Anatomy of the Binance Hot-Wallet Breach of 29 October 2026 (OpenAlex (recherche mondiale))

Summary

• An attacker moved roughly US$6.3 billion out of Binance wallets across ten blockchains, with most funds leaving within about 20 minutes starting at 20:05 UTC on 29 October 2026.p.1
• Stablecoin issuers and one network froze about US$2.7 billion of the stolen funds within hours of the breach.p.1
• The event represents the largest crypto theft on record, approximately four times larger than the US$1.5 billion Bybit heist in February 2025.p.3
• Defenders executed major freezes including 971.1M USDT by Tether at 21:01 UTC and 823M USDC by Circle at 21:04 UTC.p.3
• Ethereum suffered the largest chain-level loss at US$3.79B (60%), followed by Bitcoin at US$1.47B (23%).p.8

Key insights

1. Blockchain analytics firm TRM Labs attributed the attack with high confidence to North Korea's TraderTraitor unit.p.1
2. Binance's preliminary investigation indicates that a compromised DevOps engineer laptop was used to access a service container and submit unauthorized withdrawals.p.5
3. Preparation for the heist began at least 36 hours before the theft, starting with three small Tornado Cash withdrawals to an operator wallet.p.3
4. On Ethereum, the attacker submitted a batch of 50 pre-signed EIP-7702 authorizations in one transaction to ensure control of the target wallet regardless of nonce value.p.7
5. The attacker rapidly converted funds by selling about 325M USDT for ETH via UniswapX at a discount exceeding 10%.p.6
6. Because assets across ten blockchains produced valid signatures within 30 minutes, TRM Labs concluded that Binance's shared hot-wallet signing infrastructure was compromised.p.8
7. Approximately 42% of the stolen total was frozen by stablecoin issuers and protocol security councils, leaving un-freezable ETH and BTC beyond defender reach.p.9