The Binance Hot Wallet Hack, Step by Step

On 29 October 2026, between 20:05 and 23:56 UTC, Binance hot wallets on ten blockchains were drained. Binance puts the damage at about 6.3 billion USD [1]. Within hours, Tether and Circle froze 2.6 billion USD of the stolen USDT and USDC on Ethereum, Tron, Avalanche and Polygon. Most of the rest is now held as ETH and BTC, coins without an issuer that could freeze them.

In this post, we explain how the attacker reached ten blockchains from a single entry point, how an Ethereum feature called EIP-7702 let the attacker run its own code on one Binance hot wallet on Ethereum and drain it with one call, and where the Ethereum funds went. Figure 2 follows the funds step by step.

How the attacker reached ten blockchains

A hot wallet is an active wallet of an exchange that manages its daily business, such as customer withdrawals. According to Binance, the attacker came in through the compromised laptop of a DevOps engineer and reached a service container that submits withdrawals [1]. Binance says that no private key leaked.

On the blockchains, the drains take two forms:

The attacker used EIP-7702 only for this one hot wallet. With the delegation in place, later calls swept new deposits from the wallet until 23:56 UTC.

Sweeping the Ethereum hot wallet

EIP-7702 is part of Ethereum since May 2025. With it, a wallet can point to the code of a smart contract by signing an authorization. From then on, a call to the wallet runs that code. Only a newer authorization from the same wallet changes this.

Each authorization names one nonce, the number of the wallet’s next transaction, and only works at that number. In the 30 minutes before the attack, the hot wallet sent 339 transactions, about one every five seconds. The transaction that installed the code carried 50 authorizations, for 50 nonces in a row.

The authorization list is part of the transaction and can be read from the blockchain. In transaction 0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b, all 50 entries carry a valid signature of the hot wallet, are valid only on Ethereum and point to the same sweeper code. They cover the nonces 18,914,775 to 18,914,824. A withdrawal of the hot wallet earlier in the same block used nonce 18,914,808, so the entry for 18,914,809 matched. Its next withdrawal used 18,914,810, and the other 49 entries had no effect (Figure 1).

Following the funds

The graph in Figure 2 starts at the operator, the attacker address that deployed the sweeper code and sent the authorizations, and ends at the wallets that hold the ETH today. Scrolling through it follows the case in order. Every address opens in Pathfinder, except those on XRP and Solana.

1. On 28 and 29 October, the operator receives three withdrawals from the 0.1 ETH pool of Tornado Cash and 1.08 ETH from a second wallet, which is also funded through Tornado Cash. At 15:59 UTC, it deploys the sweeper code.
2. From 20:05 UTC, Binance wallets on XRP, Solana, Tron, Bitcoin and Avalanche send large amounts to the attacker with plain transfers, signed by their own keys. On Bitcoin, the 18,270 BTC are split into 19 addresses by 20:48 UTC, 17 of them with exactly 1,000 BTC. On Avalanche, five Binance wallets send 2.26 million AVAX and 8.4 million USDT to the same address as the main receiver on Ethereum, from 20:33 UTC. Tether freezes this USDT at 21:07 UTC.
3. At 20:20:59 UTC, the operator hands the Ethereum hot wallet its 50 signed authorizations. The transaction runs nothing itself. From then on, every call to the wallet runs the sweeper code.
4. At 20:24:23 UTC, one call to the hot wallet moves 167,464 ETH, 1.615 billion USDT and 62 other tokens to the main receiver. A second Binance hot wallet follows with a plain signed transfer, and through the first one the operator also empties a Binance USDC wallet that accepts orders from it. Later calls sweep new deposits until 23:56 UTC. From 22:39 UTC, these go to a second receiver.
5. At 21:01 UTC, Tether freezes the main receiver for USDT, and at 21:04 UTC, Circle freezes its 823 million USDC. The USDT freeze blocks sending but not receiving, so later sweeps bring the frozen USDT to 1,175 million.
6. Fourteen minutes after the sweep, 195,500 ETH leave the main receiver for a first ETH wallet, and 2,000 ETH follow on 30 October.
7. At 20:30 UTC, 500 million USDT go to a new pass-through wallet. Between 20:34 and 20:50 UTC, it sells 325 million USDT through UniswapX and 1inch orders for about 122,300 ETH, about 2,660 USDT per ETH, while the Chainlink price feed showed 2,240 to 2,310 USD per ETH. At 21:47 UTC, it sends the 122,300 ETH to a second ETH wallet. The other 175 million USDT reach a wallet that Tether freezes at 21:15 UTC.
8. From 20:33 UTC, another 200 million USDT run through a chain of new pass-through wallets. Along the way, 110 million USDT are swapped for ETH on decentralized exchanges. One wallet puts 60 million USDT into Aave (a lending service) and borrows about 19,800 WETH (wrapped ETH) against it.
9. At the end of the chain, 30 million USDT stay in a wallet that Tether freezes at 21:19 UTC, and 57,900 ETH reach a third ETH wallet. A side wallet adds 20,500 ETH to it later that night.
10. On 30 October at 05:15 UTC, the main receiver moves its last 17,260 ETH to a fourth ETH wallet. A side branch that sold 217.5 million ENA tokens adds 15,300 ETH to the second ETH wallet. Wallets that sold other stolen tokens and the second receiver fill two more ETH wallets with 43,600 ETH. At 11:00 UTC, the six ETH wallets hold 474,338 ETH and have not sent a transaction.
11. On Tron, 300 million USDT go to a swap wallet. It swaps 234 million USDT for 638.2 million TRX and passes 66 million USDT to a third wallet. Tether freezes 313 million USDT in the first attacker wallet and the 66 million in the third. The TRX moves on to five new wallets between 10:15 and 10:20 UTC on 30 October. The 18,270 BTC sit unspent in 19 addresses.

Where the funds are now

On 30 October at 11:00 UTC, six Ethereum wallets hold about 474,000 ETH, about 1.1 billion USD, and none of them has sent a transaction. The 18,270 BTC sit unspent in 19 addresses. On Tron, the TRX moved on to five new wallets between 10:15 and 10:20 UTC. The last two steps of Figure 2 show these wallets.

On Arbitrum, the attacker moved 8,426 ETH and 74.6 million ARB to a second wallet. At 00:18 UTC on 30 October, the Arbitrum Security Council moved these funds out of that wallet to the address 0x0000000000000000000000000000000000000da0.

Further notes

The graph is drawn for this post and follows the layout of Pathfinder. It shows the main routes, not every transaction. Amounts are totals per pair of addresses, and small transfers (gas top-ups, dust from address-poisoning bots) are left out.

At the time of writing, Binance’s statement [1] is the only source on how the attacker got in. The figures in this post reflect the state of the blockchains on 30 October 2026 at 11:00 UTC.

This post and the tracing behind it were made with internal Iknaio tooling that is not yet part of the Iknaio subscriptions.

References

[1] Binance (2026, October 30). Update on the security incident. Binance on X. Reported by CyberInsider.