$6.3B Drained From Binance: Biggest Crypto Hack Ever

On October 29, 2026, Binance lost about $6.3 billion from its hot wallets, the largest crypto hack ever recorded. Cédric breaks down how the attacker rehearsed the exploit for two days, what got frozen, and why the emergency freeze powers of stablecoins and layer 2s raise a hard question about decentralization.

The Night Binance's Hot Wallet Became a Hacker's ATM

To understand what happened, you first need to see how an exchange stores money. Think of it like a bank. Most of the funds sit in cold wallets, completely offline and secure, like a safe in the basement. But you still need some cash at the counter for daily withdrawals, and that is what hot wallets do. This time, those hot wallets got hit.

On the night of October 29, the world's biggest exchange got drained. Binance itself says around $6.3 billion was taken. What worries me more than the amount is how it happened. Nobody hacked Bitcoin or Ethereum. Binance's own hot wallet signed an authorization and became the hacker's withdrawal machine, basically an ATM. Behind that is EIP-7702, launched on Ethereum last year, plus AI supercharging hackers, plus all these freezes by Tether and Circle. It raises a real question about what decentralization still means.

How the Attack Was Prepared and Executed

According to Binance's first findings, a DevOps engineer's laptop was compromised, and from there the attacker submitted unauthorized transactions. So far, Binance says there is no evidence that any wallet private key leaked, but we will need the full postmortem for all the details.

On-chain, the story is already pretty clear. The hacker started preparing about two days before. On October 28, they pulled small amounts of ETH out of Tornado Cash in a few batches to use later for gas. On October 29, they deployed their sweeper contracts and then used test wallets they controlled to rehearse the whole authorize-then-sweep process. They did it a couple of times and swept all the test funds.

Once everything worked, they went for the real thing. The actual attack window was very short. The hacker sent 50 EIP-7702 authorizations in one go. Why 50? Because the nonce, basically the wallet's transaction counter, keeps changing on a busy hot wallet. They signed a whole range of nonces to make sure one of them would land. Once one landed, the hot wallet known as Binance 14 got turned into the hacker's sweeper contract. From then on, one call was enough to send everything straight to the attacker's address. In just a few minutes, nearly 200,000 ETH, more than 1.6 billion USDT, and dozens of other tokens left Binance's wallet on Ethereum, with the biggest sweep happening in one single transaction.

At almost the same time, Binance hot wallets on Bitcoin, Tron, Solana, Arbitrum, Avalanche, and several other chains started sending funds out too. The attacker swept all these chains in parallel, exactly as rehearsed.

What Was Frozen and What Binance Promises

The stablecoin issuers reacted fast. Tether, Circle, and others froze a big chunk of the stolen USDT and USDC. Arbitrum's Security Council also stepped in and moved the attacker's funds on Arbitrum into a frozen wallet. Binance says around $3 billion is frozen so far, and that it will cover all remaining losses with its SAFU fund and its own money.

From the angle of limiting damage, that is obviously good news. But my feelings get a bit mixed here. Being able to lock funds fast and protect users is good, at least from their point of view. As someone who has always pushed for decentralization, I have to say it leaves me uneasy. Who can freeze assets like that? Mostly stablecoins at the smart contract level, and layer 2s like Arbitrum where the team or a security council can step in directly in an emergency. How can they still call themselves fully decentralized? Real decentralization means nobody can easily touch your assets. Bitcoin and Ethereum mainnet, to this day, cannot be frozen. That is their core value, and that is why the hackers are swapping the coins for ETH.

In reality, a lot of projects keep some centralized control for security and compliance. It is a trade-off, and I do not like it. But I still believe decentralization is the best direction for giving regular people real ownership of their assets. Every incident like this forces us to make decentralization stronger and easier to use, not the other way around.

EIP-7702, AI, and the Next Generation of Attack Surface

When EIP-7702 was proposed in 2024, quite a few people in the community pushed back. Ethereum was debating account abstraction, and Vitalik jumped in and quickly wrote this proposal as an alternative. Back then, a lot of people worried it would bring new security risks. If someone gets hold of that authorization, it can be abused as an auto-transfer tool. Some developers clearly warned about this exact kind of scenario, and now that risk has played out in the real world.

In my view, every technology today has to be tested, fixed, and improved at the same pace as AI. AI has moved pretty fast these last two years. For hackers, it is now way easier to find bugs in code, generate phishing content, and automate the whole attack. Defenders are using AI too, but it is an asymmetric arms race. The rewards for white hats are really small. Look at the recent XRP findings. Billions were protected, and the person got a small price compared to what they saved. From now on, security has to factor in what AI can do, and we have yet to properly reward white hats.

This is not the first time. In 2019, a Binance hot wallet got hacked on a much smaller scale. They covered it with their SAFU fund and were back up in about a week, and they published a postmortem. Last year, Bybit got hit for about $1.5 billion. Before that we had even more extreme cases like Mt. Gox and FTX. From history, what I see is that after every big disaster, the industry is forced to take one step forward. After FTX, proof of reserves finally became the norm. This time, hot wallet signed transactions, real-time monitoring of authorizations, and the new attack surface in the AI era are going to get a hard second look.

What This Means for Your Crypto

First, remember that an exchange is not your vault. The coins you leave there are basically an IOU from the platform, like a bank. It is centralized, and that is dangerous. Only keep on an exchange what you actually need to trade. For long-term holding, think about self-custody. Yes, self-custody has its own risks. Lose your keys and nobody can get them back for you. But I still think it is the safest way. Which one you pick is your call.

Second, learn to read proof of reserves. Do not just trust a platform saying they are safe. Check if the reserve ratio is 100% or more, and how often it is updated. Do not put all your eggs in one basket.

Third, during big events like this, the biggest danger is not the hack that already happened. It is scammers. Fake support, fake compensation, fake links. They are everywhere today and will be for months. Anyone asking for your seed phrase, your private key, or your 2FA code is a scammer. Period. Be especially careful with fake refund emails, because those are already coming.

The Three Questions I Ask Before Putting Crypto Anywhere

Before you do anything with your coins, I always ask myself three questions. They are the real takeaway from this whole mess.

Why am I putting them here? How much am I putting here? And if this place ever has a problem, can I handle it? Not all your eggs in one basket, ever. Think it through before you act, and once you act, it is your own decision, so assume the risks.

Why am I putting them here?
How much am I putting here?
If this place ever has a problem, can I handle it?

Security and Decentralization Are Long Term Work

On the surface, this is a hot wallet hack. Deep down, it shows the systemic risk of centralized custody with new features stacked on top. The bigger the exchange, the bigger the single point of failure. EIP-7702 lets a wallet temporarily act like a smart contract, and the idea was a better user experience. But once someone gets the signing right, the attack gets far more efficient. AI makes it even cheaper for hackers to prepare and test nowadays.

I have been in crypto for almost 10 years, and I really feel this. After every big disaster, the industry is forced to get better. That is a good thing. But it never happens on its own, and that is a bad thing. Every single time, it is paid for with real money and real trust. Next, the industry needs to improve the hot wallet signing process, monitor authorizations better, and put safeguards in place. Signing a few billion just like that is crazy. We also have to seriously discuss the emergency freeze powers of stablecoins and layer 2s.

Real security takes time, practice, and repeated testing in the real world. Decentralization is not a slogan, and neither is security. Both are long term work that we have to build slowly with real respect for the risks. So wherever you keep your coins, ask yourself those three questions before you act.

Not your eggs, all your eggs in one basket. Think it through.