On 29 October, Binance paused customer withdrawals after attackers broke into its wallet infrastructure. The pause closed the route customers normally use to take money off the exchange. But the attackers had already given their own code permission to move assets from one of Binance’s Ethereum wallets. That permission was recorded on Ethereum. Binance needed a separate transaction on the blockchain to revoke it.
At 23:56 UTC, a transfer of 2,961.9 ETH that had already been broadcast became final. At 00:10 UTC, Binance cleared the malicious permission. The exchange estimates that $6.34 billion in assets were affected across several networks. Its account of how the attackers got in is preliminary.
For any bank or fintech using a crypto custodian, the incident raises a practical question. If the provider has to shut down its systems, who can revoke a permission that is already live on-chain?
How the attackers reached the signer
A hot wallet holds assets an exchange needs to move quickly. When a customer withdraws crypto, the exchange can pay from a hot wallet without first bringing funds out of cold storage. The trade-off is that a service with signing authority has to be available during normal operations. Whoever can get that service to approve a transaction can move real assets.
Binance’s preliminary investigation describes a campaign that included fake recruitment interviews and malicious downloads. The attackers compromised an engineer’s computer and used an internal AI tool as part of the route to other engineering systems. They obtained a credential with permission to deploy a container, then used it to run malicious code and reach wallet signing operations. The internal AI tool matters because of the access it helped connect. The report is preliminary, and Binance says it is bringing in independent security firms to review its findings.
Bitquery traced outflows from 17 hot wallets on nine chains. Binance says five wallets sent 233.46 million XRP to an attacker-controlled address in four minutes. One Bitcoin wallet sent 18,270 BTC. Several wallets appear to have made ordinary signed transfers. Ethereum is where the attackers used the signer to change what the wallet itself could do.
The FBI attributed the theft to North Korea. Chainalysis identified the group as TraderTraitor and found that some Binance proceeds mixed with funds from the September 2026 Bitget theft. That overlap is evidence for the attribution. It leaves open who may handle the funds at later stages of laundering.
The FBI attributed the $1.5 billion Bybit theft in February 2025 to the same North Korean activity. It documented a familiar pattern there too: some of the stolen assets were converted to Bitcoin and dispersed across thousands of addresses.
Why pausing withdrawals could only do so much
Ethereum’s EIP-7702 lets a regular account delegate execution to smart contract code. In a consumer wallet, that can make a series of actions possible in a single transaction. In this case, the compromised service signed an authorisation that let an attacker-controlled contract act through a Binance hot wallet. Once the delegation was recorded on Ethereum, the attacker could use it independently of the exchange’s withdrawal infrastructure.