The sequence of the Binance hack is now available as a timeline. Attackers drained most of roughly USD 6.3 billion from the exchange's hot wallets in about 20 minutes. According to analytics firm TRM Labs, they had the exchange's own signing system sign the transactions.
A crypto exchange holds customer funds partly in hot wallets that stay online for withdrawals. The rest sits offline in cold storage. Every withdrawal first passes through a signing infrastructure that checks requests against internal policies. Only then does it sign them with the hot wallet keys. Whoever controls this layer consequently needs no key. Binance reported the theft on October 29, 2026, and cited further points of entry the following day. The pattern resembles the Bybit hack of February 2025. There, too, the approval layer failed, and no contract bug played a role. TRM attributes the attack to North Korea with high confidence. In its reconstruction of the attack, it puts the loss at USD 6.36 billion across ten chains. Elliptic, by contrast, arrives at USD 6.43 billion across eleven chains, each valued at the time of transfer. A promised root cause report should clarify the exact cause.
36 hours of preparation via Tornado Cash
Preparation began at least 36 hours before the theft. Starting October 28, 2026, a newly created operator wallet received small amounts through the mixer Tornado Cash. According to Elliptic, these were three withdrawals of 0.1 ETH each. In addition, around 16:00 UTC on October 29, 2026, the attackers deployed the sweeper contract to the blockchain. This program drains balances in bulk. The contract only accepts commands from the operator wallet. According to security firm Immunefi, it has just around 130 lines of code.
Earlier that same day, the attackers had tested a first version of the code on two wallets. They later rehearsed the final version on a third wallet, roughly four hours before the attack. The test funds then flowed back to the operator. The attackers thus checked the code twice and rehearsed it once. TRM sees the same pattern as in the Bybit hack and the attack on KelpDAO in April 2026.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
How the Binance hack unfolded, minute by minute
In an initial statement, Binance named a possibly compromised laptop of a DevOps engineer as the entry point. Through this machine, the attackers had allegedly reached a service container and submitted unauthorized withdrawals. According to this account, there was initially no sign of leaked private keys. On October 30, 2026, however, the exchange reported further points of entry. It described a complex attack that no single person had carried out. Binance has not yet disclosed which points these are. So the laptop remains an unproven first claim.
The outflows began at 20:05 UTC on October 29, 2026, on the XRP Ledger. By 20:09, five Binance wallets there had sent 233.46 million XRP, worth around USD 296 million, to a single address. Each wallet stopped at its minimum balance. Shortly after 20:10, Solana followed with 970,500 SOL, along with Optimism. At 20:20, the Bitcoin hot wallet sent out 18,270 BTC worth around USD 1.47 billion. A so-called peel chain split the amount into chunks of 1,000 and 100 BTC within the same block. At the same time, the Tron hot wallet lost 612.7 million USDT and 46.4 million TRX within two minutes. With the Ethereum sweep at 20:24, the main phase lasted about 20 minutes. Finally, a second wave hit Avalanche and Polygon around 23:05.
TRM draws its central conclusion from this sequence. On its own, the Ethereum delegation could look like phishing. Yet the attackers drained nine other chains with ordinary signed transfers, without any delegation. TRM therefore concludes that the hot wallet signing system itself signed for the attacker. Data from Elliptic backs this reading. According to it, a second Ethereum hot wallet called "Binance 16" has its own key. That wallet sent 28,006 ETH and other tokens directly to the attacker, together worth USD 174 million.
| Blockchain | Assets drained | USD |
|---|---|---|
| Ethereum | 200,630 ETH and 185 other tokens | 3.79 billion |
| Bitcoin | 18,270 BTC | 1.47 billion |
| Tron | 612.7 million USDT, 46.4 million TRX | 628 million |
| XRP Ledger | 233.46 million XRP | 296 million |
| Solana | 970,500 SOL | 96 million |
| Arbitrum, Optimism, Base | including 74.6 million ARB | 39 million |
| Avalanche | various tokens | 28 million |
| Polygon | various tokens | 10 million |
| Total | ten blockchains | 6.36 billion |
Values at the time of the theft. Source: TRM Labs
How 50 authorizations unlocked the sweeper
On Ethereum, the attackers used a feature that arrived with the Pectra upgrade in May 2025. With EIP-7702, a regular wallet signs an authorization that points to a smart contract and then runs its code. The signature only covers the chain ID, target address and nonce, not the individual transaction. The nonce is the account's counter. Neither the recipient nor the amount is part of the signature. Moreover, anyone may submit such an authorization. The specification itself warns that delegation gives the code unrestricted access to the account.
At 20:20:59 UTC, the attackers submitted a transaction with 50 authorizations. Each carried a signature from the "Binance 14" wallet key and pointed to the sweeper. They needed that many because the nonce must match exactly, while the high withdrawal rate kept advancing the counter. As a result, the series covered nonces 18,914,775 to 18,914,824. In the end, only nonce 18,914,809 hit. The network discarded the other 49. TRM reads the series as a sign of time-limited access or of a route through a request system. At 20:24:23 UTC, the attacker then called the sweeper via Binance 14. A single transaction drained 167,464 ETH and 63 tokens, including about 1.6 billion USDT, together worth around USD 2.5 billion.
The delegation remained active afterward, because EIP-7702 keeps it in place until the next authorization. The specification justifies this with convenience, since users should not have to set up new contracts all the time. Here, however, the same property enabled further sweeps of new deposits without a new signature. These followed at 20:41, 21:04, 22:39 and 23:56 UTC, among others. Binance 14 only revoked the delegation at 00:10 UTC on October 30, 2026, almost four hours later. Through the compromised wallet, the attackers also instructed another Binance wallet and drained 823 million USDC from it. According to TRM, this second wallet is a separate smart account. In total, Binance lost USD 3.79 billion on Ethereum by TRM's count.
The race against stablecoin freezes
Stablecoins such as USDT, USDC and RLUSD have a central issuer that can freeze individual addresses. Bitcoin and Ether lack such an authority. Thus, only an exchange that freezes incoming funds or authorities with access to the keys can stop them. Yet Tether and Circle froze the first addresses only about an hour after the outflows began. According to Elliptic, the attackers swapped 434 million USDT into 160,451 ETH via Uniswap, 1inch and market makers. They accepted a discount of 12 to 26% below market price, which Elliptic reads as speed taking priority over value. By the first freezes, around USD 786 million in stablecoins had moved into ETH and TRX.
A second attacker wallet turned to the lending protocol Aave as well. It deposited 59.9 million USDT as collateral and borrowed 19,762 ETH worth around USD 44 million. Consequently, the freezable USDT now sits in the Aave pool, while the ETH stayed with the attacker. Aave froze the affected markets as a precaution and has since reopened them. The positions remain fully collateralized. And on Tron, the attackers swapped 234 million USDT on SunSwap into 638 million TRX. According to Elliptic, the main laundering wallet there executed 546 TRX transfers, at a median interval of 96 seconds. In its own analysis, Chainalysis classifies the transaction pattern on Tron as automated. Many addresses first receive exactly 1 TRX, then the amount they subsequently forward. Elliptic, though, cannot judge whether AI agents play a role.
TRM puts the non-freezable remainder at around USD 2.4 billion in Bitcoin and Ether. Including XRP and TRX at current prices, Elliptic arrives at USD 3.21 billion. The bitcoin sits spread across 19 addresses via a peel chain and has not yet reached any service. Analysts therefore expect bridges, swap services and OTC desks as the next stage.
The controls exchanges need to add
TRM's recommendations target exactly these weak points. Exchanges should reject EIP-7702 authorizations unless they expect them. Furthermore, they should treat requests for many authorizations across a nonce range as a sign of compromise. Additionally, TRM recommends separating signing infrastructure and approval paths by chain and wallet tier. On treasury wallets, any delegation is an immediate alarm, because an address that should hold no code suddenly carries some. At Binance, according to the exchange, the delegation did not pass through the normal approvals. The revocation came only after almost four hours. For this exact scenario, TRM therefore advises a tested, pre-approved revocation process. Immunefi Vice President Simone Imbrescia likewise sees the weakness in the operational layer, since the attack needed little on-chain code.
Binance has not yet disclosed the initial point of entry. The exchange keeps withdrawals paused, plans a gradual reopening and is overhauling its withdrawal system. Alongside the root cause report, it is also targeting a proof-of-reserves report for November 2, 2026.
![ICE wants to offer regulated Hyperliquid perps to US retail investors through Trade[XYZ], a firm in which Stan Druckenmiller has invested.](https://cryptovalleyjournal.com/wp-content/uploads/2026/03/CVJ.CH-NYSE-ICE-OKX-450x300.jpg "ICE plans to bring Hyperliquid perps to the US with Trade[XYZ]")
