The short answer
Binance lost roughly $6.3 billion because attackers gained control of what its hot wallet would sign, not because a vault was cracked. Early findings point to an engineer’s compromised laptop, a never-expiring full-access token and a signing system that approved delegations to an attacker’s contract. Any team building fintech software that moves money automatically has the same weak spot.
What happened at Binance?
On October 29–30, 2026, depending on time zone, funds began leaving Binance hot wallets on the XRP Ledger, Ethereum, Bitcoin and other chains. The Associated Press reports about $6.36 billion moved across ten blockchains in around 20 minutes. Binance froze deposits and withdrawals, confirmed that only hot wallets were hit while most assets sit in cold storage, and set aside company funds to cover the loss.
Blockchain intelligence firms TRM Labs and Chainalysis linked the theft to TraderTraitor within a day, and the FBI publicly attributed it to the same North Korean group, saying the assets were being converted mainly into Ether with further laundering likely. Tether and Circle froze roughly $3 billion in USDT and USDC, which CNBC describes as about half of the haul. Binance says the remaining losses will not be passed on to users.
How did the attackers get in?
The full post-mortem is not public, so treat details as reported. According to the AP, Binance’s first finding was a compromised laptop; later work uncovered additional points of breach, and the attackers held “a never-expiring, full-access token” to a hot wallet.
TRM Labs’ on-chain analysis adds the mechanics on Ethereum. The attacker submitted one transaction carrying 50 EIP-7702 authorizations, each signed in advance by the Binance hot wallet for consecutive nonces. Those delegations pointed the wallet at a sweeper contract the attacker controlled, so the balance and later deposits flowed out. TRM’s conclusion is that the attacker most likely could make Binance’s signing system sign transactions of its choosing, which is a compromise of the approval path rather than theft of one private key.
Why does this matter beyond crypto?
Swap “hot wallet” for “payout service” and the pattern fits most modern fintech stacks. Card issuing, ACH, real-time payments and treasury tools all have a component that turns an API call into money movement, usually guarded by a service token and a rules engine. If the rules engine only checks amounts and destinations, an attacker who can submit requests does not need the keys at all.
The EIP-7702 detail is a warning about new transaction types in particular. A signing policy written before a protocol change can approve a message whose effect it does not understand. The same risk appears whenever a payment network, bank API or card scheme adds a new instruction type and the approval service is not updated in step.
What it means for US & EU software teams
For US fintechs, state-backed groups like TraderTraitor go after developers directly, often with fake job offers or poisoned tooling, because one engineer’s session can open the whole system. Treat developer laptops that can reach production signing or payout services as part of the cardholder-data and custody perimeter, and test that boundary with a penetration test and security audit that includes the CI/CD and secrets path, not only the public app.
For EU teams, the incident lands as DORA’s ICT risk and incident-reporting rules apply to financial entities and MiCA governs crypto-asset service providers. Both expect documented access control, tested recovery and fast incident classification. A never-expiring token to a system that moves client funds is exactly the kind of finding an auditor or supervisor will ask about.
What should fintech teams do now?
- Kill long-lived tokens. Inventory every credential that can request a signature or payout; make them short-lived, scoped and bound to a device or workload identity.
- Make the signer understand what it signs. Decode and allowlist transaction or instruction types; reject delegations, approvals and contract calls that policy does not explicitly cover.
- Cap velocity. Hard limits per minute and per hour on hot wallets and payout accounts would have turned a 20-minute drain into a contained incident.
- Require two parties for policy changes. Changes to signing rules, allowlists and limits need separate approval and alerting.
- Harden engineer endpoints. Managed devices, phishing-resistant MFA and no production secrets on laptops.
- Rehearse the freeze. Know who you call at stablecoin issuers, banks and processors, and how fast you can halt outflows.
None of this is legal advice. The direction is clear, though: the most valuable target in a money-moving system is now the automation that approves transfers, and it deserves the same scrutiny as the keys themselves.
Frequently asked questions
What happened in the Binance hack?
On October 29-30, 2026 attackers moved roughly $6.3 billion in crypto out of Binance hot wallets across ten blockchains, according to the Associated Press. The FBI attributed the theft to TraderTraitor, a North Korean group. Binance said it would cover the losses itself and resumed phased withdrawals on November 1.
How did attackers get into Binance's hot wallet?
Binance’s early investigation pointed to a software engineer’s compromised laptop, and the AP reports the attackers obtained a never-expiring, full-access token to a hot wallet. Blockchain analytics firm TRM Labs says the most likely explanation is that the attacker could make Binance’s hot wallet signing system sign transactions of its choosing, including 50 pre-signed Ethereum EIP-7702 delegations.
What is EIP-7702 and why did it matter here?
EIP-7702 is an Ethereum feature, live since May 2025, that lets a regular account delegate its behaviour to smart contract code. TRM Labs reports the attacker used signed delegations to point the Binance hot wallet at a sweeper contract it controlled, so funds arriving later could also be swept. Signing policies that only check transfer amounts and destinations can miss this kind of authorization.
Did Binance customers lose money?
Binance says no. The exchange stated it will bear the financial impact and that losses will not be passed on to users. TechCrunch reports Binance covered about 95% of the stolen assets, and Tether and Circle froze roughly $3 billion in stablecoins tied to the theft.
What should fintech teams outside crypto take from this?
Treat the signing or payment-approval service as the crown jewel, not just the keys. Remove long-lived, full-access tokens, make the signer inspect what it is signing, cap hot-wallet and payout velocity, and harden engineer devices that can reach production. These controls apply equally to card, ACH and real-time payment platforms.
Sources
Associated Press via PBS NewsHour — What to know about the $6.3B hack on Binance, likely the biggest-ever crypto theft (October 31, 2026)
CNBC — Binance hack: Investigators in a ‘cat and mouse game’ to recover $6.3 billion in stolen funds (October 30, 2026)
TechCrunch — Binance resumes withdrawals following $6.3 billion breach (November 1, 2026)
TRM Labs — North Korea steals USD 6.36 billion from Binance in the largest hack in history (on-chain analysis, October 30, 2026)