Binance: Incident Report

On October 29th, an attacker emptied 21 Binance hot wallets on nine blockchains in under 31 minutes, then continued to steal funds for more than three hours, including from two more wallets. The theft totaled $6.36 billion at attack-time prices. Every transfer carried a valid signature from Binance's own keys. Binance first pointed to a compromised DevOps engineer's laptop that gave the attacker access to a service container, then said a subsequent investigation had uncovered additional points of breach; it has found no evidence that wallet private keys leaked.

Chainalysis attributes the attack to TraderTraitor, the North Korean group linked to September's Bitget theft. Tether, Circle, Ripple, Binance, BitGo, Paxos, First Digital, and World Liberty Financial have frozen $2.81 billion of the stolen tokens, and Arbitrum's Security Council seized another $31.8 million. The remaining $3.52 billion sits in the attacker's wallets. Binance has said it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds, and that it has reserved more than $6.34 billion for the incident.

How the Attack Unfolded

Phase 1: Preparation. The attacker's main wallet, 0x7c86…5ca0, was funded through Tornado Cash on October 28th and 29th. It deployed a sweeper contract at 02:28 UTC on October 29th, tested it on three throwaway wallets from 13:51, and at 15:59 deployed a second version that can also make a delegating wallet call execute on a smart-account wallet it owns.

Phase 2: The sweep (20:05 to 20:35 UTC). At 20:04, the attacker tried to send 42,750,000.1 RLUSD from Binance 6 to a fresh address, rK21t6…qfzMx, and the payment failed. On the XRP Ledger, an address becomes an account only when it receives its first XRP, and a token payment such as RLUSD cannot activate it. Eight seconds later, the attacker sent 185,017,485.5 XRP from the same wallet, which activated the account, and by 20:09 it had taken 233,461,943.1 XRP from five Binance accounts. XRPSCAN labels all five senders as Binance, and each was activated by another Binance account, in a chain that leads back to Binance's first XRP accounts from November 2017.

At 20:10, the attacker took 965,455.1 SOL from Binance Hot Wallet 2 on Solana, then 5,066.8 SOL more by 20:33. It took 4,735,627 VIRTUAL from Binance 73 on Base at 20:16 and 44,231,858 OP from Binance 55 on Optimism at 20:18.

At 20:20, the attacker moved 18,270.2 BTC out of Binance's bc1qm34l…77s3h wallet in 11 transactions and split it across 19 wallets, 17 of them holding 1,000 BTC each. On TRON, it took 46,384,098 TRX and 612,729,468 USDT from TDqSquXB…hSCf at 20:21 and 20:22.

On Ethereum, at 20:20, the attacker broadcast 50 EIP-7702 authorizations signed by the key of Binance 14, a hot wallet then holding $2.53 billion.

EIP-7702 lets an ordinary account run a contract's code, and each authorization is valid for one account nonce. Binance 14 sends hundreds of transactions an hour, so the attacker brought signatures for 50 consecutive nonces to be sure one would match. The range started at 18,914,775, a nonce Binance 14 itself used at 20:17, which, as Dickson Wu noted, puts the signing within minutes of the attack. The authorization for 18,914,809 took effect, because a Binance 14 transaction earlier in the same block had used 18,914,808.

At 20:24, one sweeper call moved 167,464.25 ETH, 1,615,409,499 USDT, and 62 other tokens ($2.53 billion) out of Binance 14. Twenty-four seconds later, the attacker took 28,005.6 ETH, 55,739,800.5 USDT, and seven other tokens from Binance 16, which has no delegated code, in nine ordinary transfers. Between 20:30 and 20:35, it took 74,559,805 ARB and 8,426.2 ETH from four Binance wallets on Arbitrum, and 1,814,099.3 AVAX and 8,409,928.4 USDt from four on Avalanche. Every Ethereum Virtual Machine (EVM) transfer went to one attacker address, 0x5227…2f8c.

Phase 3: Return trips. At 20:41 and 20:59 UTC, the attacker used the sweeper's new function to make Binance 14 order Binance: Hot Wallet 34, a smart-account wallet it owns, to transfer 780,000,000 USDC and then 43,000,000 USDC. The delegation persisted, so the attacker swept Binance 14 again at 21:04, 21:44, 22:39, and 23:56. At 21:44, it took a 200,000,000 USDT top-up that Binance 124 had deposited 72 seconds earlier; at 22:39, it sent $48.4 million in ETH and 122 smaller tokens to a fresh address; and at 23:56, it took 2,961.9 ETH ($6.7 million).

At 23:04 and 23:05, as Binance was moving balances to cold storage, the attacker took 444,536.6 AVAX from Binance 113 on Avalanche and 46,626,589.6 POL and 6,185,900.1 USDT0 from Binance 48 on Polygon ($14.0 million). In both wallets, its transfers sit between Binance's own in the nonce sequence.

Phase 4: Laundering. The attacker raced Tether's freezes. At 20:30 and 20:33, it sent 500,000,000 USDT and 200,000,000 USDT from its Ethereum receiving address to two new wallets. The first sold 325,000,000 USDT for 122,316 ETH by 20:49 and passed 175,000,000 on. The second sold 10,000,000 on decentralized exchanges and sent 190,000,000 to a third wallet, which supplied 60,000,000 to Aave V3, borrowed 19,762.41 ETH against it, and moved the last 130,000,000 USDT 48 seconds before Tether froze it. Two more hops sold another 100,000,000. In all, the attacker sold 435,000,000 of the 1,875,464,711 USDT it took on Ethereum. On TRON, it moved 300,000,000 USDT to a second wallet and swapped 234,000,000 of it into 638,200,935 TRX before Tether froze the rest. All 18,270.2 BTC, 970,538.4 SOL, 233,461,943.1 XRP, 684,584,005 TRX, and 505,623.4 ETH across six Ethereum wallets remain outside any issuer's reach.

Root cause: suspected, not confirmed. The delegated contract holds no exploit logic; it is a sweeper only the attacker's wallet can call. The attacker had access to Binance's hot-wallet signing system: it obtained valid signatures on nine chains within 31 minutes and was still producing them three hours later, alongside Binance's own transactions.

At 02:25 UTC on October 30th, Binance said its initial investigation suggests a compromised DevOps engineer's laptop gave the attacker access to a service container, from which it submitted unauthorized withdrawal transactions, and that it has found no evidence of a wallet private key leak. That account is consistent with the onchain record on Polygon and Avalanche, where the attacker's transfers took nonces in sequence with Binance's own transactions. At 08:47, Binance revised that account: its subsequent investigation had uncovered additional points of breach, and it called the incident a complex attack. Binance has said it will publish a detailed technical post-mortem.

Chainalysis attributes the attack to TraderTraitor, a North Korean group, and says its investigators watched funds stolen from Binance commingle onchain with funds from September's Bitget theft, which had already been attributed to North Korean actors. It announced the attribution at 04:30 UTC on October 30th. Chainalysis also describes automated laundering it had not seen before: thousands of transactions circulating funds among addresses, many of which receive 1 TRX, then larger sums, and then pass the funds on. The laundering was still running on the morning of October 30th: the attacker was selling the tokens taken in the fourth Binance 14 sweep through at least 09:16, and its TRON wallet had passed on all but 105,339,350 of its 684,584,005 TRX by 13:13.

How the Damage Spread

Aave froze every V4 market and every V3 market except the EtherFi and Horizon instances on Ethereum. Aave V4's Security Council froze all 18 V4 spokes, 89 reserves in total, on Ethereum at 21:42 UTC, Avalanche at 22:05, and Base at 22:07. Protocol Guardian multisigs froze Aave V3 market by market, starting with Ethereum Core at 21:47 and finishing with Celo at 23:04. Nothing was paused. A freeze blocks new supplies and borrows, while repayments, withdrawals, and liquidations continue. The attacker's own Aave position, 60,000,000 USDT against 19,762.41 ETH of debt, had a health factor of 1.037 at 21:36 UTC.

Curators pulled back. Steakhouse Financial said its systems withdrew liquidity from several markets as a precaution, and that Ethena's only exposure was $8.8 million in unrealized basis positions, against a $60 million reserve fund. USDe did not depeg; its lowest CoinGecko price between 20:00 and 24:00 UTC was $0.99746. Gauntlet said its Lista vaults on BNB Chain withdrew liquidity and that Compound had frozen its markets. Sky, Spark, ether.fi, Avant, Clearstar, and Allez Labs said they were unaffected or had no direct exposure.

How Binance and Others Responded

World Liberty Financial blacklisted the receiving address for WLFI at 20:57 UTC, and Tether froze its USDT at 21:01. Circle froze 823,000,000 USDC at 21:04. Tether then blocked USDt on Avalanche at 21:07 (the attacker's attempt to move it at 21:40 failed), USDT on TRON at 21:09 and 21:21, XAUt at 21:11, and two more Ethereum wallets at 21:14 and 21:18.

Ripple paused the attacker's RLUSD wallet at 22:00, in the same block as the attacker's last RLUSD sale, freezing 40,541,065 RLUSD. BitGo froze 27,824,040 USD1 at 22:10, Paxos froze 1,906.67 PAXG at 22:30, and Binance, which issues wBETH, blacklisted the wallet holding the 29,934.01 stolen wBETH at 22:48. USDT0, which runs the omnichain version of USDT, froze the 6,185,900.1 USDT0 taken on Polygon at 23:25; its team said its monitoring caught the Polygon thefts and its multisig signers froze the funds before the attacker could swap them. The tokens have not left the attacker's wallet. At 23:31, Circle blacklisted an attacker address on Ethereum minutes after 1,563,812.8 USDC, from 200,005 stolen AVAX, reached it from Avalanche through Circle's Cross-Chain Transfer Protocol (CCTP).

USDT0 had also paused USDT transfers between Ethereum and TRON at 21:27 as a precaution, closing a laundering route between two chains where the attacker held stolen USDT, and reopened the route at 01:00 on October 30th, once Tether had frozen the bulk of the stolen USDT.

First Digital followed at 00:46 on October 30th, freezing 3,454,895 FDUSD. In all, issuers froze 1,767,593,979 USDT, 824,563,813 USDC, 40,541,065 RLUSD, 6,185,900.1 USDT0, 12,574.05 XAUt, 29,934.01 wBETH, 27,824,040 USD1, 48,525,612 WLFI, 3,454,895 FDUSD, and 1,906.67 PAXG, worth $2.81 billion. The freezes were fast, but not fast enough. Tether froze the main attacker address 37 minutes after the first Ethereum sweep and the TRON address 46 minutes after that theft, after 1,000,000,000 USDT had left those two addresses. Circle froze the USDC 23 minutes after it left Hot Wallet 34. Tether caught 70.8% of the 2,496,604,107 USDT stolen across Ethereum, TRON, and Avalanche. Circle caught all of the USDC.

Not everything was caught. From 21:42 until Ripple's pause, the attacker sold 48,000,000 of its 88,541,065 RLUSD through decentralized exchange pools. USDe and USDS were never frozen: the attacker began selling its 9,707,547 USDe at 22:56, and 1,014,445 USDS still sits at the main attacker address.

Arbitrum went further. At 00:08 UTC on October 30th, its Security Council, a 9-of-12 multisig, executed an emergency action on Ethereum that briefly upgraded the Arbitrum Inbox and submitted two transactions in the name of the attacker's Arbitrum wallet, 0x3e2b…32d5. At 00:18, those transactions moved 74,559,805.2 ARB and 8,425.9977 ETH ($31.8 million) to 0x…0DA0, an address with no code and no known key. With that seizure, $2.84 billion, or 44.6% of the loss, is frozen or seized. None has been returned to Binance.

Binance's first statement, at 21:29 UTC, said "User funds are completely safe." At 00:04 UTC on October 30th, Binance co-founder Yi He said "Binance will cover all hacking losses" and that deposits and withdrawals were temporarily suspended during security checks.

In later updates on October 30th, Binance said it will cover all losses from SAFU and company funds, will publish an updated Proof of Reserves once remediation is complete, and has engaged law enforcement and blockchain intelligence partners to trace and recover the funds. By 10:55, it had reserved more than $6.34 billion for the incident, $5 billion of it already held in the tokens that were taken, was buying the remainder through market and over-the-counter channels, and had begun recovering affected assets. It also said the outflows ceased when it paused withdrawals and that it remained on track to resume them within 45 hours.

From 22:55, Binance began moving hot-wallet balances on Ethereum, Base, and Polygon to Binance: Cold Wallet 20, including 44 tokens out of Binance 14 by 23:07. Tether blacklisted Binance 14 itself at 22:06, which also made Binance's own USDT transfers from that wallet fail at 22:15 and 23:01, and Circle blacklisted Binance 14 and Hot Wallet 34 at 23:53 and 23:54. Binance revoked Binance 14's delegation at 00:10 on October 30th, 14 minutes after the attacker's last sweep.

What Should Have Been Different

Halt outflows automatically when they spike. The first theft, on the XRP Ledger at 20:05 UTC, came 19 minutes before the $2.53 billion sweep of Binance 14, and $5.96 billion of the loss, 93.7% of it, left Binance's wallets more than 15 minutes after that first transfer. The attacker was still taking funds at 23:56 UTC. A system that detects an abnormal outflow and automatically stops signing, moves the remaining hot-wallet balances to cold storage, and blocks top-ups would have had time to act, and could have limited the damage to the first few wallets.

Refuse EIP-7702 authorizations at the signer. An exchange hot wallet has no reason to sign a delegation, so a signing policy that rejects authorization payloads would have blocked the Ethereum route outright.

Watch your own wallets' code. Binance 14 ran attacker code from 20:20 until 00:10 the next day. A monitor flagging a non-empty code field on any hot wallet would have stopped the 200,000,000 USDT top-up at 21:42.

Cap hot-wallet balances. Binance 14 lost $2.53 billion in one transaction. Balance limits with automatic refills from cold storage cap what a single compromised key can lose.

Keep smart-account owners off the hot path. Hot Wallet 34's owner was another hot wallet, so one compromised key reached $823 million in USDC.

Does Nexus Mutual Cover This?

Binance Custody is listed under Crypto Cover (product type 21), Part A: Custody Cover. Nexus Mutual had no active Binance Custody Cover when the breach occurred.

Part A covers this type of attack when the losses are passed on to end users. Clause 1(a), Crime-Related Loss, applies when "The Designated Custodian is the victim of a Crime that either occurred or was first discovered during the Cover Period" and the custodian then announces a loss that its users must bear. The cover wording defines Crime as "the criminal, fraudulent or dishonest taking or appropriation of cryptocurrency assets to the deprivation of the Designated Custodian by any person." The theft meets that definition.

Clause 1(b) also responds when a custodian imposes "a complete restriction on User withdrawals without prior notice" that "remains in effect continuously for 100 days or more." Binance has temporarily suspended deposits and withdrawals while it completes security checks, and said on October 30th that it remained on track to resume withdrawals within 45 hours; that suspension would have to stop all withdrawals for 100 days or more before clause 1(b) could respond.

Every custody claim Nexus Mutual has paid came from cases where users bore the loss: FTX ($4.92 million), Hodlnaut ($1.04 million), and BlockFi ($30,000), each after withdrawals were halted for months. The Bybit theft of February 2025, which Bybit absorbed, produced no claims.

Binance Custody Cover remains available for breaches like this one that end with losses passed on to users. Cover is discretionary, and the Claims Committee assesses each claim against the cover wording. Nexus Mutual has paid 100% of valid claims since 2019, totaling more than $24 million.

When the Keys Sign for the Attacker

The suspected weak point in the Binance breach is the signing system behind its hot wallets. Whoever controls it can move funds on every chain those wallets touch, and on October 29th that reached 23 wallets on 10 chains. EIP-7702 adds a sharper edge: on Ethereum, one signed authorization turned a hot wallet holding $2.53 billion into the attacker's sweeper, and the attacker kept sweeping it until 23:56.

For anyone holding assets on an exchange, the balance is a claim on the exchange's ability to make customers whole. Binance says it will cover all losses from SAFU and company funds, and that it has reserved more than $6.34 billion for the incident, $5 billion of it already held in the tokens that were taken; the loss equals 4.39% of its tracked reserves. A smaller exchange hit with the same loss might not cope. Part A of Crypto Cover protects against that outcome: a custodian that passes its losses on to users, or halts withdrawals for an extended period.

For DeFi users, frozen Aave markets still allow repayments and withdrawals. It is a live situation that the Nexus Mutual team is closely monitoring.

You’re Covered with Nexus Mutual

This is another reminder that scale doesn’t guarantee security. Taking proactive steps to protect your assets is the only way to minimize your risk exposure. If you’re looking for expert help to stay safe onchain, reach out to us at Nexus Mutual.