On the night of October 29, an attacker moved roughly $6.3 billion out of Binance hot wallets across ten blockchains, most of it in about 20 minutes. It is the largest theft of digital assets on record, more than four times the $1.5 billion Bybit theft of February 2025. The incident is still unfolding: all figures reflect information available as of October 30, 2026, 05:30 UTC, and estimates have already been revised upward several times.
How did the attacker get in? Where did the money go, and how much of it could be stopped? And what does the incident mean for custody, markets and regulation? Leonardo Larieira of Teroxx Research answers these questions in the new special report The Binance Hack, part of the Teroxx Radar series.
An infrastructure breach, not a smart contract bug: Binance points to a compromised DevOps engineer's laptop that gave access to a service container able to submit withdrawals. Binance says no private key leaked.
North Korea is the prime suspect: Several blockchain intelligence firms attribute the attack with high confidence to TraderTraitor, the Lazarus Group unit behind the Bybit theft. Binance and government authorities have not yet attributed it.
Stablecoin issuers acted as a circuit breaker: Roughly half of the impact, about $3 billion, was frozen within hours. What escaped is the part no issuer can freeze: ETH and native BTC.
Customer coverage remains to be verified: Binance has pledged to cover all losses through its SAFU fund and company funds. The next Proof of Reserves snapshot is due on November 1.
Market impact so far is contained: BNB took the brunt, while BTC and ETH sold off with broad risk aversion and recovered part of the move.
The structural message is about custody: Expect faster moves to segregated custody, off-exchange settlement and stricter withdrawal controls.
How the Binance Hack Worked: Signing Access, Not a Leaked Key
According to Binance's preliminary investigation, the attacker compromised a DevOps engineer's laptop and used it to reach a service container that could submit withdrawal transactions. On Ethereum, the attacker used EIP-7702, a feature introduced with the Pectra upgrade in May 2025, to delegate Binance 14, one of the exchange's largest hot wallets, to a sweeper contract. From then on, every asset in the wallet and every new deposit was forwarded to the attacker. On nine other chains, funds left through ordinary signed transfers that looked like normal Binance withdrawals. Wallets with different key types all produced valid signatures within about 30 minutes, which suggests the attacker could request signatures from Binance's signing infrastructure.
There is no official attribution yet. TRM Labs and Chainalysis say they have high confidence that North Korea is behind the attack, and the pattern fits earlier operations: small Tornado Cash funding, extended staging and pre-signed approvals executed in a burst. 2026 already counts more than 320 hacks, roughly 1.5 times the previous peak of about 216 in 2024.
The Binance hack is more than four times the size of the previous record, the 2025 Bybit theft. Source: TRM Labs, Chainalysis, Fortune, Business Standard, CoinDesk; Teroxx Research.
Stablecoin Freezes Stopped About Half of the Damage
The main reason the net loss is far smaller than the headline figure is the speed of stablecoin issuers. Tether froze 971 million USDT at 21:01 UTC, less than 40 minutes after Binance 14 was swept, and later raised the total above 1.5 billion. Circle followed three minutes later with 823 million USDC. Ripple, World Liberty Financial, First Digital and Arbitrum's Security Council froze further assets. Binance now reports about $3 billion frozen.
The attacker anticipated this. Within minutes, freezable stablecoins were converted into ETH, at an implied price near $2,650 per ETH against about $2,300 in the market, and USDT was posted on Aave to borrow ETH. As of the latest count, the attacker holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion. The episode also shows how much discretionary power sits with a few issuers, a question we examine in our report The State of Stablecoins at Mid-Year 2026.
Freezes by issuers and networks recovered roughly half of the impact. Source: TRM Labs, totals as of October 30, 00:30 UTC (about $2.7B); Binance reports about $3B including later actions.
Market Reaction: BNB Took the Brunt, ETH Carries the Overhang
So far, the reaction has been sharp but orderly. BNB fell from about $744 to an intraday low near $683, a drawdown of about 8%, and has since recovered to around $716. BTC slid from about $80,800 to below $76,500 and ETH from about $2,334 to $2,173, before both recovered part of the move. Market-wide liquidations reached about $1.5 billion, mostly long positions. ETH underperformed BTC after the initial shock, consistent with the market pricing the potential supply from the attacker's wallets.
BNB carried the idiosyncratic risk, ETH the supply risk. Hourly close indexed to 100 at October 29, 19:00 UTC. Source: CoinMarketCap; Teroxx Research.
Binance's Reserves and the November 1 Checkpoint
Binance has committed to cover all losses from SAFU, its emergency fund of around $1 billion, and from company funds. The estimated outflow equals about 4.4% of the roughly $145 billion held in Binance-labelled public wallets before the incident. The drained wallets are the same wallets that back Binance's monthly Proof of Reserves. A static calculation based on the October 1 reserve figures implies ETH backing of about 94.6%; this is not a measured post-incident ratio. Confidence over the coming days will depend on an orderly reopening of withdrawals, the reserve snapshot on November 1, the technical post-mortem and any replenishment purchases.
What the Binance Hack Means for Investors
On the evidence available today, neither Binance insolvency nor systemic market disruption has been demonstrated. The lasting impact will be felt less in prices than in how investors hold their assets: segregated custody, off-exchange settlement, event-driven Proof of Reserves and stricter controls on hot wallets. Supervisors, including under MiCA, are likely to focus on operational resilience and ICT risk. Our MiCA report shows which legal boundaries every mandate should define.
The full 17-page report also covers the timeline of the night, the six DeFi exit routes, industry reactions, the possible role of AI and three scenarios for the next two to four weeks. For the broader market context, see our latest Weekly Market Update. This report is for information purposes only and does not constitute investment advice.
Only 103 of 1,229 MiCA permissions in the ESMA register cover advice or portfolio management. What that means for investors and where U.S. firms stand.
