EXPLAINER · OCTOBER 29–30, 2026

Binance Hack 2026: What Happened to $6.3 Billion?

Last reviewed November 5, 2026 · Published by the LATCH community · Figures are preliminary and may change

On October 29–30, 2026, Binance reported a major security incident involving unauthorized withdrawals. This page summarizes what the exchange has said, what the FBI and independent researchers found, and what the episode teaches about signing security — with sources for every key claim.

What Binance confirmed

In its statements, Binance described unauthorized withdrawal transactions executed through internal service containers. Its preliminary investigation initially pointed to a possibly compromised DevOps engineer's laptop. [Binance official incident announcement] Its November 3 preliminary report describes a longer, multi-stage campaign, summarized below. [Binance preliminary incident report (Nov 3)]

In Update #2 on October 30, Binance said it had discovered additional breach points and described a more complex, multi-stage incident. It also said there was no evidence yet of private-key leakage — a preliminary finding. [Binance Security Incident Update #2 (Oct 30)] A complete technical post-mortem has not been published.

Reuters separately quoted Binance co-CEO Richard Teng as saying the compromise also involved malware designed to delete evidence. That is Binance's statement as reported, not a confirmed root cause. [Reuters — withdrawals resume (Nov 1)]

Binance pledged to cover losses using its SAFU fund and company funds. [Binance statement (Binance Square)] That is the exchange's own commitment; readers should follow Binance's official channels for account-specific details rather than treat any summary — including this one — as a guarantee.

How could signing infrastructure be abused?

Much crypto security focuses on protecting private keys: hardware modules, cold storage, multi-party computation. But a key is only one part of the system. Around it sit the services, permissions and automated workflows that decide what gets signed and when.

If an attacker gains influence over that workflow — for example through a compromised developer machine or an internal service — they may be able to get the system to produce signatures it should never have produced. Those signatures are cryptographically valid. The math checks out. What fails is the decision behind them.

That is the core lesson of this incident as currently understood: a valid signature is not the same as a legitimate decision. It does not prove no key was exposed — investigations are still open — but it explains how large losses can occur even when key storage holds.

EIP-7702 and the 50 authorizations, explained

EIP-7702 is a legitimate Ethereum upgrade that lets a regular account delegate execution to smart-contract code, with the delegation persisting until replaced or revoked. It powers useful features such as batched transactions and sponsored gas. [EIP-7702 specification]

According to on-chain analysis by Blockaid, attackers had prepared 50 pre-signed EIP-7702 authorizations for one Binance hot wallet (labelled Binance 14), covering a range of sequential nonces. Because an authorization is only valid when its nonce matches the account's current nonce, only one of them was accepted. That authorization delegated the wallet to an attacker-controlled sweeper contract, which then moved assets out. [Blockaid on-chain EIP-7702 analysis]

Because EIP-7702 delegation persists until replaced or revoked, it was not a one-time action. Elliptic reports that new assets arriving at the wallet were automatically swept at least six more times over roughly three and a half hours. [Elliptic analysis (updated Nov 1)]

Binance's own account uses different wording: it says the attacker submitted "50 signing transactions" to manipulate the nonce and establish a malicious EIP-7702 delegation. [Binance preliminary incident report (Nov 3)] Blockaid describes 50 pre-signed authorizations, one of which matched the current nonce. The two descriptions may refer to related activity, but we do not treat the counts as proven identical.

Why the withdrawal pause couldn't stop EIP-7702

According to Binance, pausing off-chain withdrawals did not invalidate on-chain permissions already granted. Because the wallet used MPC rather than a readily exportable private key, revoking the delegation required a special process. Binance says the final unauthorized transfer, 2,961.9 ETH, was finalized at 23:56 UTC on October 29, and a revocation to the zero address cleared the Binance 14 delegation at 00:10 UTC on October 30. That describes this one wallet, not every affected path. [Binance preliminary incident report (Nov 3)]

What happened to the funds?

Three different things are easy to confuse here: what was stolen, what was frozen, and what Binance replaced with its own money.

• Affected: about $6.34 billion, per Binance's November 3 preliminary report (first reported as ~$6.3B on October 30). [Binance preliminary incident report (Nov 3)] [Binance official incident announcement]
• Frozen or intercepted: about $2.85 billion, per Binance on November 3 (its October 30 figure was roughly $3B) — mostly stablecoins, with Reuters reporting freezes by Tether and Circle. Frozen does not mean returned. [Binance preliminary incident report (Nov 3)] [Reuters — October 30 overview]
• Replaced: about 98% of affected assets replenished from Binance's own resources, per its November 4 update (earlier: ~90% Oct 31, ~95% Nov 1). This is Binance covering users, not funds recovered from the attackers. [Binance Recovery Update #7 (Nov 4)] [Binance Recovery Update #4 (Nov 1)]

Separately, blockchain analytics firm Elliptic published its own research snapshot estimating about $6.43 billion stolen and about $2.85 billion verified frozen. These are Elliptic's figures, not Binance's. [Elliptic analysis (updated Nov 1)] The FBI says the actors have been converting stolen assets primarily to ETH and may use DeFi services and instant swaps. [FBI — Binance attribution alert (Oct 31)]

A fourth, separate figure is customer behavior after reopening. When withdrawals resumed on November 1, Binance reported about $3.638 billion in net customer outflows over roughly nine and a half hours — customers moving their own funds, not stolen money, and not additive to the $6.3B theft. Binance says withdrawal activity spiked at first, then declined and appeared to stabilize, with substantial deposit volumes; that is Binance's own reading, and Reuters separately reported a withdrawal spike followed by decreasing activity, citing DefiLlama net outflows of over $3.5B measured from different sources and times. [Binance on X — withdrawal/deposit flow update (Nov 1)] [Reuters — withdrawals resume (Nov 1)] None of this is an independent conclusion that the platform is fully secure; Binance's report is preliminary, its independent review is ongoing, and the full ZK proof for the expanded 44-token November 4 snapshot was not confirmed published as of November 5, 06:30 UTC. [Binance Recovery Update #7 (Nov 4)]

What's happened to the stolen funds since?

Elliptic's independent tracking found that in the first 3.5 days the funds moved through about 12,000 wallets across 11 blockchains in more than 40,000 transactions — roughly one new wallet every 25 seconds. The patterns were highly automated and scripted; Elliptic found no evidence of AI agents doing the laundering. Those 12,000 are addresses, not user accounts or individual perpetrators. Most of the stolen SOL (about $85M) was moved via swaps, bridges and mixing, and some BTC was mixed. At its snapshot, Elliptic linked about $3.21B in balances, mostly ETH and BTC.* [Elliptic — laundering analysis (updated Nov 4)] [Elliptic on X (Nov 2)]

TRM Labs describes further obfuscation through self-minted tokens, liquidity-pool receipt tokens and chained bridges — layering designed to make tracing harder. [TRM Labs — laundering update (Nov 3)]

* Analyst balances are time-stamped snapshots (Elliptic, updated Nov 4, 09:15 UTC), not live figures, and are not additive to Binance's totals.

The Response Network

ONE INCIDENT. MANY WATCHFUL EYES.

As the incident unfolded, independent investigators, stablecoin issuers, and protocol risk teams traced suspicious flows, froze assets or reduced exposure. Their actions were independent of this memecoin.

1. Spreek

   Oct 29

   EARLY WARNING

   Posted an early on-chain alert about unusually large Binance outflows — a preliminary signal at the time, before Binance confirmed an incident.

   [The Block — Binance investigating outflows (Oct 29)][Portfolio Terminal — suspected hack timeline]

2. Paolo Ardoino (Tether)

   Oct 29

   STABLECOIN CONTAINMENT

   Announced that more than 1.567B USDT linked to the suspected hack had been frozen.

   [Paolo Ardoino on X][The Block — Binance investigating outflows (Oct 29)][Reuters — October 30 overview]

3. Jeremy Allaire (Circle)

   Oct 29

   STABLECOIN CONTAINMENT

   Announced more than 800M USDC frozen in connection with the incident, describing the action as coordinated with law enforcement.

   [Jeremy Allaire on X][The Block — Binance investigating outflows (Oct 29)][Reuters — October 30 overview]

4. Blockaid

   Oct 29

   TECHNICAL ON-CHAIN ANALYSIS

   Described 50 pre-signed EIP-7702 authorizations, one matching nonce, and delegation to an attacker-controlled sweeper contract. Independent research, not a Binance root-cause finding.

   [Blockaid on-chain EIP-7702 analysis][Blockaid on X]

5. ZachXBT

   Oct 30

   FUNDS TRACING

   Reported Binance exploit funds being commingled with Bitget exploit funds via THORChain, suggesting a possible common operator — an inference, not a proven finding.

   [ZachXBT on X]

6. Arbitrum Security Council

   Oct 30

   EMERGENCY ASSET CONTROL

   Confirmed an emergency action moving 74,559,805 ARB and 8,425 ETH associated with the exploiter into a controlled frozen wallet (about $30.5M at the time).

   [Arbitrum on X]

7. Aave Labs, LlamaRisk, TokenLogic, Certora

   Oct 29–30

   PROTOCOL RISK RESPONSE

   Risk teams temporarily froze deposits and borrowing on many Aave V3/V4 markets to reduce exposure; users could still repay and withdraw. Aave's contracts were not hacked, and this was not a recovery of Binance funds.

   [Aave governance forum — Aave's response][The Block — Binance investigating outflows (Oct 29)]

8. Changpeng Zhao (CZ)

   Oct 29

   PUBLIC ACKNOWLEDGMENT

   Binance's founder publicly acknowledged Tether's and Circle's response and said he expected losses to be covered, noting he no longer manages Binance. On Nov 1 he publicly thanked the U.S. Secret Service and partner agencies; per that post, investigators worked within minutes with industry partners to help identify and freeze a significant portion of funds — their own account, not independently verified timing.

   [CZ on X][The Block — Binance investigating outflows (Oct 29)][CZ on X — thanks to U.S. Secret Service (Nov 1)]

Figures are historical snapshots reported by each party at the time. They overlap with Binance's totals, may since have been updated, and must not be added together. "Frozen" does not mean returned. Links are documentary references, not partnerships or endorsements; X post links were corroborated through media and third-party archives rather than opened one by one.

These accounts and organizations are cited for their documented response to the incident. None is represented as affiliated with or endorsing LATCH.

Why people compare it to Bybit 2025

In February 2025, Bybit lost roughly $1.5 billion after attackers compromised the wallet interface used to approve transactions. The FBI attributed that attack to North Korea, referring to the activity as TraderTraitor. [FBI — Bybit attribution (2025)]

For the October 2026 Binance incident, the FBI attributed the theft to North Korea's TraderTraitor in a public alert on October 31 — a government assessment, not a court finding — while Binance's November 3 report remains preliminary pending independent review. [FBI — Binance attribution alert (Oct 31)] The two incidents used different techniques; the common thread is that attackers targeted the infrastructure trusted to approve transactions, not the cryptography itself.

Lessons for wallets and exchanges

• Check transaction intent — verify what a request actually does before it is signed.
• Set signing policy limits — define amounts, destinations and delegations that are never allowed automatically.
• Separate duties — no single device or person should be able to both prepare and approve high-value actions.
• Monitor permissions and signing activity — watch for unusual delegations, authorizations and nonce patterns.
• Contain fast — limit the blast radius so one compromise cannot drain everything.

These are general industry principles. They are not features or services of the LATCH token.

FAQ

Were Binance private keys stolen?

Binance's November 3 preliminary report says attackers gained unauthorized access to an internal wallet signing service and that there is no evidence of private-key exposure. That is a preliminary finding; Binance says a full investigation and independent review are ongoing.

Who was behind the attack?

The FBI attributed the theft to North Korea's TraderTraitor in a public alert on October 31, 2026. That is a government assessment, not a court ruling.

Is EIP-7702 insecure?

No. EIP-7702 is a legitimate Ethereum feature for account delegation. Researchers say it was used in one Ethereum path of a multi-chain theft, which is different from it being a flaw.

Was the money recovered?

Mostly not. Binance's November 3 report puts frozen or intercepted assets at about $2.85B (an earlier October 30 figure was ~$3B); frozen is not returned. Separately, Binance's November 4 update says about 98% of affected assets have been replenished from its own resources — replacement, not recovery from the attackers.

Has Binance published its full proof of reserves?

Partly. The 10-token ZK proof for the October 31 snapshot was completed. Binance's November 4 snapshot expands coverage to 44 tokens, and Binance estimated its full ZK proof would take 50–60 hours; as of November 5, 06:30 UTC we had not confirmed its publication.

Can users withdraw again?

According to Binance, all 15 networks/assets in the first wave had reopened by 12:36 UTC on November 1, with further networks and assets still in testing. Not every asset/network combination outside the first wave is restored yet. Check Binance's official channels for live network status.

Is there a $150 Binance hack compensation claim?

Not that Binance has announced. Screenshots and posts promising a $150 payment for withdrawal disruptions were described by Binance as digitally altered, and CZ called them scams. A separate community rewards campaign was reportedly under consideration pending regulatory approval, so check only Binance's official channels — and never click claim links, connect a wallet or sign approvals to receive a supposed payout.

Is LATCH associated with Binance?

No. LATCH is an independent Solana community memecoin launching on Pump.fun, with no affiliation to Binance, Bybit, the FBI or any security provider.