Binance hacks span four security incidents between 2018 and 2026, and the most recent one, detected on October 29, 2026, moved approximately $6.3 billion out of Binance hot wallets on several blockchains. The exchange suspended withdrawals, committed its SAFU fund and company reserves to cover losses, and opened an investigation with law enforcement.
Chainalysis and TRM Labs attribute the 2026 exploit to TraderTraitor, a North Korean group affiliated with Lazarus, with high confidence. The evidence includes on-chain commingling of stolen funds with proceeds from the September 2026 Bitget exploit, staging withdrawals from Tornado Cash, and laundering patterns across thousands of automated transactions.
Binance Hacks Before 2026: A Phishing Wave and 7,000 BTC
The earliest of the Binance hacks occurred on March 7, 2018. Attackers collected user credentials through phishing pages on lookalike Unicode domains, created trading API keys on compromised accounts, and placed market buy orders on the VIA/BTC pair during a two-minute window while 31 pre-funded accounts sold VIA. Binance’s risk management system halted withdrawals automatically, and the exchange reported no stolen funds.
On May 7, 2019, attackers withdrew 7,000 BTC, worth about $40.7 million at the time, in a single transaction from the exchange’s hot wallet. The group used phishing and malware to obtain API keys and two-factor authentication codes from users. The hot wallet held about 2% of Binance’s Bitcoin and cold storage remained intact. Binance paid the loss from the SAFU fund, a reserve it created in July 2018 and finances with 10% of trading fees.
Deposits and withdrawals stayed suspended for about a week while Binance rebuilt its API, two-factor authentication and withdrawal validation systems and announced support for hardware security keys including YubiKey. The 2019 breach set the response pattern for later Binance hacks: suspend withdrawals, cover losses from reserves and publish remediation steps.
BSC Token Hub Exploit of 2022: A Proof Verification Flaw
On October 6, 2022, an attacker exploited the BSC Token Hub, the cross-chain bridge of BNB Chain, and minted 2 million BNB in two transactions of 1 million BNB each, worth about $570 million. The flaw sat in the verification of IAVL Merkle proofs: the attacker forged a proof tied to a block submitted two years earlier, and the bridge accepted it as valid. BNB Chain suspended the network in coordination with its validators.
The attacker moved between $100 million and $110 million off BNB Chain before the halt, and the response team froze about $7 million.
The October 2026 Exploit: Hot Wallets Drained on Nine Blockchains
The attack began on October 29, 2026, at about 20:04 UTC and ran until 23:56 UTC. On-chain tracing identifies 17 Binance hot wallets on nine networks: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base and Polygon.
Binance estimates the total loss at $6.3 billion, and independent analytics firms place the figure between $6.36 billion and $6.4 billion. Among Binance hacks, the 2026 exploit exceeds the $1.5 billion Bybit theft of February 2025, the previous largest crypto hack.
Ethereum carried the largest share: the first sweep, at 20:24 UTC, moved 167,464 ETH and about 1.6 billion USDT out of the Binance 14 wallet, and six more drains followed. The Bitcoin network recorded 18,270 BTC leaving in one block, Tron lost about 613 million USDT, and the XRP Ledger lost 233.5 million XRP.
How EIP-7702 Delegation Enabled the Ethereum Sweep
EIP-7702, activated in the Pectra upgrade in May 2025, lets an externally owned account run smart contract code through a signed authorization, an attack surface absent in earlier Binance hacks. At 20:20:59 UTC, one transaction submitted 50 authorizations signed by the Binance 14 address, each pointing to an attacker-deployed sweeper contract.
The network accepted the authorization with the valid nonce, and the contract could move every asset in the wallet. An authorization defines neither recipient nor amount, which lets the delegated code reach existing balances and later deposits.
Bitcoin, Tron and the other networks do not support EIP-7702, and funds on them left through ordinary signed transfers, which means every drain carried a valid Binance signature. Binance’s preliminary findings point to the compromised laptop of a DevOps engineer, which gave the attacker access to an internal service container able to submit withdrawals.
Co-CEO Richard Teng stated no evidence shows a leaked private key, and investigators found further breach points beyond the laptop. Binance revoked the delegation at 00:10 UTC on October 30, after three hours and 50 minutes, and has not published the full attack path.
Freezes, SAFU Coverage and Proof of Reserves
Tether froze more than 1.5 billion USDT and Circle froze 823 million USDC about one hour after the first drain, while Ripple, World Liberty Financial, First Digital and the Arbitrum Security Council locked additional assets. Frozen value totals between $2.7 billion and $3 billion, close to half the loss. The attacker swapped about $729 million of stablecoins into ETH and TRX before the freezes.
Binance stated user funds are safe and committed to cover all losses with the SAFU fund, which holds about $1 billion in Bitcoin, and with company funds. The 2019 loss drew on the same reserve, and the 2026 commitment applies it to the largest of the Binance hacks.
Co-CEO Yi He said withdrawals should resume within 48 hours of her October 30 update. Bitcoin fell about 5% and traded below $77,000, and BNB lost about 7%.
The proof of reserves Binance published on October 1, 2026 listed the Binance 14 wallet, which means the stolen assets backed customer balances. On-chain estimates place ETH backing at about 94% after the loss, down from 100% on October 1. Binance scheduled its next reserve snapshot for November 1, and the result will show whether the exchange replaced the assets.
Isai Alexei is a journalist and financial analyst covering cryptocurrency markets and traditional securities for Blockchaindose. He has spent ten years analyzing digital assets, trading activity, and market structure.
