Binance hot wallets lose up to $6 billion in coordinated multi-chain exploit
Security & Exploits ·
A single attacker sequence on October 29 drained between $5.8 billion and $6 billion from Binance's hot wallets across several blockchains, triggering emergency freezes and a temporary withdrawal halt.
According to a posted timeline, the breach began at 20:20 UTC when the attacker exploited the EIP-7702 standard to delegate one of Binance's hot wallets, labeled wallet 14, to malicious code. Four minutes later, that delegation enabled a single transaction removing 167,464 ETH along with 63 other tokens, including 1.615 billion USDT. A separate hot wallet, number 16, lost another 28,005 ETH shortly after, at 20:25 UTC. By 20:41 UTC, a third wallet, number 34, had been stripped of $780 million in USDC, with an additional $43 million taken soon afterward.
The attacker then moved to leverage the stolen funds further, depositing $60 million in USDT into Aave at 20:57 UTC and borrowing nearly 19,762 ETH against it. Starting at 21:01 UTC, stablecoin issuers Tether and Circle, along with other issuers, began freezing portions of the stolen assets, and roughly $3 billion has been frozen so far while the rest of the funds remain under tracking. Binance subsequently revoked the malicious delegation and paused withdrawals to conduct security checks.
Binance has attributed the breach to a compromised laptop belonging to a DevOps engineer, and the exchange disclosed the incident as a $6.3 billion security breach, according to cryptopotato.com. The company has said customer funds are safe and that affected users will be reimbursed in full, with the exchange pledging to cover losses through its SAFU fund. Separate on-chain tracking put the total moved to attacker-controlled addresses at $6.26 billion spread across nine major chains, including Ethereum, Bitcoin, and Solana, and Binance has since been shifting remaining balances from potentially compromised wallets into cold storage.
On-chain analysis has also tied the exploit to other recent incidents, linking the Binance attacker cluster, holding an estimated $5.78 billion across multiple assets, to the $388 million Bitget exploit and the Phemex hack through commingled funds routed via THORChain, per x.com. It remains unclear how much of the roughly $3 billion still untraced will ultimately be recovered, how long withdrawal suspensions will last, and whether the DevOps laptop compromise points to a broader vulnerability in Binance's internal security controls.