No key was stolen. The system signed what it was asked to sign.
The Mistake
Binance's first account of 29 October 2026 points to one machine: a DevOps engineer's laptop. According to the exchange's preliminary investigation, whoever controlled that laptop could reach an internal service container, and that container could submit withdrawal transactions [5]. How the laptop was compromised has not been made public. Binance says it found no evidence that a wallet private key leaked [5]. The laptop belonged to someone whose job was keeping systems up: the kind of access that is routine to hold and easy to stop noticing.
The documented failure sits one step further in. A request from that container reached Binance's hot-wallet signing system, and the signing system signed it. On Ethereum, what it signed was not a transfer. It was fifty EIP-7702 authorizations. EIP-7702, added to Ethereum in May 2025, lets an ordinary wallet hand its behaviour to a smart contract by signing an authorization. An authorization carries no amount and no recipient, only a code address — so a policy built to inspect payments had nothing to inspect [6]. Co-CEO Richard Teng later said the delegation "did not pass through our normal approval controls" [2]. In the same half hour, Binance wallets on every other affected chain signed ordinary transfers to the same attacker [1].
That is the mistake as far as the public record shows: a path from one engineer's endpoint to "sign this," with nothing along it that recognised the request as wrong. Binance has since said the attack involved "additional points of breach," was "not a single one-click action" [7], was not carried out by one person, and used tooling that deleted itself as it ran [2]. A technical post-mortem is promised. Until it arrives, the laptop is where the story starts, not necessarily where it was decided.
The Trail
Preparation began at least 36 hours out. On 28 October an operator wallet, 0x7c86…5ca0, received three 0.1 ETH withdrawals from Tornado Cash, a mixer that hides where funds come from [1][2]. On 29 October the operator tested a first version of its code on two wallets of its own. The final sweeper contract — about 130 lines [4] — went live at 15:59 UTC and was rehearsed on a third wallet roughly four hours before use [1][2].
20:05 UTC. Five Binance wallets on the XRP Ledger send 233.46 million XRP to one attacker address [1]. At 20:20 a Binance Bitcoin hot wallet sends 18,270 BTC to an address that starts splitting it into 1,000 and 100 BTC pieces in the same block — a peel chain [1].
20:20:59 UTC, block 26,300,753. Transaction 0xad99…298b carries 50 authorizations, all signed with the key of the wallet Etherscan labels Binance 14 (0x28C6…1d60), covering consecutive nonces 18,914,775–18,914,824, all delegating to sweeper 0x63e8…6fae [6]. Binance 14 sends almost every block, so fifty signatures across consecutive nonces guaranteed one would match. One did. According to Tibane Labs, the wallet had used nonce 18,914,775 three minutes earlier — a batch that fresh was signed on demand, not pulled from an old leak [6].
20:24:23 UTC, block 26,300,770. Transaction 0x53bd…e2f3 calls sweep. Binance 14 sends 167,464 ETH and 63 tokens, including about 1.6 billion USDT, to 0x5227…2f8c [1][6]. Twenty-four seconds later Binance 16 sends 28,006 ETH and other tokens, $174 million in all, by plain signed transfers [2][6]. The sweeper also uses Binance 14's owner rights over a separate Binance smart account to pull 823 million USDC [1][2]. The delegation stays live for nearly four hours; Binance's own systems keep routing deposits into the wallet and the attacker sweeps them again, the last time at 23:56 UTC [1]. Binance 14 clears the delegation at 00:10:35 UTC on 30 October [6].
TRM, Elliptic and Chainalysis read the record the same way: keys were not stolen; Binance's own signing infrastructure was made to sign, across chains [1][2][3]. SlowMist's CISO dissents, favouring a private-key leak [9]. Attribution rests on the laundering, not the intrusion. Chainalysis watched Binance funds commingle in real time with proceeds of September's Bitget theft, already assessed as North Korean [3]; Elliptic found shared service usage with launderers of three earlier TraderTraitor thefts [2]. TRM states high confidence. Elliptic says "likely" and "not yet certain," noting the overlap is small and the laundering slower than the group's habit [2]. No government has attributed the attack.
The Takedown
Stablecoin issuers moved first. Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the sweep, then followed the funds into four more addresses [1][2]. Circle froze 823 million USDC at 21:04, in coordination with law enforcement [1]. Ripple and World Liberty Financial froze their stablecoins within the hour [1]. At 00:08 UTC Arbitrum's Security Council used its emergency powers to move 8,426 ETH and 74.6 million ARB out of the attacker's wallet [1]. Binance puts the frozen total near $3 billion; Elliptic has verified $2.85 billion on-chain, 94% of it stablecoins [2]. Nothing has been frozen on Bitcoin, the XRP Ledger, Solana or NEAR, because native assets have no issuer [2]. Frozen is not returned: no reissuance to Binance had been announced as of 31 October.
The attacker raced the freezes and paid for speed: 434 million USDT swapped for 160,451 ETH at a 12–26% loss, 59.9 million USDT posted to Aave to borrow 19,762 ETH, 234 million USDT turned into 638 million TRX on Tron [2]. The 18,270 BTC sits in a peel chain across 19 addresses, most holding exactly 1,000 BTC [2]. As of 31 October, around $3.2 billion is in assets no issuer can touch [2]. The laundering runs on software: one Tron wallet has made 546 transfers with a median gap of 96 seconds, and Chainalysis sees addresses seeded with exactly 1 TRX before receiving funds [2][3]. Elliptic's public blocklist holds more than 1,000 addresses [2].
Binance suspended withdrawals, revoked the affected authorizations and is rebuilding its withdrawal service. It has reserved $6.34 billion to cover losses, said on 31 October that 90% of affected assets were replenished, and plans to resume withdrawals in phases on 1 November [8]. Law enforcement is engaged; the FBI has said it is aware and coordinating [2]. As of 31 October, no arrest, charge or sanctions designation connected to the theft has been announced. Binance says its investigation has not attributed the attack to any individual [2].
Your Check
Binance has not said how the laptop was compromised. What the record shows is narrower and quieter: one trusted endpoint, and a system that took its word.
You are not running a signing service. You are running a browser — and a browser is also a trusted endpoint that can disclose something you did not authorise. The ordinary version is a WebRTC leak: the VPN is on, and the browser hands out your real IP anyway. Same category of error — unwitting disclosure — at a scale that fits on one screen.
Run the WebRTC Leak Test. A few seconds. No sign-up.