How $6.15 Billion Was Stolen from Binance: BitOK Investigates

On October 29, 2026, Binance suffered one of the largest attacks in crypto history. An attacker gained access to the exchange's hot-wallet signing infrastructure and drained assets across nine blockchains. Binance initially put the damage at $6.3 billion, while BitOK's expanded transaction analysis via Graph traces approximately $6.15 billion in stolen funds.

On October 30, Binance said the attacker had entered through a DevOps engineer's laptop and used a service container to submit fraudulent withdrawals, without stealing private keys. Meanwhile, the attacker converted stolen stablecoins into ETH and TRX in a race against issuer freezes. Tether and Circle froze approximately $2.59 billion; including other issuer actions and an Arbitrum intervention, the total frozen, burned or seized reached roughly $2.79 billion.

BitOK Graph helped reconstruct the preparation, the wallet-signing compromise, the movement of stolen assets and, in a significant new finding, a shared Ethereum receiving address for funds linked to the Binance and Bitget hacks.

The initial cross-chain theft lasted 31 minutes, from the first attempted transfer on XRP Ledger at 20:04:52 UTC to the final Avalanche transfer at 20:35:53 UTC on October 29. The most concentrated wave came between 20:16 and 20:36 UTC. Additional funds were drained later while the attacker still controlled a Binance wallet.

The attacker targeted hot wallets on XRP Ledger, Solana, Bitcoin, Ethereum, Tron, Base, Optimism, Arbitrum and Avalanche. Different networks showed the same pattern: transfers to new attacker-controlled addresses were authorized by Binance wallets, but assembled differently from the exchange's routine payments.

According to BitOK's investigation, the stolen assets included:

The analysts' key finding was that the attacker's transfers were signed using Binance's own hot-wallet keys or signing authority.

Yet the transactions looked different from the exchange's normal activity. On many affected networks, the attacker used fees around 2 to 2.7 times higher than usual and transaction formats that differed from Binance's normal payout systems.

On Ethereum, suspicious transfers were inserted into the live nonce queue between legitimate Binance payouts. Similar discrepancies appeared on XRP Ledger and Solana, where the attacker's transfers carried different fees or instruction formats from routine withdrawals.

BitOK's findings point to a compromise of the exchange's transaction-signing infrastructure rather than an isolated smart-contract exploit. Binance's description of the DevOps laptop and service-container intrusion is consistent with that conclusion.

Valid signatures alone do not prove that private keys were stolen. They show that the exchange's signing authority was used; Binance says the private keys themselves were not leaked.

The attack began on XRP Ledger. After an unsuccessful attempt to send RLUSD to an address that did not yet exist, a Binance wallet sent XRP to create it. Five Binance wallets ultimately transferred 233.46 million XRP to the new address. The transfers used fees of 6,000 drops, versus the wallets' usual 3,000.

On Solana, Binance's hot wallet sent approximately 970,522 SOL to a fresh address. Unlike the exchange's normal batched payouts using durable nonces, the attacker used individual system transfers. As of the October 30 reporting cutoff, the stolen XRP and SOL had not been spent.

On-chain analysis allowed BitOK to trace the attacker's activity back to the days and hours before the Binance breach.

On October 28, the attack operator's address received its first funds through Tornado Cash, a crypto mixer designed to obscure the origins of funds.

In total, the operator and two supporting wallets received transaction-fee funding through six withdrawals from Tornado Cash pools.

The attacker then began building the infrastructure needed for the operation.

At 02:28 UTC on October 29, the attacker deployed a test contract designed to take control of a wallet and drain its assets.

The first dry run took place between 13:51 and 14:24 UTC. The attacker used two of their own wallets, each preloaded with small amounts of USDT and USDC. After delegating control to the test contract, they successfully drained the funds.

At 15:59 UTC, the primary malicious contract was deployed.

A second dry run followed between 16:20 and 16:47 UTC, this time using the main contract.

The difference between the two versions was critical. The main contract included a function that could execute arbitrary calls on behalf of a wallet that had delegated control to it. The attacker later used that function to drain 823 million USDC from a Binance smart wallet.

This suggests the attacker already understood the exchange's infrastructure and had built a tool tailored to the way its funds were managed.

The most unusual part of the attack unfolded on Ethereum. Its central target was the Binance 14 hot wallet.

The attacker exploited EIP-7702, an Ethereum mechanism that allows a regular wallet to delegate transaction execution to a smart contract.

Under normal circumstances, this delegation can automate wallet operations. In this case, however, the authority was handed to the attacker's contract.

At 20:20:59 UTC, the operator submitted a transaction containing 50 EIP-7702 authorizations.

All 50 authorizations were signed with the Binance 14 key, but each used a different nonce, the sequential number used to order transactions.

Why would the attacker need so many signatures?

The Binance wallet was processing transactions continuously, so its nonce kept increasing. The attacker needed at least one authorization to match the wallet's current nonce when the transaction was processed.

The tactic worked. In block 26300753, the authorization with nonce 18914809 matched. Binance 14 then delegated transaction execution to the malicious contract.

The attacker submitted the 50 signed authorizations in descending nonce order. Only the authorization matching the wallet's current nonce took effect, leaving the Binance 14 wallet operational. This mattered: after the initial drain, it continued receiving funds that the attacker could sweep again.

Just 3 minutes and 24 seconds later, the operator invoked the sweep function to drain the wallet.

A single transaction pulled 65 different tokens worth more than $2.2 billion from the wallet.

They included 1.615 billion USDT, 167,464 ETH, 62.6 million RLUSD, 27.76 million USD1, 29,934 wBETH, and 11,372 XAUt.

Exactly 1 ETH was left in the Binance wallet, a rule the attacker had built into the contract.

The attack did not stop there. At 20:41 and 20:59 UTC, the attacker used the same delegation to make another Binance smart wallet transfer a further 780 million and 43 million USDC.

At the same time, the attacker targeted another hot wallet, Binance 16.

Unlike Binance 14, this wallet did not delegate control to a contract. Instead, nine transfers to the attacker were signed directly from it.

All nine transfers were included in a single block, interspersed with regular exchange payouts.

The stolen assets included 28,005.6 ETH, 55.7 million USDT, 25.9 million RLUSD, and other tokens.

The Binance 16 transfers, like those on the other networks, show how the attacker used signing authority in real time while ordinary exchange activity continued. The intruder did not have to steal private keys to make the transfers appear cryptographically valid.

After the theft came the second phase: converting assets into cryptocurrencies that cannot be frozen at the discretion of a centralized issuer.

The main receiving address on Ethereum was 0x5227f6....

Within just 5 minutes and 48 seconds of the Binance 14 drain, the first 500 million USDT had already left this address. Another 200 million USDT was sent to a second address.

The attacker pursued several routes at once.

On Ethereum, they used Uniswap, UniswapX, and a chain of newly created wallets. At each address, part of the USDT was swapped for ETH before the remaining stablecoins and newly acquired ETH were moved onward.

Over 35 minutes, from 20:34 to 21:09 UTC, the attacker swapped 435 million USDT for ETH, converting funds at an average rate of roughly $12 million per minute.

Another tactic involved borrowing against stolen assets.

At one of the addresses, the attacker deposited 60 million USDT into Aave v3 and borrowed 19,762 ETH.

The idea was to replace an asset that its issuer could freeze with ETH, while leaving the collateral and the loan obligation in place.

The attacker used a similar approach on Tron.

A total of 612.7 million USDT and more than 46 million TRX were transferred from the Binance-Hot 7 wallet to a new address.

The attacker then began distributing the stablecoins to other wallets. One address received 300 million USDT.

Between 20:47 and 21:14 UTC, the attacker executed 16 swaps on SunSwap, each worth between $2 million and $30 million. In total, 234 million USDT was converted into 638.2 million TRX.

The resulting TRX was sent to a separate address, while another 66 million USDT went to a different wallet.

The attacker also used JustLend, depositing 10,000 USDT as collateral and borrowing 17,375 TRX. This mirrored the Aave borrowing strategy used on Ethereum.

As a result, a substantial portion of the stolen funds ended up in native cryptocurrencies with no centralized issuer capable of administratively freezing an address.

Stablecoin issuers reacted quickly, but in some cases the attacker moved faster.

BitOK's investigation found that freezing USDT on Ethereum required approval through Tether's multisignature wallet.

Three signatures were needed to execute a freeze. Collecting them took between 1 minute and 48 seconds and 2 minutes and 36 seconds.

The problem was that pending freeze requests became visible on-chain before they were executed.

The attacker could watch for those requests and move funds to another address while the approvals were still being collected.

For example, one wallet forwarded 175 million USDT roughly two minutes before it was frozen. Another transferred 130 million USDT just 48 seconds before Tether executed its freeze.

The attacker made mistakes, too.

At address 0xaa24, the attacker lost nearly 175 million USDT. Instead of moving the funds immediately, they began issuing swap approvals. Tether froze the address 24 seconds after one of those approvals.

Circle took a different approach. All 823 million stolen USDC remained at the attacker's main address, allowing the issuer to freeze the entire amount in a single transaction.

Tether and Circle freezes, according to BitOK:

Other token issuers intervened as well: approximately 27.82 million USD1, 12,574 XAUt and 1,906.67 PAXG were frozen. Binance blacklisted an address holding 29,934 wBETH, and First Digital froze FDUSD on six addresses, including approximately 3.45 million FDUSD at the main attacker address. The BEAM issuer burned 984,249,380 stolen BEAM tokens directly at that address.

Arbitrum took a different route. Its Security Council used a nine-of-twelve multisignature process to authorize cross-chain messages that transferred 8,425.998 ETH and 74,559,805.2 ARB from the attacker's Arbitrum address to a designated storage address without the attacker's signature. The funds were seized at 00:18:20 UTC on October 30 and can only be released through a further Security Council decision or DAO vote.

Taken together, freezes by Tether, Circle and other issuers, the BEAM burn and the Arbitrum seizure amounted to approximately $2.79 billion at the prices used in BitOK's analysis. This should not be confused with the narrower $2.59 billion total frozen by Tether and Circle alone.

The attacker had nevertheless managed to convert 669 million USDT into ETH and TRX before the freezes took effect.

In all, Tether froze eight attacker-linked addresses on Ethereum. By the time those freezes were executed, only three still held funds. The attacker had already emptied the other five.

These findings illustrate the limits of even a rapid, coordinated response by exchanges, blockchain investigators, and token issuers. When an attacker automatically spreads funds across new addresses and swaps them immediately, a delay of just a few minutes can be decisive.

One of the most revealing episodes in BitOK's investigation occurred after the initial wave of thefts.

At 21:43:59 UTC, about an hour and a half after the attack began, a regular Binance wallet sent another 200 million USDT to the compromised Binance 14 wallet.

The transfer looked like a routine top-up. Analysts observed that the sending wallet regularly transferred exactly that amount to Binance 14.

But control of Binance 14 was still delegated to the attacker's contract.

Just 12 seconds after the top-up, another sweep call was triggered automatically.

The contract drained 200.4 million USDT, nearly 370 ETH, and the remaining balances of other tokens.

The USDT, however, did the attacker no good. It was sent to an address that had already been frozen, making it inaccessible. The ETH and other unfrozen assets remained available.

Later, at 22:39:35 UTC, the attacker targeted the compromised wallet again. This time, the contract received an expanded list of 124 tokens and a new destination address.

The operation drained another 128.49 ETH, along with residual balances of various digital assets.

The attacker's access was still active after 23:00 UTC. At 23:55:47 UTC, another 2,961.99 ETH arrived at Binance 14; roughly a minute later, a fifth sweep removed 2,961.91 ETH.

Binance finally removed the malicious delegation at 00:10:35 UTC on October 30, by sending an authorization to the zero address. The attacker had retained the ability to drain Binance 14 for nearly four hours after the initial takeover.

The lesson from this episode is particularly important: stopping the initial theft is not enough if the attacker retains a mechanism for controlling the wallet and draining new deposits.

BitOK investigated the Bitcoin side of the attack separately.

At 20:20:06 UTC, 11 transactions left a Binance hot wallet for a new address.

Together, they carried 18,270.2 BTC.

The attacker paid a higher fee rate: 10.05 satoshis per virtual byte, compared with the wallet's usual 5.01.

The funds were split almost immediately after arrival.

Seventeen addresses received 1,000 BTC each, another received 832.5 BTC, and the remaining 437.7 BTC was sent separately.

As of 06:20 UTC on October 30, the 19 Bitcoin addresses still held the 18,270.2 BTC traced from Binance.

Splitting Bitcoin into multiple addresses does not, by itself, erase its provenance. Bitcoin transactions are recorded publicly, allowing investigators to trace the trail from Binance's hot wallet to the destination addresses.

The next moves will be especially important to watch: unlike USDT or USDC, Bitcoin cannot simply be frozen by an issuer.

The most important new development concerns what happened after the initial theft. BitOK traced stolen Binance funds to the same Ethereum address that was already receiving proceeds linked to the September 2026 Bitget hack. The overlap emerged at the laundering stage, not in the newly created wallets used to prepare the Binance intrusion.

On October 30, the attacker began moving TRX and USDT from Tron through THORChain, a cross-chain protocol that pays out an asset on a different network. Binance-linked payouts in ETH were directed to 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7. The receiving address had already collected ETH from BTC tied to the Bitget incident.

BitOK traced the Bitget-related route from ZEC through the Maya protocol into BTC, then through THORChain into ETH. The relevant Bitcoin addresses appeared in Bitget's published list of attacker-controlled addresses and had been active since October 23, six days before the Binance theft. No ZEC was stolen in the Binance attack.

By 06:20 UTC on October 30, the investigators had identified eight Bitget-linked THORChain payouts totaling 349.46 ETH and five Binance-linked payouts totaling 13.63 ETH to the same receiving address. The first Binance-funded payout arrived at 04:02:59 UTC, after Bitget-linked ETH had already accumulated there.

The address sent 259 ETH onward before the Binance proceeds arrived. After the first Binance-linked payout, it transferred 61 ETH, 30.55 ETH and 33.13 ETH to three other wallets; at 06:11:59 UTC, it sent its remaining 166.87 ETH to a fourth address. The mixing of the two funding streams is observable on-chain, although a shared receiving address by itself does not identify the individuals behind either intrusion.

The two cases show further similarities. According to Bitget, the September attack involved an intrusion into internal systems and manipulation of transaction data without the theft of private keys. Binance described an entry point through a DevOps engineer's laptop and fraudulent withdrawals sent via a service container, again without a private-key leak. Bitget attributed its attack to North Korea.

BitOK also identified traits associated with North Korean exchange attacks: the compromise of signing infrastructure, rapid withdrawals across networks, immediate swaps out of freezable tokens, advance testing, Tornado Cash funding and preparatory activity concentrated within UTC+9 working hours.

The newly identified shared laundering address is stronger evidence of operational overlap than similarities in tactics alone. BitOK assesses that the two thefts may be linked to the same North Korean group and that one operator controlled the observed laundering flows. That remains an analytical attribution, not proof of the real-world identity of every participant.

Shortly after detecting suspicious activity, Binance suspended some withdrawals.

According to BitOK, payouts from Bitcoin and Tron hot wallets stopped at around 20:36–20:37 UTC, although deposits continued to arrive.

Analysts compared activity with previous days. During the same time window on October 28, the exchange paid out 394.69 BTC to customers; on October 29, that figure was 167.98 BTC. On Tron, USDT payouts fell from 89.8 million to 33.3 million.

In a separate Tron comparison, deposits in the 20:30-22:00 UTC window rose to 45 million USDT on October 29, versus roughly 22 million USDT in comparable periods on October 26-28, even as USDT payouts during the same window fell to 2.55 million from a previous daily range of 36-49 million. These figures describe visible wallet flows, not the number of customers attempting withdrawals.

The on-chain data does not establish a customer withdrawal panic during the period studied. Nor can the drop in payouts be read as proof of weak demand: the exchange had halted outgoing transfers while deposits continued.

Binance pledged to cover customer losses in full using its SAFU insurance fund and its own resources. The exchange also said it was working with law enforcement and blockchain analysts.

The market reacted with falling prices and liquidations of leveraged positions. According to Coinglass, $1.52 billion in positions was liquidated over 24 hours, with Bitcoin and Ethereum accounting for the largest share.

For BitOK's investigation, however, the central question was not the price reaction but what happened to the stolen assets and whether they could be recovered.

As of 06:20 UTC on October 30, BitOK identified these major balances linked to the attacker:

The Arbitrum assets no longer belong in the attacker-controlled totals: 8,425.998 ETH and 74.56 million ARB had been seized by the network's Security Council. The attacker also had 60 million USDT posted as collateral at Aave, while 29,934 wBETH and multiple stablecoin balances had been frozen.

BitOK valued the attacker-linked ETH, BTC, XRP and SOL at approximately $2.95 billion at the reporting cutoff. This figure covers those four cryptocurrencies only, not all stolen tokens or the assets frozen, burned or seized.

The location and availability of these funds can change with each subsequent transfer. Further tracing will depend on whether the attacker uses exchanges, bridges or protocols capable of identifying and potentially restricting the funds.

BitOK's expanded investigation places the loss at approximately $6.15 billion across nine blockchains. The attack exploited the infrastructure used to sign hot-wallet withdrawals, not a vulnerability in one token or smart contract. The Binance 14 compromise used 50 EIP-7702 authorizations, one of which delegated control to the attacker's contract.

The immediate theft lasted 31 minutes, but control of Binance 14 persisted for nearly four hours. During that time, further deposits were swept out, including a 200 million USDT routine top-up and, later, nearly 2,962 ETH. Binance revoked the delegation at 00:10:35 UTC on October 30.

Tether and Circle froze approximately $2.59 billion in stablecoins. Including freezes by other issuers, the destruction of BEAM and the recovery of funds in Arbitrum, approximately $2.79 billion was frozen, burned or seized. Yet the attacker had already converted 669 million USDT into ETH and TRX and secured 60 million USDT as Aave collateral.

A further finding links the laundering of proceeds from Binance and Bitget: BitOK traced both streams through THORChain to the same Ethereum receiving address. The shared route supports an inference of a common laundering operator and strengthens the hypothesis of an overlap with the North Korean group implicated by Bitget, while not independently proving the attacker's identity.

As of 06:20 UTC on October 30, the tracked funds still included 505,603 ETH, 18,270.2 BTC, 233.46 million XRP, roughly 970,500 SOL, 675.9 million TRX and about 1.61 million AVAX. BitOK's evidence connects the preparations, signing operations, fund conversions, issuer interventions and subsequent laundering routes.

The Binance incident shows why the security of private keys alone is insufficient. Exchanges also need controls over signing authority, safeguards against suspicious withdrawal instructions, prompt revocation of compromised permissions and continuous monitoring of asset movements across networks.