We analyzed this claim: is it true that
one security breach at Binance let an attacker produce genuine transfer approvals across ten separate blockchain networks?
records confirm withdrawals occurred across ten networks, but Binance has not proven how its approval system failed
How One Breach Emptied Ten Blockchains
A single digital intrusion bypassed security across multiple payment networks.
Updates
- 30 October 2026Chainalysis confirms a minimum theft estimate of $5.912 billion while withholding a root-cause conclusion — #1 should distinguish Chainalysis's confirmed observed theft from attribution based partly on intelligence not disclosed publicly; #2 must preserve its statement that the exact cause remains under investigation rather than presenting the DevOps-laptop hypothesis as a completed forensic conclusion. Source: https://www.reuters.com/legal/government/view-analysts-react-binance-freezes-assets-after-63-billion-security-breach-2026-10-30/ ↗
In a nutshell
An attacker took roughly $6.3 billion from Binance hot wallets across ten independent blockchain networks by generating valid digital approvals. The incident began on October 29 and involved both automated script permissions on Ethereum and ordinary signed transfers on networks like Bitcoin and Solana. Stablecoin issuers and emergency councils helped freeze more than $2.5 billion, while Binance paused withdrawals to contain the damage. Binance reported that a compromised staff laptop may have let the intruder reach an internal transaction system, but it has not yet explained how that access allowed valid approvals across so many separate networks.
Highlights
- An attacker drained roughly $6.3 billion from Binance hot wallets across ten separate blockchain networks.
- Binance linked the intrusion to an engineer's compromised laptop that accessed an internal software service.
- Stablecoin issuers and network controllers intervened to freeze more than $2.5 billion in stolen tokens.
- Binance temporarily halted customer withdrawals while overhauling its transaction approval systems.
From the Editor’s Diary
Independent security networks are only as strong as the centralized systems that feed them. When an internal approval tool fails, technical separation between blockchains cannot prevent a breach.
Who's involved
Binance
The world's largest cryptocurrency exchange, which holds customer digital funds in online wallets
goal → Discover how the intruder entered, halt unauthorized transactions, protect customer funds, and restore normal withdrawals
Unidentified attacker or attackers
The people who directed the malicious computer code and took funds across multiple networks
goal → Secure the stolen digital money before companies or authorities can freeze the accounts
Blockaid
A digital security firm that tracks suspicious activity across online networks
goal → Spot the attack methods quickly, warn users, and design defenses to block similar thefts
TRM Labs
A firm that investigates and traces illicit cryptocurrency movements
goal → Map the full path of the stolen funds across networks and identify who carried out the theft
Bitquery
A data company that tracks and analyzes transactions recorded on public digital ledgers
goal → Document which wallets lost funds, verify transaction records, and calculate how much money remains frozen
Tether and Circle
Companies that issue dollar-pegged digital coins, USDT and USDC
goal → Freeze stolen digital tokens held in attacker accounts to save recoverable customer money
Arbitrum Security Council
An emergency governance committee with administrative control over the Arbitrum network
goal → Move stolen assets into a secure emergency wallet to prevent the thief from keeping them
Binance customers
Individuals and institutions who hold digital money in the exchange
goal → Keep their money safe and regain the ability to take their funds out of the platform
In short
The central discovery is that a single point of failure breached ten independent payment networks at once. This matters because cryptocurrency systems are supposed to operate separately, so a flaw in one network cannot compromise another.
The most likely immediate outcome is that Binance will overhaul how it approves customer withdrawals before letting users access their money again.
That outcome is likely, because the company has paused all withdrawals while it rewrites its security rules. It remains uncertain whether the underlying problem lay in stolen keys or in an approval program that was tricked into signing bad requests.
How it unfolded
A Small Transaction Begins the Attack
The earliest sign of preparation occurred on October 28, when an online wallet linked to the theft received a tiny transfer from Tornado Cash, a service designed to hide the origin of digital money. The first public alert arrived the following night from independent researcher Spreek, shortly after millions of dollars moved out of Binance. Security company Blockaid stated that its private software spotted the suspicious outflow minutes before the public alert.
The Intruder Tests Code on Ethereum
The thief spent hours rehearsing the theft on test accounts. They developed a small software program designed to transfer assets out of a wallet automatically once given authorization. Because the target was a busy Binance account whose internal counter updated constantly, the attacker needed a program that would work despite that constant activity.
Valid Approvals Spread Across Multiple Networks
The theft spread across distinct networks rather than staying on one. It started on the XRP Ledger, then hit Binance wallets on Solana, Bitcoin, and Tron. On Ethereum, the thief sent 50 permission slips to the wallet, and one matched its exact activity counter, letting the malicious code take control and sweep out hundreds of millions of dollars without needing separate signatures for each transfer.
Ordinary Transfers Show a Wider Control Failure
Seconds after the first Ethereum sweep, another Binance Ethereum wallet sent out funds through a standard signed transfer, without using automated code delegation. Wallets on other blockchains did the same. These plain transactions show the problem was bigger than a single Ethereum trick: the attacker had gained the power to issue genuine transfer approvals across separate networks.
Defenses Scramble to Contain Losses
As stolen assets moved, stablecoin companies stepped in. Tether and Circle locked digital dollar tokens held in the attacker's addresses, stopping them from moving further. Binance paused customer withdrawals to prevent new losses, though that pause did not immediately disable the attacker's code on Ethereum, which kept draining new deposits for several hours.
Binance Probes Laptop Entry Point
Binance reported that an engineer's laptop might have let an intruder reach an internal software package used to handle withdrawals. If true, the thief did not need to steal private keys directly; they simply told a legitimate approval system to sign bad transactions. The exchange said it found no proof that secret keys were stolen, but it has yet to share how the internal software was tricked.
We checked again
No new developments at this moment.
Checked Reuters' October 30 report quoting Chainalysis, Binance's official security update, Associated Press coverage and independent blockchain investigations; no material development dated after 2026-10-30 was found, and the requested update window has not yet begun.
Where things stand
The core event is established: an attacker used genuine digital approvals to take billions of dollars from Binance across several independent networks. Binance believes an engineer's work laptop gave the intruder access to an internal software tool that creates withdrawals.
What remains unknown is the exact technical path the attacker took. Public transaction records show that approvals were valid, but they cannot show whether the secret keys were stolen or if a legitimate signing tool was simply fed fraudulent withdrawal orders. Binance has promised a full technical review while it works to restore normal customer services.
Binance $6.3B hack
Freezing Stolen Crypto Proves Easier Than Returning It
30 October 2026Stopping billions in stolen digital coins halts the thief but leaves victims waiting on complex legal returns.
North Korea Clues Mount in Huge Binance Theft
30 October 2026Clues point to North Korean hackers in a massive crypto theft, but public proof remains out of reach.
Binance faces $6.3 billion breach as stablecoin use grows
30 October 2026Visa reported surging payment volumes in dollar-pegged tokens just before the world's biggest crypto exchange suffered a record-scale security incident.
Sources
- Ethereum Improvement Proposals, EIP-7702 specification
- Ethereum Foundation, Pectra mainnet announcement and EIP-7702 explanation
- Ethereum.org, Pectra activation record
- Blockaid, preparation, nonce spraying, contract delegation, ordinary signatures and monitoring response
- Ondology Labs, Ethereum contract deployment, test-wallet activity and transaction reconstruction
- Decrypt, early Ethereum, Bitcoin and Tron transaction analysis
- The Block, independent reporting on suspicious transfers and public investigator findings