Binance hot wallet hacked for approximately $5.8 billion: a retrospective of the largest exchange theft in crypto history

[[**In the early hours of October 30, a Binance hot wallet was drained via a malicious EIP-7702 authorization, with cross-chain losses of approximately $5.5 billion to $6.2 billion, making it the largest exchange theft in crypto history and triggering a market crash and an industry-wide freeze.**

**Key Points**

**1. The attack was carried out through EIP-7702 authorizations, setting a record in scale**

At 4:20:59 on October 30, 50 EIP-7702 authorizations were submitted for "Binance 14"; 3 minutes and 24 seconds later, 167,464 ETH, 1.615 billion USDT and 63 tokens were swept, with cross-chain losses of $5.5 billion to $6.2 billion.

**2. Markets crashed, and stablecoin issuers moved to freeze funds**

Bitcoin fell below $78,500, Ethereum lost $2,250, BNB dropped as much as 9%, and $629 million was liquidated in one hour; Tether, Circle and others froze assets, and Binance verified $3 billion in frozen funds.

**3. The problem lay in the signing process, not a contract vulnerability**

Shenyu's review said there was no on-chain contract vulnerability; the private key remained in Binance's hands, but the malicious authorization had not been revoked. The hacker may not have directly stolen a plaintext private key, but instead induced the signing of a Type-4 transaction during signing or in the operations pipeline.

**4. The incident is suspected to point to North Korean hackers, and AI is worsening the offense-defense imbalance**

Blockaid said the methods were "very similar" to the Bybit theft and highly consistent with North Korean hacker characteristics; in 2026, more than 230 protocols were attacked, and in the first half of the year North Korea-linked hackers stole $643 million, accounting for 66%. 2026-10-30 10:27 A night of shock in crypto: Binance stolen from for $5.8 billion, a review of the largest hack in crypto history TechFlow quick read

This article is from the WeChat public account: TechFlow, author: Worth Following, original title: "A night of shock in crypto: Binance stolen from for $5.8 billion, a review of the largest hack in crypto history"

At 4:20:59 a.m. Beijing time on October 30, a seemingly ordinary Ethereum transaction was confirmed on-chain. The transaction submitted 50 EIP-7702 authorizations to the hot wallet labeled by Binance as "Binance 14." Three minutes and 24 seconds later, the 167,464 ETH, 1.615 billion USDT, and 63 tokens including UNI, LINK, AAVE and PEPE in that wallet were all swept away in a single transaction.

This is the largest exchange theft by amount in cryptocurrency history. On-chain data shows that outflows on Ethereum alone exceeded $3.3 billion, while cross-chain figures reached $5.5 billion to $6.2 billion. By comparison, the $1.5 billion theft from Bybit's cold wallet in February 2025 had already been the industry record.

Panic spread to the secondary market within minutes.

Bitcoin quickly fell below $78,500, Ethereum lost $2,250, BNB plunged as much as 9% intraday, and the network-wide contract market saw $629 million in liquidations within an hour, of which $607 million were long positions.

Binance then urgently suspended withdrawals across multiple networks and Binance Alpha trading, repeatedly stating that user funds were completely safe. Binance founder Changpeng Zhao (CZ) said bluntly on X that it "does look like we got hacked," while citing DefiLlama founder 0xngmi's estimate that the actual net loss "may be slightly higher than $1 billion, but will be fully covered."

This was not just Binance's fight; the entire crypto industry sprang into action.

About 40 minutes after the incident, Tether froze more than 1.567 billion USDT, Circle froze more than $800 million USDC, Ripple froze about $200 million RLUSD, World Liberty Financial froze $27 million USD1, and Paxos froze about 1,906 PAXG.

Binance's latest official announcement put the total verified frozen amount at $3 billion and said the figure may continue to rise.

Lying low for 48 hours and one deadly authorization slip

This was not a raid decided on the spur of the moment.

Cobo co-founder and crypto OG Shenyu released an on-chain review video several hours after the incident. Tracing the on-chain traces backward, the attacker's preparations had begun at least two days before the incident.

Starting on the afternoon of October 28, the attacker withdrew small amounts from the mixing protocol Tornado Cash in three batches to serve as fees for subsequent contract deployment and rehearsals. From the evening of October 29 to the early hours of October 30, the attacker used a test wallet to rehearse the entire attack process twice in full. When the final test wrapped up, only three and a half hours remained before the real operation at 4:20.

The weapon that actually delivered the fatal blow was a new feature Ethereum had just introduced in last year's Pectra upgrade: EIP-7702.

In the traditional Ethereum architecture, ordinary externally owned accounts (EOAs, i.e., wallets normally controlled by private keys) and smart contract accounts are two clearly separate systems. EIP-7702 broke down that wall, allowing an ordinary wallet to temporarily delegate control of its account to a piece of smart contract code by signing a special authorization. As long as it is not actively revoked, this program can act on behalf of the wallet owner to execute batch transfers and any other operations.

In his review, Shenyu dissected the logic of the attack contract: "The attacker's program recognizes only one master and does only one thing: move money."

The transaction at 4:20:59 a.m. that matched the sequence number was what made the "Binance 14" hot wallet sign this contract of servitude. Once it took effect, the hackers did not even need to use Binance's private key each time; they could simply call the contract to drain all 64 types of tokens from the wallet.

By 4:41, an even more alarming scene unfolded. The attacker, using the legitimate identity of the "Binance 14" hot wallet to issue commands, directly directed a USDC contract wallet that obeyed that hot wallet and moved out 823 million USDC in one go. By 6:40 a.m., the attacker had returned to the "Binance 14" hot wallet four times to sweep up assets as if entering their own backyard, not even sparing the scattered funds transferred into that address. On-chain analyst Aunt Ai monitored that the hacker even casually sold off all 7.77 trillion PEPE in the hot wallet on-chain for ETH.

Why would the hot wallet of the world's most secure exchange sign 50 consecutive EIP-7702 malicious authorizations with its own private key?

"On-chain, the problem lies in the signing step; no contract vulnerability was seen," Shenyu gave a technical diagnosis in the video.

Even more peculiar, at 6:55 a.m., Binance's security team itself used the "Binance 14" private key to sign and transfer the remaining scattered tokens in the wallet back to its own secure wallet. More than two hours after the incident, Shenyu was still posting a warning on X: the key was clearly still in Binance's own hands, but that fatal EIP-7702 delegation authorization had still not been revoked, and at that time a deposit of about 2,961 ETH was stuck en route due to low gas fees, ready to be swept away again by the hacker's program as soon as it arrived.

This means the hacker most likely did not directly steal a plaintext private key file, but more likely tore open a gap in Binance's internal automatic signing system, permission verification, or operational command pipeline, inducing the signing machine to sign that Type-4 transaction it should never have signed.

Every Day Is Zero Day

Hours after the Binance incident, Musk posted on X, "Everyday is Zeroday," hinting that AI has pushed the crypto industry into an era where offense and defense are forever asymmetric.

Blockaid co-founder and CEO Ido Ben-Natan's assessment was more specific: this attack is "very similar" to the February 2025 Bybit theft of $1.46 billion, and the on-chain preparation methods closely match the known operational characteristics of North Korean hackers.

This is not unfounded.

Immunefi CEO Mitchell Amador has publicly warned multiple times this year that AI has completely tipped the balance of offense and defense toward attackers, and defenders will need at least three to four years to possibly close the gap.

In past security battles, zero-day vulnerabilities (fatal flaws not yet discovered and patched) were scarce munitions manually mined by a very small number of top hackers over months. But in 2026, with AI large-model computing power surging, the balance has completely overturned. AI can not only scan global open-source protocols and smart contract code 24/7 and mass-produce zero-day vulnerabilities, but also combine deepfake technology and automated penetration scripts to launch social engineering and supply chain attacks precise to the millisecond against exchange operations personnel and internal signing pipelines.

2026 is not yet over, and more than 230 crypto protocols across the network have already been attacked.

According to ValueTheMarkets statistics, in the first half of 2026 alone, North Korea-linked hacker groups stole $643 million in crypto assets, accounting for 66% of the global total stolen during the same period. From Bybit to Binance, the scale of attacks has multiplied several times in eight months.

The industry has already begun an arms race. According to DLNews, several leading exchanges and security companies are racing to obtain access to Anthropic's latest Claude Mythos model, trying to use the most cutting-edge AI to fortify their defenses. Cyvers CEO Deddy Lavid said the crypto industry is "the first market to truly feel the impact of AI."

Has published 71 articles on Huxiu. This content comes from the internet, original link; the views represent only the author and do not represent Huxiu's position. For copyright issues, please contact hezuo@huxiu.com, and we will verify and handle it promptly. Everyone who is changing and wants to change the world is on the Huxiu APP[ ]