The $6.3 billion Binance hack paradox: Centralization made the hack possible, but also saved $3 billion

On 29 October 2026 Binance suffered a coordinated cyber‑attack that drained roughly $6.3 billion from its hot wallet “Binance 14” across ten blockchains in about twenty minutes. The breach was traced to a compromised DevOps engineer’s laptop that gave attackers access to an internal withdrawal‑signing service. Using the newly‑added EIP‑7702 feature on Ethereum, the hackers turned the wallet into a sweeper that emptied it three times as Binance’s systems automatically refilled it. Stablecoin issuers Tether and Circle froze about $3 billion of the stolen assets, while roughly $2.4 billion in Bitcoin and Ether escaped.

Background

Binance, the world’s largest cryptocurrency exchange, stores large sums of user funds in hot wallets to facilitate rapid deposits and withdrawals. Such wallets are protected by internal services that generate withdrawal signatures without exposing private keys. In 2025 Ethereum introduced EIP‑7702, a mechanism that can designate a contract as a “sweeper” with exclusive execution rights. Stablecoins like USDT and USDC are issued by centralized entities that retain the ability to blacklist addresses and freeze tokens. Past exchange failures, such as Mt. Gox in 2014 and FTX in 2022, have underscored the risks of custodial models and fueled the “not your keys, not your coins” mantra. The Binance incident occurred after a two‑day preparation phase in which the attackers funded a wallet, rehearsed the sweeper contract on testnets, and waited before striking. The hack highlighted both the vulnerabilities inherent in centralized exchange infrastructure and the protective role that centralized stablecoin issuers can play when administrative controls are available.

What happened

According to cryptotimes.io, on 29 October 2026 an Ethereum transaction moved 167,464 ETH and 63 other tokens, including 1.615 billion USDT, out of Binance’s hot wallet “Binance 14”. Etherscan initially valued the receiving address at about $2.38 billion, but on‑chain investigators later traced matching outflows on Bitcoin, Tron, XRP Ledger, Solana, Avalanche, Arbitrum, Optimism, Base and Polygon, raising the estimate to $6.3 billion (TRM Labs reported $6.36 billion). Binance’s preliminary investigation identified a compromised DevOps engineer’s laptop that accessed a service container capable of submitting withdrawal requests and producing valid signatures without leaking private keys. On Ethereum the attacker employed EIP‑7702 to convert Binance 14 into a sweeper that could be operated only by the attacker, allowing the wallet to be emptied three times as Binance’s internal systems refilled it. Stablecoin issuers Tether and Circle used their administrative freeze functions to lock roughly $3 billion of the stolen stablecoins, while Bitcoin and Ether, lacking such controls, saw about $2.4 billion leave the exchange. Binance suspended all deposits and withdrawals at 22:15 UTC, pledged to cover all customer losses from its SAFU fund and company reserves – a sum Binance later said exceeded $6.34 billion – and set aside more than $2.3 billion of its own money for the purpose. TRM Labs attributed the attack with high confidence to North Korea’s TraderTraitor unit, though Binance has not named a perpetrator. The FBI and US Secret Service are reported to be working with Binance to trace the stolen funds.

Market impact

The hack triggered an immediate sell‑off in major cryptocurrencies, with prices falling overnight as reported by cryptotimes.io. The $6.3 billion loss represented a massive on‑chain outflow across ten blockchains, causing heightened volatility. Stablecoin issuers’ freeze actions immobilised about $3 billion, limiting further market disruption from those tokens. Bitcoin and Ether, which together accounted for roughly $2.4 billion of the stolen assets, continued to move on‑chain, prompting tracking by investigators but no direct price stabilization. Binance’s suspension of deposits and withdrawals lasted roughly 45 hours, delaying normal market activity on its platform. The incident also spurred discussions on the trade‑off between centralized controls that can freeze assets and the decentralized ethos of immutable transactions.

Why it matters

The Binance breach underscores a core paradox in crypto security: centralized exchange infrastructure creates a single point of failure that can be exploited, yet the same centralization enables rapid response mechanisms such as stablecoin freezes that can contain losses. The use of EIP‑7702 demonstrates how new protocol features can be weaponised when combined with internal access, highlighting the need for rigorous internal security beyond cryptographic safeguards. The freeze of $3 billion by Tether and Circle shows that administrative controls can act as a safety valve, but also raises concerns about the extent of issuer power over supposedly decentralized assets. The incident revives the debate over self‑custody versus custodial services, reminding users that “not your keys, not your coins” remains a critical risk mitigation strategy. Finally, the attribution to a state‑linked hacking unit, if confirmed, signals that nation‑state actors are increasingly targeting centralized crypto infrastructure, raising geopolitical stakes for the broader digital asset ecosystem.