Binance’s Multibillion-Dollar Crypto Theft Exposes Critical Weakness in Wallet Security
A preliminary investigation into the reported multibillion-dollar theft from cryptocurrency exchange Binance has revealed how attackers allegedly exploited Ethereum’s account delegation mechanism to gain control of a major hot wallet, with an initial blockchain transaction costing approximately $15. The incident highlights growing concerns about the security of digital asset infrastructure, particularly the systems responsible for authorising transactions.
The attack, which reportedly began on 29 October 2026, involved the withdrawal of billions of dollars in cryptocurrency following an unauthorised change to the wallet’s execution permissions.
According to blockchain security company Blockaid, the attackers used Ethereum Improvement Proposal 7702 (EIP-7702) to delegate control of a Binance wallet to an external smart contract.
The initial transaction cost approximately $15 in network fees, an unusually small amount compared with the value of assets subsequently withdrawn.
However, that figure represents only the cost of establishing the delegation. It does not account for the later transactions used to remove the cryptocurrency.
The distinction is central to understanding the incident, which investigators believe may have originated through compromised internal infrastructure rather than a failure of Ethereum’s underlying cryptography.
Binance published a preliminary account on 30 October, while independent blockchain analytics firms have offered differing estimates of the financial impact.
As of 9 November 2026, a completed technical investigation and independently audited assessment of the losses had not been made publicly available.
How the Attackers Gained Control
The reported attack centred on EIP-7702, an Ethereum feature that allows externally owned accounts to delegate transaction execution to smart-contract code.
The mechanism provides additional flexibility for cryptocurrency wallets, enabling functions normally associated with programmable smart contracts.
However, an unauthorised delegation can have serious consequences if an attacker gains the ability to approve or submit transactions on behalf of a wallet.
According to Blockaid’s preliminary findings, reported by ForkLog, the attackers submitted a transaction containing 50 authorisations targeting a wallet identified as Binance 14 at approximately 20:20 UTC on 29 October.
One authorisation reportedly matched the wallet’s required sequence number, allowing control to be delegated to an unverified smart contract capable of moving assets.
The delegation itself did not immediately transfer cryptocurrency.
Instead, it established the permissions subsequently used to initiate withdrawals.
Approximately three minutes and 24 seconds later, at around 20:24 UTC, the delegated contract was reportedly activated.
Blockaid estimated that the resulting transactions removed approximately 167,464 ETH, 1.615 billion USDT and around 60 additional cryptocurrencies.
The combined value of those assets was estimated at approximately $2.5 billion.
Although the delegation transaction cost only about $15, the subsequent withdrawals were separate operations.
The findings illustrate how a relatively inexpensive blockchain transaction can create significant exposure when an attacker has obtained the authority needed to alter a wallet’s execution permissions.
Investigators Examine Possible Infrastructure Compromise
Binance’s preliminary investigation suggested that the attack may have originated through a compromised laptop belonging to a DevOps engineer.
According to the exchange, the initial compromise could have enabled unauthorised access to a service container within its infrastructure, potentially allowing attackers to submit fraudulent withdrawal transactions.
Binance stated that it had found no evidence indicating that a wallet private key had been leaked.
That assessment remains preliminary and has not been independently verified.
CoinDesk reported that Binance co-chief executive Richard Teng attributed the compromise to attackers exploiting EIP-7702 to gain control of a hot wallet without following the exchange’s usual approval procedures.
Teng also said the attackers employed a self-destruct mechanism intended to eliminate evidence of their activities.
Investigators reportedly identified additional potential entry points, although the complete sequence of events had not been established.
The available findings suggest that the primary security failure may have involved transaction-authorisation systems or internal operational infrastructure.
They do not establish that Ethereum’s cryptographic protections were broken.
Nor does the reported use of EIP-7702, by itself, demonstrate a vulnerability in the Ethereum protocol.
Instead, the incident raises questions about how exchanges protect the infrastructure capable of signing transactions, managing permissions and controlling large cryptocurrency reserves.
Conflicting Estimates of the Financial Impact
Determining the full scale of the reported theft has been complicated by differing estimates from Binance and blockchain analytics companies.
Blockaid’s initial assessment placed the withdrawal from the Binance 14 wallet at approximately $2.5 billion.
However, subsequent reporting suggested that the overall incident may have involved significantly larger amounts.
ForkLog reported that blockchain analytics firm Elliptic identified approximately $3.6 billion moving through the delegation mechanism, including the initial withdrawal and an additional $823 million associated with another Binance wallet.
Binance’s preliminary estimate placed the total financial impact at approximately $6.3 billion.
Separately, Yahoo Finance reported that Chainalysis estimated the amount stolen at approximately $5.912 billion when the assets were taken.
These figures are not directly interchangeable.
Some estimates concern individual wallet withdrawals, while others account for broader asset movements or the exchange’s overall financial exposure.
Differences in valuation timing, affected wallets and transaction coverage may also contribute to the discrepancies.
According to Binance’s preliminary findings, as reported by ForkLog, the final unauthorised transfer occurred at approximately 23:56 UTC on 29 October.
The malicious delegation was reportedly removed at 00:10 UTC on 30 October.
That extended activity provides further context for why the total value associated with the incident may exceed the amount identified in the initial withdrawal.
Until Binance publishes a comprehensive technical report and independently verified financial figures, the ultimate loss remains uncertain.
Billions in Cryptocurrency Frozen
Efforts to contain the financial impact reportedly began shortly after the unauthorised transactions were identified.
In its preliminary announcement, Binance said approximately $3 billion in cryptocurrency had been frozen on-chain.
Additional reporting indicated that major stablecoin issuers had taken action to restrict the movement of assets potentially connected to the incident.
Yahoo Finance reported that Tether’s chief executive confirmed the freezing of approximately $1.6 billion associated with a potential attack on Binance.
Circle’s chief executive also reportedly confirmed that more than $800 million in USDC had been frozen.
However, the available announcements do not establish whether those amounts are entirely separate or overlap with Binance’s broader estimate of frozen assets.
There is also an important distinction between freezing cryptocurrency and recovering stolen funds.
A freeze can prevent assets from being transferred or redeemed through certain mechanisms, but it does not necessarily return those assets to their original owner.
The legal, technical and financial processes involved in recovering the frozen cryptocurrency remain unresolved.
As a result, the announced freezes cannot yet be treated as confirmed recoveries or deducted directly from the reported losses.
Binance Pledges to Cover Losses
Binance has sought to reassure customers that their assets remain protected despite the scale of the reported incident.
The company said it would cover losses using its Secure Asset Fund for Users (SAFU) alongside its own corporate funds.
According to CoinDesk, Teng said Binance had allocated more than $6.34 billion to address the incident, including approximately $5 billion already held in the affected cryptocurrencies.
The exchange also announced plans to resume withdrawals after temporarily restricting activity.
Teng reportedly indicated that withdrawals could restart by Sunday, approximately 40 hours after the disruption.
However, the material available at the 9 November reporting cutoff did not independently confirm whether that timetable had been achieved.
Binance also updated its public communications to clarify that deposits remained operational throughout the incident, following earlier reports suggesting that both deposits and withdrawals had been suspended.
The exchange maintained that customer funds were safe and that any losses would be covered.
Nevertheless, questions remain about the distinction between corporate assets and cryptocurrency held to support customer balances.
Teng stated that the compromised wallet contained Binance’s own assets rather than customer funds.
A separate CoinDesk analysis of previously published reserve information, however, indicated that some affected wallets had appeared on lists of assets associated with backing customer balances.
That finding does not independently establish that customer assets were lost or that the exchange lacked sufficient reserves.
It does highlight the need for updated, independently verifiable information about the composition and adequacy of Binance’s holdings following the incident.
At the reporting cutoff, an updated proof-of-reserves assessment had not been available in the reviewed material.
Consequently, the company’s assurances concerning customer protection remain statements that require confirmation through further financial disclosure.
Questions Surrounding the Attackers’ Identity
The identity of those responsible has also become a subject of investigation and competing claims.
ForkLog reported that the United States Federal Bureau of Investigation attributed the attack to TraderTraitor, a North Korean-linked hacking operation associated with the Lazarus group.
North Korean authorities reportedly denied the allegation.
However, no primary FBI statement, court filing or formal government advisory supporting that attribution was available in the reviewed reporting.
Separately, Blockaid co-founder Ido Ben-Natan told Cointelegraph that aspects of the operation resembled techniques previously associated with North Korean-linked attackers.
That assessment reportedly reflected the sophistication and preparation visible in the blockchain transactions.
Such similarities may inform an investigation, but they do not independently establish responsibility.
The available evidence therefore does not support treating attribution to a particular government or hacking group as conclusively established.
A Critical Test for Cryptocurrency Security
Beyond the immediate financial consequences, the incident raises broader questions about the security architecture used by major cryptocurrency exchanges.
Hot wallets are designed to remain connected to operational systems, allowing exchanges to process transactions and manage liquidity.
That accessibility also makes the systems responsible for authorising transactions especially sensitive.
The reported Binance attack illustrates how control over wallet permissions can become a significant security risk even when the underlying cryptographic mechanisms remain intact.
If an attacker can compromise the infrastructure responsible for approving transactions, conventional protections against unauthorised access may be circumvented without directly stealing a private key.
In response, Binance outlined measures intended to strengthen its internal security arrangements.
These reportedly include reviews of employee devices, cloud infrastructure, key-management procedures and transaction-signing systems.
The company also described plans to improve monitoring and introduce mechanisms capable of rapidly revoking suspicious authorisations.
Such controls are particularly relevant to EIP-7702 transactions, where delegated execution permissions can provide access to valuable assets.
The effectiveness of those measures will depend on how they are implemented, monitored and independently assessed.
The Questions Still Unanswered
Despite the preliminary investigation and reported remediation efforts, several important aspects of the incident remain unresolved.
Binance has not publicly released a completed technical post-mortem establishing the full sequence of events or precisely how the attackers gained access to its internal systems.
A final audited loss figure has not been published, and the amount of cryptocurrency that can ultimately be recovered remains uncertain.
The status of frozen assets, the sufficiency of reserves supporting customer balances and the long-term financial consequences also require further clarification.
Similarly, while the company announced plans to restore withdrawal services, the reviewed reports did not independently verify the completion of that process.
The incident has consequently become a significant test of Binance’s operational resilience, financial transparency and ability to demonstrate that customer assets remain adequately protected.
It also offers a broader lesson for the cryptocurrency industry.
The approximately $15 transaction fee that attracted attention was not the cost of stealing billions of dollars in assets. It was the reported network cost of establishing a delegation that enabled subsequent withdrawals.
The more consequential issue is how that authorisation became possible and whether the systems designed to protect the wallet were sufficiently isolated from compromised operational infrastructure.
As cryptocurrency platforms adopt more sophisticated account functionality, protecting the authority to initiate and approve transactions will remain fundamental to securing customer and corporate assets.
For Binance, the immediate priority is establishing a verified account of the attack, the final financial exposure and the effectiveness of its recovery efforts.
For the wider industry, the reported breach illustrates a critical security principle: the strength of cryptography offers limited protection when the infrastructure authorised to use it has been compromised.
An account that can hand its execution to someone else’s code is a design choice rather than a bug, and the Binance case shows how much can rest on who is allowed to make that choice. Read alongside the article, the useful question is not how cheap the delegation was but what it granted, who could grant it and what evidence would show the grant was misused. Cybersecurity fundamentals covers that ground, from identity and access decisions to the defensive responsibilities that sit around a signing service, which is where a clearer reading of preliminary reports begins. To build that understanding, explore The Hack Academy’s online cybersecurity training programme, where cybersecurity fundamentals is one of the listed subject areas, with self-paced learning and practical exercises alongside the theory, all in authorised, controlled environments.