The $6.15 Billion Binance Heist: How It Unfolded

In a 31-minute window on October 29, 2026, roughly $6.15 billion was taken from Binance — among the largest thefts in crypto history, if not internet history.

Binance initially put the loss at $6.3 billion. BitOK, a blockchain analytics firm, tracked the funds transaction by transaction and arrived at $6.15 billion across nine blockchains.

The exchange’s private keys were never stolen. Instead, Binance’s own systems were made to approve the withdrawals. The narrative below follows the heist chronologically and defines technical terms as they come up. All timestamps are UTC.

The Basics: How an Exchange Moves Money

An exchange keeps its online wallets, known as hot wallets, connected so that withdrawals can go out promptly.

Signing. Every transfer needs approval from a wallet’s private key, a secret number. Exchanges rely on automated systems to sign thousands of payouts every day.

Nonces are the transaction counter of an Ethereum wallet. On an active wallet, the nonce rises constantly.

Freezable coins. Stablecoin issuers, such as Tether (USDT) and Circle (USDC), are able to freeze addresses. Native coins like BTC, ETH or TRX cannot be frozen by anyone.

October 28: Preparation Before the Hack

Each blockchain transaction involves a small fee. To fund wallets without leaving a trail, the attacker used Tornado Cash, a mixer that pools many users’ coins and makes withdrawals impossible to tie back to deposits. Six Tornado Cash withdrawals financed the operator’s wallet and two helper wallets.

October 29, 02:28–16:47 UTC: Two Rehearsals

Before going anywhere near Binance, the attacker practised on their own wallets, much as a burglar might test a lock-pick on their own front door.

The instrument was a smart contract, a program on Ethereum whose actions are determined exactly by its code. This contract was built to drain any wallet that had given it permission to act on that wallet’s behalf. (Ethereum’s EIP-7702 feature permits such delegation; details come below.)

• 02:28 — a test version of the draining contract is published by the attacker.
• 13:51–14:24 — first rehearsal. Small amounts of USDT and USDC are moved into two attacker-owned wallets, the test contract is given permission over them, and it is triggered. Both wallets end up empty, proving the tool works.
• 15:59 — the final version, later used against Binance, is published.
• 16:20–16:47 — the exercise is repeated with the final version.

The final version had one additional power: it could instruct a wallet to do anything, not only transfer tokens. That night, the capability was used to order a Binance wallet to release 823 million USDC. A tool so precisely fitted suggests the attacker already understood how Binance’s wallets were wired.

“The difference between the two versions was critical. The main contract included a function that could execute arbitrary calls on behalf of a wallet that had delegated control to it. The attacker later used that function to drain 823 million USDC from a Binance smart wallet,” BitOK explained.

October 29, 20:04 UTC: The 31-Minute Drain

Between 20:04:52 and 20:35:53, hot wallets belonging to Binance on XRP Ledger, Solana, Bitcoin, Ethereum, Tron, Base, Optimism, Arbitrum and Avalanche were emptied. The stolen haul included:

• 18,270.2 BTC,
• 197,540 ETH,
• 2.49 billion USDT,
• 823 million USDC,
• 233.46 million XRP,
• 970,522 SOL and dozens of other tokens.

Each move carried the signature of Binance’s own wallets. BitOK recognised them by their habits: fees 2 to 2.7 times above the usual level, transaction formats that Binance’s payout software does not use, and, on Ethereum, counterfeit transfers inserted between genuine customer payouts.

The attacker got in through a DevOps engineer’s laptop, then submitted fraudulent withdrawal orders using a service container — a packaged program running inside Binance’s systems.

20:20 UTC: The 50-key Trick

The cleverest manoeuvre of the evening came at 20:20. Its target was a hard-working Ethereum hot wallet known as Binance 14.

The plan. Through EIP-7702, a wallet can sign an authorization — a permission slip that allows a smart contract to operate on its behalf. Had Binance 14 signed one naming the attacker’s contract, the wallet would have been under the attacker’s control.

The problem. The slip is only valid if it carries the wallet’s current transaction number, the nonce. Binance 14 was serving customers non-stop, so that number was always changing. A slip with an outdated number is simply ignored.

The trick. At 20:20:59, the attacker had Binance’s signing system produce 50 slips simultaneously, each with a different number. It was like trying 50 keys on a lock at once: a single fit is enough. One fit. Binance 14 then took orders from the attacker’s contract while continuing to work normally, so funds kept flowing in.

The payoff. Minutes later, one transaction drained 65 different tokens worth more than $2.2 billion, including 1.615 billion USDT and 167,464 ETH. At 20:41 and 20:59, the contract also directed a second Binance wallet to send out 823 million USDC.

Binance 16. Another hot wallet was robbed in a more straightforward way. Nine fake transfers were fed into Binance’s system, signed, and sent out together with real customer payouts. They moved 28,005.6 ETH and 55.7 million USDT.

20:30–21:14 UTC: The Race to Unfreezable Coins

On Ethereum, the main receiving address lost 500 million USDT in the space of six minutes. Between 20:34 and 21:09, the attacker exchanged 435 million USDT for ETH on Uniswap, a decentralized exchange governed by code. A further 60 million USDT went into Aave, a lending protocol, against which 19,762 ETH were borrowed — leaving the freezable collateral behind.

On Tron, 612.7 million USDT exited the Binance-Hot 7 wallet. In 16 trades on SunSwap, Tron’s main decentralized exchange, 234 million USDT were converted into 638.2 million TRX.

The Freeze Race

A USDT freeze by Tether requires three approvals from its multisignature wallet, meaning several signatures are needed. Each freeze could take as long as 2 minutes 36 seconds, and pending requests were visible on-chain. The attacker could see a freeze about to happen and act first: one wallet moved 130 million USDT just 48 seconds before its freeze. At one address, though, hesitation cost nearly 175 million USDT.

A single transaction froze the whole 823 million USDC while it still sat at one address.

The freeze tallies attributed to Tether and Circle:

• Ethereum USDT: $1.38 billion
• Ethereum USDC: $823 million
• Tron USDT: $378.7 million
• Avalanche USDt: $8.4 million
• Total: $2.59 billion

Other issuers placed freezes on USD1, XAUt, PAXG, wBETH and FDUSD, and BEAM’s issuer burned 984 million stolen tokens. The Security Council of Arbitrum, an emergency panel of 12 members, seized 8,426 ETH and 74.56 million ARB.

In all, around $2.79 billion was frozen, burned or seized. Even so, 669 million USDT had already been turned into ETH and TRX.

21:43–00:10 UTC: The Wallet That Kept Getting Robbed

The attacker continued to hold control over Binance 14.

• 21:43:59 — a routine top-up by Binance sends 200 million USDT to Binance 14. Twelve seconds later, the contract empties it. The USDT lands at an already frozen address, but nearly 370 ETH escapes.
• 22:39 — another sweep removes 128.49 ETH.
• 23:56 — 2,961.91 ETH is collected one minute after arriving.
• 00:10:35, October 30 — the handover is finally cancelled by Binance.

The wallet remained in the attacker’s hands for almost four hours.

Where the 18,270 BTC Went

The transfer of 18,270.2 BTC out of a Binance hot wallet was carried out in 11 transactions at 20:20:06, with the fee twice the normal amount. The coins were split across 19 addresses, 17 of them holding 1,000 BTC each. As of October 30, none had moved. Bitcoin’s public ledger keeps the coins traceable, but no one is able to freeze them.

October 30, 04:02: The Bitget Connection

BitOK’s most important finding was that Binance’s stolen funds reached the same Ethereum address that had already been collecting proceeds from the September 2026 Bitget hack.

TRX and USDT were moved by the attacker through THORChain, a cross-blockchain swapping protocol, with ETH arriving at 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7.

That address had already taken in ETH tied to the Bitget hack. The ETH came from Bitcoin addresses on Bitget’s published list of attacker wallets, in use since October 23, and originally started as ZEC, a coin never stolen from Binance.

By 06:20, it had received eight Bitget-linked payouts (349.46 ETH) and five Binance-linked payouts (13.63 ETH), then moved the combined funds on to new wallets. A shared address alone does not point to who was behind either hack.

Was it North Korea?

Both break-ins got into internal systems without taking private keys, and Bitget has blamed North Korea for its hack. BitOK also cites characteristics it connects with North Korean groups: rehearsals, Tornado Cash funding, immediate swaps out of freezable tokens and work carried out during UTC+9 business hours.

“The newly identified shared laundering address is stronger evidence of operational overlap than similarities in tactics alone. BitOK assesses that the two thefts may be linked to the same North Korean group and that one operator controlled the observed laundering flows. That remains an analytical attribution, not proof of the real-world identity of every participant,” BitOK said.

Binance’s Response

At about 20:36, Binance suspended withdrawals from its Bitcoin and Tron hot wallets, while deposits kept coming in. The company promised to cover all customer losses from its SAFU emergency fund and its own resources.

I want to speak to you directly about what happened.

Bottom line – your money is safe, and we're covering every loss.

Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a…

— Richard Teng (@_RichardTeng), October 30, 2026

In the wider market, Coinglass recorded $1.58 billion in leveraged-position liquidations over a 24-hour span.

What Are Attackers Holding Now?

As of 06:20 on October 30, BitOK connected the attacker with:

• 197,460 ETH,
• 18,270.2 BTC,
• 233.46 million XRP,
• about 970,500 SOL,
• 675.9 million TRX,
• and 1.61 million AVAX.

The ETH, BTC, XRP and SOL on their own were worth roughly $2.95 billion.

What the attackers effectively seized was the system that signs Binance’s withdrawals. BitOK drew lessons for the whole crypto industry from the Binance hack.

“The Binance incident shows why the security of private keys alone is insufficient. Exchanges also need controls over signing authority, safeguards against suspicious withdrawal instructions, prompt revocation of compromised permissions and continuous monitoring of asset movements across networks.”