Binance hack: 50 pre-signed authorizations turned a wallet into a sweeper

Hackers most likely made Binance's own hot wallet signing system approve transfers of their choosing on Oct. 29, 2026, blockchain analytics firm TRM Labs assesses. On Ethereum, 50 authorizations signed in advance turned a Binance hot wallet into their collector. The Security Alliance, or SEAL, estimates they were inside Binance for about eight weeks first, from an unspecified day in September. That matters to anyone with coins on an exchange, because those wallets send whatever the exchange's signing system approves.

The way in ran through employees' computers. In Binance's account as reported by Cointelegraph, one employee's device was infected in June through a tampered installation of Homebrew, a popular package manager. On Oct. 20, attackers used the computer of an engineer compromised in September to take over the devices of two wallet infrastructure engineers. Chainalysis's summary of Binance's findings says that engineer was lured with a job offer.

Dwell time is how long attackers stay inside a network before acting. Its length depends on where the clock starts: in June, with the first infected device, or in September, where the eight-week estimate begins.

TRM traces the theft to Binance's signing system

A signing system is the software that approves a wallet's outgoing transactions, much like a bank's payment authorization desk. The assessment is TRM's best explanation pending a root cause from Binance. On every chain but one, Binance wallets sent the stolen funds through ordinary signed transfers.

Ethereum worked differently. There the attackers used an EIP-7702 delegation, a feature that lets a regular account hand its actions to code, comparable to a standing power of attorney. With 50 authorizations prepared in advance, the Binance hot wallet became a sweeper, an account that collected funds under the attackers' control.

That one chain carried most of the money. By TRM's count, about $6.36 billion left Binance wallets on 10 blockchains on Oct. 29, with each transfer valued at the asset's price when taken. Ethereum accounted for about $3.79 billion of that, about 60%. At later prices, the same assets come to about $6.23 billion.

The XRP leg followed the ordinary-transfer pattern. Between 8:05 and 8:09 p.m. UTC on Oct. 29, five Binance wallets sent 233.46 million XRP, about $296 million at the time, to a single attacker address. As of 12:30 a.m. UTC on Oct. 30, that XRP was still at the address.

Binance dates the first breach to June

The June infection came while the employee was trying to install an AI coding tool, Cointelegraph reported, citing a Binance post on X. Binance detected it, replaced the device and rotated related credentials. By then, the attackers had gathered information about employees working on its wallet infrastructure.

In Chainalysis's summary of Binance's findings, the September approach came through a legitimate job platform. The attackers spent weeks building trust with the engineer before sending an assignment.

Per Binance, as reported by Cointelegraph, the attackers on Oct. 20 used that engineer's computer and an internal AI tool to take control of two wallet infrastructure engineers' devices. They then discovered a deployment permission token, which was used during the Oct. 29 exploit.

TRM's tracing dates the onchain run-up to at least 36 hours before the theft. It began the morning of Oct. 28 with three small withdrawals into the attackers' operator wallet from Tornado Cash, a service that mixes deposits to hide their origin. Those 36 hours measure the onchain staging alone.

The fake-interview playbook has been used before

SEAL sets Binance beside three other 2026 intrusions it ties to TraderTraitor, which TRM calls North Korea's elite hacking unit. Its LayerZero estimate is about six weeks, from March 6 to April 18. AFX ran from July 9 to July 22, about two weeks by those dates, though labeled about three. At Bitget, logs show at least 24 days, from August to Sept. 24, summarized as about six weeks.

Set side by side, the eight-week Binance estimate is the longest of the four.

SEAL argues that a company threat model tuned for Contagious Interview, another North Korean subgroup, will fail against TraderTraitor because preparation, operators and post-exploitation differ. Its Nov. 5 post lists four TraderTraitor front-company domains observed in 2026, in a list it calls non-exhaustive: citalab.net, citalab.com, bitfit.io and oddium.io. As of that date, Binance had yet to provide any meaningful technical indicators, the file names, addresses and other traces companies use to check their own networks.

Chainalysis has attributed more than $14.3 million in losses over the past 18 months to similar North Korea-linked fake interview and malware schemes.

North Korea rejects the TraderTraitor attribution

TRM attributes the attack with high confidence to TraderTraitor, citing on- and off-chain intelligence it has not published.

Cointelegraph and SEAL report that the FBI also attributed the attack to TraderTraitor.

Pyongyang rejects that. In a statement carried by the state news agency KCNA on Nov. 3, 2026, Kim Yo Jong, sister of leader Kim Jong Un, denied North Korean involvement, NK News reported. The statement called the FBI's accusation "absurd" and evidence of Washington's hostile attitude.

About $2.7 billion was frozen by Oct. 30

As of 12:30 a.m. UTC on Oct. 30, about $2.7 billion of the haul was frozen onchain, by TRM's tally. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, including 40.5 million of Ripple's RLUSD. Arbitrum's Security Council moved about $30 million in ETH and ARB out of reach. Binance's earlier verified total was $2.54 billion.

Frozen tokens are locked in place, a separate step from returning them to Binance. At the same snapshot, the attacker held more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach, plus smaller amounts on other chains.

Per TRM, Binance said it temporarily suspended withdrawals on multiple networks as a precaution and that user funds are safe.

Whether customer balances or Binance's own reserves carried the loss, and whether anyone will be reimbursed, is still open.