Binance $6.3B Hack EIP-7702 Delegation 2026-10-30

Lead: $6.3 billion — the largest single theft in crypto exchange history, using an unprecedented attack vector

Between UTC 20:20 and 23:36 on October 29, 2026, Binance's global hot wallets were systematically drained. Across 8 chains, assets worth approximately $6.28–6.3 billion were transferred out — the largest single theft in crypto exchange history. (The previous record was Binance's own 7,000 BTC hack in 2019, worth roughly $41 million at the time; this new breach is a 153x increase.) What makes it even more alarming is the method: the attackers did not break any private-key cryptography. Instead, they gained access to Binance's signing service by compromising a DevOps engineer's laptop, then leveraged the EIP-7702 delegation mechanism to make Binance's largest Ethereum hot wallet — Binance 14 — sign 50 type-4 transactions, permanently delegating its code-execution authority to a sweep contract deployed by the attacker. The entire attack, from signature delegation to a single $250 million ETH+USDT sweep transfer, took 3 minutes and 24 seconds. Blockaid's AI detection system raised an alert within 2 minutes of the sweep, confirmed the signature-authority hijacking and EIP-7702 delegation mechanism within 11 minutes, and flagged all attacker addresses as malicious within an hour. Binance's official statement puts the total impact at roughly $6.3 billion; in collaboration with on-chain partners, approximately $3 billion has been frozen (Tether $1.567B + Circle $822M + Ripple RLUSD + Paxos + World Liberty, etc.), leaving an estimated $3.27 billion in non-stablecoins (BTC, ETH, XRP, SOL, etc.) still freely transferable. Binance has fully suspended deposits and withdrawals, stating it will cover all losses from its SAFU fund and company capital, and that "user funds are safe."

Attack Timeline: 3 minutes 24 seconds — from EIP-7702 delegation to a single $250 million sweep

The attacker's technical path (cross-verified from multiple sources: Blockaid technical deep-dive UTC 02:30, ChainCatcher's Dickson Wu UTC 08:00, Binance progress statement UTC 10:00, all October 30):

1. Late UTC October 28 — Warm-up: The attacker's main wallet withdrew 0.1 ETH from Tornado Cash in three separate transactions — just enough to cover gas fees;
2. UTC October 29, 13:51–16:47 — Rehearsal: On three test wallets they controlled, the attackers ran through the full delegate-and-sweep sequence end-to-end, moving $2–$6 each time to test EIP-7702 delegation and the sweep function;
3. UTC October 29, 15:59 — Sweeper contract deployed: Contract address 0x63e8…6fAe, source code unverified, operator address pointing to the attacker. The contract carried a sweep() function (listing all tokens + ETH for one-click transfer + a forwarding function allowing the delegated account to call other contracts);
4. UTC October 29, 20:20:59 — The critical transaction: The attacker sent a type-4 transaction to Binance 14, which signed 50 EIP-7702 authorizations (nonces 18914775–18914824, a consecutive block of 50), all delegating authority to the sweeper contract. Forty-nine failed due to nonce expiration; one hit the current nonce, and the delegation took effect. At that moment, Binance 14 was still processing withdrawals normally — the signing system had no idea it had just handed code-execution authority to the attackers;
5. UTC October 29, 20:24:23 — Single $250 million outbound transfer: The operator called sweep(), and Binance 14 transferred 167,464 ETH + 161.5 million USDT + 61 token types = $250 million in a single transaction. Binance 14 was left with just 1 ETH;
6. UTC October 29, 20:24:47 – 21:00 — Multi-chain parallel drain: Twenty-four seconds later, Binance 16 signed and transferred out 9 transactions = $174 million (28,006 ETH + 55.7 million USDT + RLUSD, etc.); four Arbitrum hot wallets transferred 74.6 million ARB + 8,426 ETH; Avalanche sent 1.81 million AVAX + 841,000 USDT; Optimism's Binance 55 moved 44.2 million OP; on the Bitcoin chain, 11 transactions in the same block split 18,270 BTC across 19 new addresses (1,000 BTC each); TRON transferred 612.7 million USDT + 46.4 million TRX; XRP Ledger sent 233.5 million XRP; Solana moved 970,522 SOL;
7. UTC October 29, 21:01:35 – 23:36 — The stablecoin freeze battle + final sweep failure: Tether's first blacklist targeted address 0x5227 (containing 971 million USDT) at 21:01; Circle froze $822.6 million in USDC at 21:04; Tron-chain Tether froze 378.7 million USDT at 21:09; three minutes before Tether's freeze, the attackers had already split and sold 435 million USDT for ETH; Ripple froze $40.5 million in RLUSD at 22:00; the final sweep() call failed at 23:36 — Binance had already revoked the EIP-7702 authorizations.

Blockaid detection timeline: Alert raised within 2 minutes of the sweep (before any public report), "signature authority hijacking + EIP-7702 delegation mechanism" confirmed within 11 minutes, all attacker addresses flagged as malicious within an hour and pushed to every customer's Ecosystem Incidents Feed.

Stolen Asset Breakdown (Dickson Wu's complete 8-chain audit, UTC October 30, 08:00)

The on-chain audit by CertiK engineer Dickson Wu, published in full by ChainCatcher, is currently the most precise source for stolen-asset figures:

The Freeze Counter-Battle: $2.8 billion frozen, but $3.27 billion still freely transferable

Stablecoin issuers and Binance moved urgently to freeze whatever they could — but non-stablecoins were completely beyond their reach:

Tether's anti-freeze battle: Before Tether's first blacklist (at 21:01 targeting 0x5227 with 971 million USDT), the attacker had already split 200 million USDT to 0x0ddf…697e at 20:33. Of that, roughly $10 million was sold on DEXs, and $190 million was moved to 0x8d53…639a and deposited into Aave to borrow ETH. Circle froze $822.6 million in USDC at 21:04:59, but before Ripple froze RLUSD at 22:00, the attacker had already transferred $40.5 million RLUSD to 0xe702…958d and sold $48 million for ETH — the final sell order landed in the same block as Ripple's freeze.

Market Reaction: BNB down 10% in a day, Binance's platform alone accounts for $345 million in liquidations

Are User Funds Safe? Binance says SAFU + company capital covers everything; net loss roughly 0.69% of custodial assets

What was stolen was Binance's hot wallets — internet-connected wallets used to process user withdrawals quickly — not cold wallets or individual user accounts. Here's the chain of key assurances:

• Binance official statement: "We have not found any evidence of wallet private key leakage" (cryptographically, the keys were not broken; the attack happened at the signing-service permission layer);
• CZ's statement (UTC 21:15, ahead of the official release): "as a shareholder, I expect all user funds will be fully covered";
• He Yi's statement (co-founder): Confirmed Ripple has frozen $40.5 million in RLUSD; Binance is pursuing the attackers with full effort;
• Current SAFU fund status: Established in July 2018, last purchase completed in February 2026, fully converted to 15,000 BTC (≈ $1.2 billion at October 30, 2026 prices);
• Net loss estimate (DefiLlama founder 0xngmi): $6.28 billion total loss - $2.8 billion frozen = ≈ $3.48 billion unfrozen; but factoring in the likelihood of recovering some attacker assets later, Binance's full net loss is roughly $1 billion (0.69% of its $144–165 billion in custodial assets), which "Binance's balance sheet can easily absorb";
• Withdrawal suspension: Binance has fully suspended deposits and withdrawals (starting UTC October 30, 00:30), stating "will resume as soon as the security issue is fully resolved" — no specific timeline given.

Risk note: The suspension of withdrawals itself could amplify panic (during Bybit's $1.5 billion hack in 2025, it kept withdrawals open; the merits of each approach remain debated). No large-scale reports of individual accounts being frozen or user funds lost have surfaced so far, but Binance's full investigation is still ongoing.

Historical Comparison: Binance's three hacks grew 153x in size — attack methods evolved from phishing to supply chain

Growth trend: Binance's own three hack amounts: 2019 $41 million → 2023 BNB Chain $566 million → 2026 $6.3 billion (153x growth). Evolution of attack methods: phishing for user credentials → tampering multi-sig UI → supply chain / internal credentials → EIP-7702 delegation hijacking signature-key code-execution authority. Blockaid's report notes this was an attack at the level of "the person/system that tells the key what to do" — not the key cryptography itself, which remains secure to this day.

Regulatory Reaction: Silence across the board; only Circle CEO hints at law enforcement involvement

Following Binance's historic hack, the world's major regulators have been remarkably quiet:

Key Data Sources and Items Marked UNCONFIRMED

Data sources:

• Blockaid technical deep-dive (EIP-7702 delegation mechanism, timeline, detection timeline);
• ChainCatcher — Dickson Wu's complete 8-chain audit (most precise stolen-asset breakdown);
• France24/AFP live news (Binance full withdrawal suspension, Tether/Circle CEO freeze statements);
• Binance X account (21:16 draft → 21:24 wording deletion → 21:29 final "User funds are completely safe" → 22:15 → 23:06 → ~00:30 UTC announcement);
• CZ X account (UTC 21:15 first statement, ahead of official);
• Tether CEO X ($1.567 billion freeze statement);
• Circle CEO X ($823 million USDC freeze statement + "in coordination with law enforcement");
• 808bits EIP-7702 technical analysis.

Items marked UNCONFIRMED (no speculation whatsoever):

1. Attacker identity: ZachXBT speculates it could be the Lazarus Group (similar methods to Bybit 2025), but law enforcement agencies including the FBI and Interpol have not formally attributed responsibility — no judgment on any nation or organization;
2. Specific method of the DevOps engineer's laptop compromise: Binance only stated that "a DevOps engineer's laptop was compromised" — no details on whether it was a phishing email, Trojan, USB implant, or other means;
3. Final stolen amount: Binance's official estimate is $6.3 billion; on-chain analysts estimate $5.78–6.28 billion; figures are still evolving;
4. Scope of user impact: No large-scale cases of user accounts being frozen or individual funds lost have been found so far, but the withdrawal suspension remains in place;
5. Follow-up regulatory action: The SEC, CFTC, DOJ, etc. have not yet made public statements; whether investigations will follow is unclear;
6. Authenticity of "AI involvement in the attack": Media outlets (including NBC) claimed "AI may have been involved" around the same time as Binance's incident, but no technical evidence has been found; Forkast explicitly marked the AI angle as "unverified"
7. Whether Polymarket / Bitget / Binance 2026 attacks were carried out by the same attacker: Similar methods but no concrete evidence;
8. When Binance withdrawals will resume: Only stated "as soon as the security issue is fully resolved" — no specific timeline.

Data cutoff: Approximately 10:30 UTC on October 30, 2026 (18:30 Beijing time). Binance's full investigation is ongoing; a technical post-mortem report is expected to be released later.

Risk Notice and Promotion Disclosure: Binance's full suspension of deposits and withdrawals remains in effect, with no announcement on a specific resumption date. During the withdrawal suspension, there may be liquidity risks and a blow to user confidence. Information in this article is as of October 30, 2026; some figures (frozen amounts, stolen-asset breakdown, net loss) are still being updated. Items explicitly marked UNCONFIRMED are not the subject of speculation or guesswork. This article contains promotional links. We may earn a commission if you sign up through these links — this does not increase the fee you pay, nor does it affect the judgment in this article.