Binance lost about $6.3 billion on the evening of October 29. Most of the asset left in around 20 minutes, across ten blockchains and it was recorded as the biggest crypto theft so far, about four times the Bybit hack in February 2025.
Binance's first statement said it was looking into a "potential security issue" and that user funds were safe. Founder Changpeng Zhao posted that it did look like a hack. Later that night Binance put the damage at around $6.3 billion and paused withdrawals while Bitcoin fell 3.2% to under $79,000.
The attack didn't start on that day as Binance's own report says it started in June. An engineer on the wallet team searched for an AI coding tool and installed a tampered version of Homebrew. Binance caught it and replaced the laptop. But the attacker had already seen who worked on the wallets.
In September, another engineer got a message on a job site. First a video interview with a fake HR person. Then a second one with someone playing the CEO of a made-up company. At the end, he was told to download a coding test. It had malware inside, and Binance's security tools missed it.
On October 20, the attacker used that laptop and an internal Binance AI tool to take over two more wallet engineers. On October 29 they used stolen credentials, deployed a container and launched the attack.
The Ethereum part was very clever as the attacker used EIP-7702 to make a Binance hot wallet obey their own smart contract. Every wallet keeps a count of its transactions, and a signed authorization only works at the exact count the wallet is on. Binance's wallet is busy all day, so that count keeps going which enabled them to sign 50 authorizations ahead of time, one for each of 50 counts in a row, and sent them together. One had to match and one did. About three minutes later, 167,464 ETH and 63 tokens were left in one transaction.
Pausing withdrawals did not stop the damage. The attacker's permission was already on the blockchain, outside Binance's own systems. The wallet uses multi-party computation, so there was no single key to swap out. Funds were still being taken until 23:56 UTC, and the attacker's code was only corrected at 00:10 UTC. That's why AFP called it a four-hour attack.
It wasn't only Ethereum as wallets on XRP, Bitcoin, Tron, Solana and others sent funds through normal signed transfers in the same half hour. TRM thinks the attacker got Binance's own signing system to sign whatever they wanted.
While Tether and Circle were freezing stablecoins, the attacker dumped them fast. About 325 million USDT was sold for roughly 122,300 ETH, more than 10% below market price. They took the loss to get out.
TRM and Chainalysis blamed TraderTraitor, North Korea's hacking unit. The FBI confirmed it on October 31 and said it's the same group behind Bybit. North Korea denies it. Kim Yo Jong called the claim "absurd rhetoric."
Binance says its findings are early. An outside review is coming, and some details are being held back. How the attacker got its signing system to sign across ten chains is still not clear.