeze, chain-hopping).
– ~20:05 UTC, 29 Oct: Binance’s hot wallets start emptying. One transaction moves ~$2.5B (167,464 ETH + 1.6B USDT + 63 tokens) for a ~$0.93 fee (on-chain).
– Ten blockchains drained; most of it in ~20 minutes (TRM), roughly $5M a second (our math). Binance’s estimate: ~$6.3B, about 4× Bybit (2025) and almost double all crypto stolen worldwide in 2025 (Chainalysis).
– The prep: gas money through Tornado Cash a day and a half before; a sweeper contract rehearsed on a test wallet.
– The way in (Binance’s first finding): a compromised DevOps engineer’s laptop reached a service container that could submit withdrawals. How the laptop was hacked isn’t disclosed; Binance found more points of breach. CEO Richard Teng: the tools self-destructed.
– The key idea: a blockchain only checks that a signature is valid. Binance found no evidence of a key leak; analysts say its signing system was made to say yes. On Ethereum, 50 EIP-7702 permissions in one transaction; one fit, and it skipped the normal approval controls (Teng).
– The race: ~$786M of stablecoins swapped to ETH/TRX at a steep loss before Tether froze the main wallet 37 minutes in (Circle 3 minutes later). About $3B is frozen.
– The getaway: automated laundering, 18,270 BTC split into 19 wallets, chain-hopping over bridges; some funds sat beside Bitget hack loot. Analysts point to North Korea’s TraderTraitor; no government has confirmed it.
– Your money: Binance says it absorbs the loss, not its users, so any “refund” message is bait. Use a hardware security key and never sign what you don’t understand.
Which step surprised you most: the laptop, the 50 permissions or the 37-minute freeze? Tell us in the comments.
Sources: Binance, Richard Teng, Yi He posts on X (30 Oct); Elliptic; TRM Labs; Chainalysis; Blockaid; CoinDesk; Bitcoin.com; ZachXBT; Etherscan. As of 02:30 UTC 31 Oct 2026. Not advice.
#binance #cryptohack #cybersecurity
— — —
Need a hand? We’re always happy to help on Discord:
Get arc
iPhone:
Android:
Web:
Step-by-step guides:
Follow arc
Discord:
YouTube:
Instagram:
X:
Reddit:
source