Binance Confirms Record $6.3 Billion Crypto Theft via Compromised Hot Wallet and EIP-7702
Binance confirmed on October 30, 2026 the theft of approximately 6.3 billion dollars in cryptocurrencies, equivalent to nearly 34 billion reais, in what analysts describe as the largest recorded theft in the sector.
The attack occurred on Thursday, October 29, with unauthorized transfers completed in roughly 20 minutes. According to the reconstruction by TRM Labs, the outflows began at 20:05 UTC on October 29 after the attacker compromised the system responsible for authorizing transfers.
The company stated that the intruder used the EIP-7702 feature of Ethereum to assume control of a hot wallet and had prepared the operation for at least 36 hours. The technical explanation evolved within less than a day: on Thursday evening Binance attributed the breach to a compromised notebook belonging to a DevOps engineer that granted access to a service container used to submit withdrawals.
On Friday the exchange clarified that the incident resulted from multiple factors and revealed additional points of intrusion. Co-CEO Richard Teng wrote that the attacker did not rely solely on one engineer's permissions and that the operation was not a single-click action. The exchange reported no evidence of private key leakage, indicating that the attacker instead forced the company's infrastructure to sign the transfers on their behalf.
Approximately 3 billion dollars have been located, with part of the funds blocked through cooperation with other companies. Tether froze more than 1.57 billion USDT and Circle blocked over 800 million USDC, according to statements from Paolo Ardoino and Jeremy Allaire. The theft represents nearly 4 percent of assets under custody according to DefiLlama.
Co-CEO Yi He stated that Binance will cover all losses using the SAFU fund and its own capital. The exchange suspended withdrawals on multiple networks on Thursday, restored deposits on Friday, and projected resuming withdrawals within approximately 45 hours. It is also working with the FBI and the United States Secret Service, according to Reuters.
Attribution remains disputed. TRM Labs attributes the operation with high confidence to the North Korean-linked group TraderTraitor, associated with Lazarus, and Chainalysis reached the same conclusion, yet Binance declared on October 30 that its investigation has not identified the responsible parties.
Related articles
EIP-7702 Explained: How Ethereum's New Signature Standard Enables Persistent Wallet Delegation Attacks
EIP-7702, activated in May 2025 as part of the Pectra upgrade, allows Externally Owned Accounts to delegate execution to smart contract code while retaining their original address and private key. The mechanism introduces powerful features such as batch operations, gas sponsorship, and limited permissions, but also creates new attack surfaces when users sign malicious delegations. Attackers exploit social engineering to obtain EIP-7702 authorizations that install sweeper contracts capable of draining ETH, ERC-20 tokens, and NFTs without further signatures. Unlike ERC-20 approvals, the delegation persists on-chain until explicitly revoked and can affect future incoming funds across multiple networks when chain_id is set to zero. Research from 2026 identified over 900 malicious delegated accounts linked to more than $2.3 million in confirmed losses. The standard itself is not inherently vulnerable; risk stems from unsafe contract implementations and user errors when signing authorizations. Users are advised to verify delegations via Etherscan or eth_getCode and revoke them through trusted wallet interfaces when necessary.
Binance Ethereum Hot Wallets Drained of Over $5.5 Billion via EIP-7702 Delegation Attack
On October 29, attackers drained between $2.5 and $3.5 billion in ETH and tokens from Binance hot wallets on Ethereum within 40 minutes, with the total including Bitcoin and Tron reaching at least $5.57 billion according to Decrypt. The attacker did not steal private keys directly but instead used EIP-7702 to delegate execution code from a malicious contract to Binance 14, allowing a single sweep call to transfer all assets. Tether and Circle froze roughly $2.5 billion in USDT and USDC within the first hours, while Binance stated user funds remain secure and investigations continue. Blockchain analysis reveals 18 hours of preparation including three test runs on external wallets funded via Tornado Cash, followed by the main delegation and sweep in just over three minutes. The attack shares strong operational similarities with previous incidents attributed to TraderTraitor, a Lazarus subgroup, including gas funding patterns, test sweeps, and the use of a sweep function. ETH was moved first to an address that has not yet dispersed funds, while stablecoins were fragmented across new wallets before partial freezes took effect.
Bitget Loses $351 Million in Record 2026 Crypto Theft After Attackers Forge Internal Transfers
Bitget's hot and warm wallets were drained of approximately $351 million on September 24, marking the largest known single crypto theft of 2026. Attackers did not steal private keys but instead forged internal transfer requests that bypassed approval workflows. The stolen assets spanned at least five blockchains, with the largest portion being roughly 103 million XRP worth about $157 million. Bitget's CEO Gracy Chen attributed the incident to North Korean hackers based on IP patterns, behavioral signatures, and on-chain evidence matching prior operations. The exchange maintains a $464 million user protection fund sufficient to cover all losses, while deposits and trading remain unaffected and only withdrawals are temporarily frozen. The case highlights how process-level compromises can bypass even robust key-management controls in cryptocurrency exchanges.
Address Substitution Attacks Exploit Partial Address Checks in Crypto Wallets
Address poisoning, clipboard hijackers, and supply-chain malware all rely on users verifying only the first and last few characters of long blockchain addresses. Researchers detail real incidents including a May 2024 theft of 1,155 WBTC worth roughly 68 million dollars where an attacker poisoned transaction history after a test transfer. Studies from Carnegie Mellon University show that even security-conscious users miss mismatches in truncated addresses 21 to 38 percent of the time. Existing identicons such as Jazzicon and Blockies can be matched by attackers because they depend on only the first eight hex characters. The team released the open-source Humanized Hash library that renders any address or hash as a 4x4 grid of colored shapes using PBKDF2 stretching, making forgery computationally expensive. Calculations indicate that matching both the visual pattern and edge characters requires tens to millions of GPU-years on current hardware. The library supports multiple languages with identical output and carries an MIT license with a fixed algorithm.