Overview
- On Oct. 29, 2026 attackers emptied Binance hot wallets in a roughly 20‑ to 30‑minute operation that moved about $6.3–6.43 billion across more than ten blockchains.
- The thieves exploited EIP‑7702, an on‑chain delegation feature, paying about $15 in fees to authorize software that transferred roughly $2.5 billion in a single bundled transaction from the compromised Binance 14 wallet.
- The FBI has publicly attributed the operation to a North Korea‑linked unit called TraderTraitor and industry firms report the intruders had covert access to Binance systems for weeks before the theft.
- Stablecoin issuers and partners froze about $2.85–3.0 billion, Binance says it revoked the affected delegation, rebuilt wallet infrastructure and absorbed the financial hit while restoring services for users.
- Blockchain analysts say roughly $3.11 billion still sits in attacker‑linked addresses, laundering has been highly automated across 20,000+ wallets on 16 chains, and investigators expect gradual swaps to BTC and OTC cash‑outs over coming months; claims of CCP involvement remain unverified.