How Did the Binance Hack Happen? Detailed Investigation of the $6 Billion Heist

On October 29, 2026, an attacker drained about $6.15 billion from Binance in 31 minutes, one of the largest thefts in crypto history, or rather, internet history.

Binance first put losses at $6.3 billion; blockchain analytics firm BitOK’s transaction-by-transaction tracing puts them at $6.15 billion across nine blockchains.

The attacker never stole Binance’s private keys. Instead, they made Binance’s own systems approve the theft. This guide follows the heist in order and explains each technical term along the way. All times are UTC.

The Basics: How an Exchange Moves Money

Hot wallets are an exchange’s online wallets, kept connected so withdrawals go out quickly.

Signing. Every transfer must be approved with a wallet’s private key, a secret number. Exchanges use automated systems to sign thousands of payouts a day.

Nonces are an Ethereum wallet’s transaction counter. A busy wallet’s nonce rises constantly.

Freezable coins. Stablecoin issuers such as Tether (USDT) and Circle (USDC) can freeze addresses. Nobody can freeze native coins like BTC, ETH or TRX.

October 28: Preparation Before the Hack

Every blockchain transaction costs a small fee. To fund their wallets without leaving a trail, the attacker used Tornado Cash, a “mixer” that pools many users’ coins so withdrawals cannot be linked to deposits.

Six Tornado Cash withdrawals funded the operator’s wallet and two helpers.

October 29, 02:28–16:47 UTC: Two Rehearsals

Before touching Binance, the attacker practised on their own wallets, the way a burglar might test a lock-pick on their own front door first.

The tool was a smart contract: a program that sits on Ethereum and does exactly what its code says. This one was built to empty any wallet that gives it permission to act on the wallet’s behalf. (Ethereum’s EIP-7702 feature allows that kind of permission; more on it below.)

• 02:28 — the attacker publishes a test version of the draining program.
• 13:51–14:24 — first rehearsal. They put small amounts of USDT and USDC into two of their own wallets, give the test program permission over them, and trigger it. Both wallets are emptied. The tool works.
• 15:59 — they publish the final version, the one later used on Binance.
• 16:20–16:47 — second rehearsal, repeating the test with the final version.

The final version had one extra power: it could make a wallet do anything, not just send tokens. That night, this let it order a Binance wallet to release 823 million USDC. A tool this tailored suggests the attacker already knew how Binance’s wallets were set up.

“The difference between the two versions was critical. The main contract included a function that could execute arbitrary calls on behalf of a wallet that had delegated control to it. The attacker later used that function to drain 823 million USDC from a Binance smart wallet,” BitOK explained.

October 29, 20:04 UTC: The 31-Minute Drain

From 20:04:52 to 20:35:53, the attacker emptied Binance hot wallets on XRP Ledger, Solana, Bitcoin, Ethereum, Tron, Base, Optimism, Arbitrum and Avalanche. The haul included:

• 18,270.2 BTC,
• 197,540 ETH,
• 2.49 billion USDT,
• 823 million USDC,
• 233.46 million XRP,
• 970,522 SOL and dozens of other tokens.

Every transfer was signed by Binance’s own wallets. BitOK spotted them by their habits: fees 2 to 2.7 times higher than normal, transaction formats Binance’s payout software does not use, and, on Ethereum, fake transfers slotted between real customer payouts.

The attacker breached a DevOps engineer’s laptop, then used a service container (a packaged program running inside Binance’s systems) to submit fake withdrawal orders.

20:20 UTC: The 50-key Trick

This was the cleverest move of the night. The target was a busy Ethereum hot wallet called Binance 14.

The plan. Using EIP-7702, a wallet can sign a permission slip, called an authorization, that lets a smart contract act on its behalf. If Binance 14 signed one naming the attacker’s contract, the attacker would control the wallet.

The problem. A slip only works if it carries the wallet’s current transaction number, its nonce. Binance 14 was paying customers non-stop, so that number kept changing. A slip with the wrong number is simply ignored.

The trick. At 20:20:59, the attacker had Binance’s signing system sign 50 slips at once, each with a different number. Think of it as trying 50 keys on a lock at the same moment: only one needs to fit. One did. Binance 14 now took orders from the attacker’s contract, yet kept working normally, so money kept flowing in.

The payoff. Minutes later, a single transaction emptied 65 different tokens worth more than $2.2 billion, including 1.615 billion USDT and 167,464 ETH. At 20:41 and 20:59, the contract also made another Binance wallet send out 823 million USDC.

Binance 16. A second hot wallet was robbed more simply. Binance’s system was fed nine fake transfers, which it signed and sent out alongside real customer payouts. They carried 28,005.6 ETH and 55.7 million USDT.

20:30–21:14 UTC: The Race to Unfreezable Coins

On Ethereum, 500 million USDT left the main receiving address within six minutes. Between 20:34 and 21:09, the attacker swapped 435 million USDT into ETH on Uniswap, a decentralized exchange run by code. They also deposited 60 million USDT into Aave, a lending protocol, and borrowed 19,762 ETH against it, leaving the freezable collateral behind.

On Tron, 612.7 million USDT left the Binance-Hot 7 wallet. In 16 swaps on SunSwap, Tron’s main decentralized exchange, the attacker turned 234 million USDT into 638.2 million TRX.

The Freeze Race

To freeze USDT, Tether needed three approvals from its multisignature wallet, a setup that requires several sign-offs. Each freeze took up to 2 minutes 36 seconds, and pending requests were visible on-chain. The attacker could see a freeze coming and move first: one wallet shifted 130 million USDT just 48 seconds before its freeze. But at one address the attacker hesitated and lost nearly 175 million USDT.

All 823 million USDC still sat at one address and was frozen in a single transaction.

Other issuers froze USD1, XAUt, PAXG, wBETH and FDUSD, and BEAM’s issuer burned 984 million stolen tokens. Arbitrum’s Security Council, a 12-member emergency body, seized 8,426 ETH and 74.56 million ARB.

In total, about $2.79 billion was frozen, burned or seized. Still, 669 million USDT had already become ETH and TRX.

21:43–00:10 UTC: The Wallet That Kept Getting Robbed

Binance 14 was still under the attacker’s control.

• 21:43:59 — a routine Binance top-up sends 200 million USDT to Binance 14. Twelve seconds later, the contract sweeps it. The USDT lands at an already frozen address, but nearly 370 ETH gets away.
• 22:39 — another sweep takes 128.49 ETH.
• 23:56 — 2,961.91 ETH is swept a minute after arriving.
• 00:10:35, October 30 — Binance finally cancels the handover.

The attacker held the wallet for nearly four hours.

Where the 18,270 BTC Went

At 20:20:06, 11 transactions moved 18,270.2 BTC from a Binance hot wallet, paying double the usual fee. The coins were split across 19 addresses, 17 of them holding 1,000 BTC each. As of October 30, none had moved. Bitcoin’s public ledger keeps them traceable, but no one can freeze them.

October 30, 04:02: The Bitget Connection

BitOK’s biggest finding: stolen Binance funds reached the same Ethereum address that was already collecting proceeds from the September 2026 Bitget hack.

The attacker moved TRX and USDT through THORChain, a protocol that swaps coins across blockchains, and received ETH at 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7.

That address had already received ETH traced to the Bitget hack. It came from Bitcoin addresses on Bitget’s published list of attacker wallets, active since October 23, and started out as ZEC, a coin never stolen from Binance.

By 06:20, it had taken eight Bitget-linked payouts (349.46 ETH) and five Binance-linked ones (13.63 ETH), then sent the mixed funds on to new wallets. A shared address alone does not identify who is behind either hack.

Was it North Korea?

Both attacks involved breaking into internal systems without stealing private keys, and Bitget blamed North Korea for its hack. BitOK also notes traits it links to North Korean groups: rehearsals, Tornado Cash funding, instant swaps out of freezable tokens and preparation during UTC+9 working hours.

“The newly identified shared laundering address is stronger evidence of operational overlap than similarities in tactics alone. BitOK assesses that the two thefts may be linked to the same North Korean group and that one operator controlled the observed laundering flows. That remains an analytical attribution, not proof of the real-world identity of every participant,” BitOK said.

Binance’s Response

Binance paused withdrawals from its Bitcoin and Tron hot wallets around 20:36, while deposits continued. It pledged to cover all customer losses from its SAFU emergency fund and its own resources.

Across the market, $1.58 billion in leveraged positions were liquidated in 24 hours, according to Coinglass.

What Are Attackers Holding Now?

As of 06:20 on October 30, BitOK linked the attacker to:

• 197,460 ETH,
• 18,270.2 BTC,
• 233.46 million XRP,
• about 970,500 SOL,
• 675.9 million TRX,
• and 1.61 million AVAX.

The ETH, BTC, XRP, and SOL alone were worth about $2.95 billion.

The attackers hijacked the system that signs Binance’s withdrawals. BitOK shared lessons to learn from the Binance hack for the crypto industry.

“The Binance incident shows why the security of private keys alone is insufficient. Exchanges also need controls over signing authority, safeguards against suspicious withdrawal instructions, prompt revocation of compromised permissions and continuous monitoring of asset movements across networks.”

The post How Did the Binance Hack Happen? Detailed Investigation of the $6 Billion Heist appeared first on BeInCrypto.