Binance Says No Private Keys Leaked. Its Own Hot Wallets Signed the $6.3 Billion Theft.

3:20 PM Central

At 3:20:59 PM Central on Thursday, October 29, 2026, a single Ethereum transaction landed in block 26,300,753. It was sent by an address nobody at Binance owned. It was addressed to one of Binance's busiest hot wallets, the account block explorers label Binance 14. And it carried fifty signatures made with Binance 14's own key.

Each signature said the same thing: from now on, when anyone calls this account, run the code at address 0x63e842B0. Each was made for a different transaction counter, fifty consecutive numbers from 18,914,775 to 18,914,824, so that whichever one happened to match the wallet's live counter when the transaction arrived would take effect. One did. The other forty-nine were spares.

Three minutes and twenty-four seconds later, at 3:24:23 PM, the outside address called Binance 14 once. The wallet, now running borrowed code, emptied itself: 167,464 ETH and 63 token balances, among them 1.615 billion USDT, moved in one transaction to a wallet the attacker controlled. Twenty-four seconds after that, a second Binance hot wallet, Binance 16, signed nine ordinary transfers of its own to the same destination, including 28,005.6 ETH. At 3:41 PM, Binance 14's borrowed code was used to tell a third Binance wallet, a smart-contract account, to release 780 million USDC. It did.

By the time Binance said "all deposits and withdrawals are temporarily suspended," at 7:13 PM Central, TRM Labs counts about $6.36 billion moved out of Binance wallets on ten blockchains. It is the largest theft of digital assets on record, roughly four times the $1.5 billion taken from Bybit in February 2025. TRM attributes it, with high confidence, to TraderTraitor, the North Korean unit the FBI blamed for Bybit.

Binance's explanation, published early October 30 UTC (Thursday night in Central time), is that "a compromised DevOps engineer's laptop" may have let an attacker reach "a service container" that could "submit unauthorized withdrawal transactions." It adds that it has found no evidence that wallet private keys were leaked.

That sentence is probably true. It is also the story.

The attacker did not need Binance's keys. It needed something that would use them on request, and Binance had built one. The signatures on the theft are Binance's. The machine that produced them did exactly what it was designed to do: sign what the withdrawal service submitted. It signed a delegation that hands a wallet to an outsider, a transaction type that is not a withdrawal at all. It signed it fifty times over, in advance. Hot wallets on nine other chains made ordinary signed transfers to attacker addresses, most of them within the same forty minutes, with later waves into the evening. The laptop is how someone got to the front of the line. The signer is why the line went anywhere.

And the door was described in public. The FBI, CISA and Treasury told the industry in April 2022 that North Korean operators were targeting crypto company employees, especially those in DevOps, IT and system administration roles, with fake recruiter approaches. The FBI and Japan's National Police Agency told it again in December 2024 that the same unit had compromised a wallet-software engineer and used that access "to manipulate a legitimate transaction request." On October 27, 2026, two days before the theft, Binance itself said it had blocked North Korean fake-interview attacks aimed at its developers and engineers, with no losses.

What we verified, and what the first reports got wrong

Blockchains are the one place in a breach where the victim's ledger is public. Between 2:00 and 2:20 AM Central on October 30, Cloudskope read the key transactions directly from public Ethereum, Bitcoin and Tron nodes and indexers. We did not contact Binance's systems or any address associated with the attacker. The commands, block numbers and full transaction hashes are in our evidence file, and the facts page is here.

• The delegation. Transaction 0xad99264d...051298b is a type-4 (EIP-7702) transaction in block 26,300,753, timestamped 3:20:59 PM Central. Its authorization list holds exactly 50 entries, nonces 18,914,775 through 18,914,824, every one delegating Binance 14 to the same contract, 0x63e842B054Bd624a465454D533C33F573e9c6fAe. It was sent and paid for by the attacker's address, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0. It succeeded. The contract it points to is 1,675 bytes of unverified code.
• The sweep. Transaction 0x53bd38b8...e88e2f3, block 26,300,770, 3:24:23 PM Central, was sent by the same attacker address to Binance 14 and produced 63 token transfers into the attacker's collection wallet, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c.
• The second key. Binance 16, a separate hot wallet that was not delegated, sent nine ordinary signed transactions to the same collection wallet at 3:24:47 PM, including 28,005.6 ETH, 84.5 wrapped BTC and 55.7 million USDT. Those are not borrowed-code calls. They are standard transfers signed with Binance 16's key.
• The third wallet. At 3:41:23 PM, the attacker called Binance 14 again; the call caused a Binance smart-contract wallet, 0xEe7aE85f, to transfer exactly 780,000,000 USDC to the collection wallet. Binance 14 had standing permission to instruct that wallet. The delegation inherited it.
• Bitcoin. The attacker's Bitcoin address received 18,270.2 BTC in eleven transactions from a single Binance hot-wallet address, all in block 973,732, mined at 3:20:06 PM Central. Five onward transactions spent most of it in the same block; the last 437.7 BTC left at 3:48 PM. The receiving address is now empty.
• Tron. The attacker's Tron address received 612,729,468 USDT at 3:22:45 PM and sent 300 million onward within 34 minutes. The 312,729,468 USDT left behind is frozen: Tether's contract returns true for that address on its blacklist check.
• The freezes. On Ethereum, the collection wallet is blacklisted by both Tether and Circle and holds 1,175,464,712.88 USDT and exactly 823,000,000 USDC that cannot move. The attacker's operator address, the one that paid for every step, is on neither blacklist.
• The revocation. Binance cleared the delegation at 7:10:35 PM Central (block 26,301,896) by having Binance 14 sign a new authorization pointing to the zero address. That is 3 hours, 49 minutes and 36 seconds after the attacker installed it. As of 2:04 AM Central, Binance 14 carries no delegated code.
• The wallet kept working. Ordinary outgoing transfers from Binance 14, dozens of USDT and USDC payments to many different addresses, continued for roughly thirteen minutes after the delegation took effect, and successful ones continued sporadically until 4:45 PM. Their pattern looks like the exchange's normal withdrawal flow. That is our inference; Binance has not said.
• Binance's own wallet is on the blacklist. Both Tether and Circle have blacklisted Binance 14 itself. Between 5:15 PM Central on October 29 and 2:02 AM on October 30, Binance 14 sent 208 transactions that failed, averaging one every two to three minutes and about one every six minutes by early Friday. Among them: repeated attempts to move nearly all of its remaining 1.35 million USDT to the wallet labeled Binance 8. Tether's contract refuses each one.

What we could not verify: the total. TRM says $6.36 billion; CertiK engineer Dickson Wu, compiling chain by chain across eight chains, says $6.28 billion; Glassnode, quoted by Investing.com on Thursday evening, said $5.3 billion; Coinbase's Conor Grogan, quoted by The Block, said up to $5.8 billion. We checked the legs listed above, not the XRP, Solana, Arbitrum, Optimism, Avalanche, Polygon or Base legs. We cannot test the laptop, the container, the attribution, or Binance's statement about keys.

What the first reports got wrong was mostly scale, and that is forgivable on a night when the number was still moving. TechCrunch's 3:27 PM Pacific story cited "at least $2 billion" from crypto watchers and put Bybit's 2025 loss at $1.4 billion; the FBI's figure is $1.5 billion. The more consequential problem was the word Binance used for hours: "potential." When The Block published at 4:48 PM Central, it quoted Yi He, Binance's co-founder: "We are aware of reports of a potential security issue and we are actively investigating." Circle had frozen 823 million USDC of the proceeds 44 minutes earlier. Binance's spokesperson gave TechCrunch the same line, and said user funds were safe, in a story published at 5:27 PM Central.

Fifty signatures for one transaction

A board does not need to read Solidity to understand what happened at 3:20 PM. It needs one concept.

Since May 2025, when Ethereum's Pectra upgrade activated a change called EIP-7702, an ordinary Ethereum account can sign a short message that says: my account now runs this program. The message names a chain, a program address and the account's transaction counter (its nonce). Anyone can then submit that message to the network on the account's behalf. Once accepted, the delegation persists until the account signs another message pointing somewhere else. It was built so that consumer wallets could batch payments and let someone else pay the fees. It was abused almost immediately: within a month of activation, Wintermute reported that more than 80% of EIP-7702 delegations on Ethereum were tied to a single malicious sweeper script, which it nicknamed CrimeEnjoyor. It also means that one signature, the right one, converts a wallet into something whose behavior is decided by whoever wrote the program.

The program here was written by the attacker. According to the analysis published by the researcher drk, it was compiled with Solidity 0.8.28, accepts instructions from exactly one caller, the attacker's address, and exposes a sweep function (move these tokens to that address) plus a path that relays calls through Binance 14 to other wallets that trust it. The researcher's reconstruction, which matches the transactions we read, has the attacker deploying a first version at 9:28 PM Central on October 28, rehearsing it twice on test accounts on October 29 at 8:51 AM and 11:25 AM, deploying the final version at 10:59 AM, and topping up its gas account with 1.08 ETH at 1:20 PM. About two hours before the theft, everything was in place except Binance's signature.

The fifty nonces are the tell. A thief holding a raw private key does not need fifty versions of the same message. It reads the wallet's current counter and signs once. A party that must ask someone else's system to produce the signature, and cannot be sure when it will land relative to the exchange's own outgoing traffic, asks for a range. Binance 14 is one of the busiest accounts on Ethereum; its counter moves every few seconds when withdrawals are flowing. The authorization that took effect was number 18,914,809, the thirty-fifth in the bracket. The drk analysis draws the same inference we do: this looks like access to Binance's signing path rather than possession of a key. Binance's own statement, that a service container could "submit unauthorized withdrawal transactions," says the same thing in its own words.

The question every institution with an automated signer should take from this is not about crypto. It is about policy. Did Binance's signing service have a rule that said never sign a delegation? Did it have a rule that said never sign fifty of anything at once? Did it have a rule that said never sign a payment to an address with no history? On the evidence of the chain, at 3:20 PM it had none of those that held. Binance has not said what its signing policy is, and until its post-mortem appears, nobody outside can say which control was missing and which was bypassed.

The other nine chains

EIP-7702 is an Ethereum feature. It explains one wallet. It does not explain the other nine blockchains, where TRM records ordinary signed transfers out of Binance hot wallets in the same window, beginning with five XRP Ledger wallets at 3:05 PM Central, fifteen minutes before the Ethereum delegation.

CertiK's Dickson Wu, who works with the Security Alliance (SEAL) incident network, posted a minute-by-minute reconstruction early on October 30. Its opening detail is the most human moment in the record. At 3:04:52 PM Central, a Binance XRP wallet sent 42,750,000.1 RLUSD to the attacker's XRP address, and the network bounced it: the destination account did not exist yet. Eight seconds later a second transfer, 185,017,485.5 XRP, created the account. The attacker had not pre-funded its own address on that ledger. The operation was rehearsed on Ethereum; on XRP, it was improvised.

Then, on Wu's timeline, Solana at 3:10 PM, 965,455 SOL in a single transaction. Optimism at about 3:18 PM. Bitcoin at 3:20:06 PM, 18,270.2 BTC in eleven transactions ranging from about 20 to 7,637 BTC, all confirmed in one block, which we verified. Tron at 3:22:45 PM. Arbitrum and Avalanche later in the afternoon, with Avalanche and Polygon wallets drained again around 6:05 PM, by TRM's count.

Every one of those is a transfer that a Binance key signed. TRM's assessment is that the most likely cause is compromise of Binance's hot-wallet signing infrastructure. Binance's answer, that the keys did not leak, does not contradict that. It confirms which layer failed.

The wallet kept paying out after it belonged to someone else

One fact on the chain has not been reported anywhere we have read.

For about thirteen minutes after 3:20:59 PM, Binance 14 kept doing its day job. Between 3:21 and 3:34 PM Central, the wallet sent dozens of ordinary USDT and USDC transfers to dozens of different addresses, the pattern of an exchange paying out withdrawals. Successful ordinary transfers continued sporadically until 4:45 PM. Under EIP-7702, a delegated account can still sign normal transactions, so nothing about those payments was impossible. What they show is that the exchange's withdrawal engine did not know, or did not act on the fact, that the wallet it was paying from had been handed to someone else.

The delegation was undone at 7:10:35 PM Central, when Binance 14 signed a new authorization to the zero address. Between installation and removal: 3 hours, 49 minutes, 36 seconds. On-chain monitoring that alerts on a code change at a treasury address is not exotic. TRM's own recommendation to exchanges this week is to monitor treasury wallets for EIP-7702 delegations and reject unexpected authorizations. A type-4 transaction touching one of an exchange's busiest hot wallets is exactly the kind of event that commercial blockchain-monitoring tools exist to flag. Whether Binance had that alert, and what happened to it, is a question only Binance can answer.

There is a coda. At 5:06 PM Central, by CertiK engineer Dickson Wu's timeline, Tether added Binance 14 itself to its blacklist. Nine minutes later, Binance 14 began sending transactions that fail. By 2:02 AM on October 30 there were 208 of them, coming about every six minutes by then, many trying to move nearly all of the wallet's remaining 1.35 million USDT to another Binance wallet. Each costs a fee. Each is refused. It is a small thing beside $6.3 billion. It is also what a system looks like when its operators have not yet turned it off.

Binance's own words, read in order

Binance has published no incident page that we could find, no timeline, no list of affected networks, and no address list. What exists is a sequence of short statements across X, Binance Square and spokespeople, reported by the outlets that captured them. Read in order, they describe an exchange learning about its own incident from the outside.

4:48 PM Central, October 29 (The Block). Yi He, Binance's co-founder: "We are aware of reports of a potential security issue and we are actively investigating." By then, by TRM's timeline, the Ethereum hot wallet had been swept repeatedly, Bitcoin, Tron, XRP and Solana had been drained, and Tether and Circle had started freezing. "Reports" is the word for what Binance had. Researchers on X, the analyst known as Spreek among the first, had seen the flows before Binance said anything.

Same evening (The Block, Investing.com, TechCrunch). Changpeng Zhao, the founder, who pleaded guilty in 2023, was pardoned in October 2025 and no longer runs the exchange but remains its largest shareholder: "It does look like a hack on Binance," and "I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." The most useful public confirmation that the exchange had been robbed came from a person who says he does not manage it.

5:15 PM Central (FinanceFeeds). Withdrawals halted on Binance's side, by FinanceFeeds' account. Cointelegraph's live log places a Binance statement about security checks at 5:32 PM; Investing.com quotes the statement: "Withdrawals will resume as soon as the security issue is fully resolved." A spokesperson, Ross O'Leary, told TechCrunch it had "temporarily suspended withdrawals on multiple networks" as a precaution.

7:07 PM Central. "We are working around the clock and will share a full post-mortem once the investigation is complete," and Binance will "cover all losses," per Cointelegraph.

7:13 PM Central. "all deposits and withdrawals are temporarily suspended," per FinanceFeeds. Deposits were later said to be unaffected.

Late Thursday Central, dated October 30 (Binance News on Binance Square, and the @binance account on X). The substantive statement. A compromised DevOps engineer's laptop "may have enabled an attacker" to reach a service container and submit unauthorized withdrawals. No evidence that private keys leaked. Estimated impact about $6.3 billion, about $3 billion frozen. Losses to be covered from the SAFU fund and corporate funds. Authorization for the affected address revoked. A technical post-mortem and an updated Proof of Reserves to follow. A later update, reported by CyberInsider, says "multiple factors" contributed.

11:17 PM Central, October 29 (per FinanceFeeds, timed 04:17 UTC October 30). Yi He: Binance expects to "begin resume withdrawal services in the next 48 hours," deposits "remain unaffected," and the team is "working on enhancements to the withdrawal service and related address controls."

Now read what those statements do not contain.

• No start time. Binance has not said when the laptop was compromised, when the attacker reached the container, or how long it was there. The chain shows the attacker's operator wallet funded from Tornado Cash beginning at 2:39 AM Central on October 28, and its first contract deployed at 9:28 PM Central that night. That is at least 36 hours of visible preparation. The intrusion itself is older than its first on-chain trace.
• No mechanism past the container. "Submit unauthorized withdrawal transactions" does not describe signing an EIP-7702 delegation, which is not a withdrawal. It does not explain why one submission yielded fifty signed authorizations. It does not say whether the container called a signing service, held key shares, or something else.
• No networks, no addresses, no amounts by chain. TRM, CertiK's engineer and the researcher drk have published more about Binance's wallets in a day than Binance has.
• No customer count. Binance says user funds are safe because it will cover the loss. It has not said whether any customer balances were debited, or whether users who sent withdrawals between 3:05 and 5:15 PM Central received them.
• No regulator. Binance has not said which supervisors it notified, in which jurisdictions, or when.
• No word on the people. The statement names a DevOps engineer. It does not say whether the compromise began, as every prior TraderTraitor case did, with a recruiter, a coding test or a chat message.

And one phrase should be read precisely: "user funds are safe." The phrase has carried two meanings since Thursday. In the first statements it meant nothing happened to you. In the later statement it means we will pay for what happened. The second is a solvency claim about an exchange that just lost about $6.3 billion, and it is only as good as the balance sheet behind it.

Two days earlier

On October 27, two days before the theft, Binance's security team published a notice that it had blocked multiple North Korea-linked attacks in the previous week, a social engineering campaign the industry calls Contagious Interview, aimed at developers and engineers through fake job interviews, coding tests and requests to install development tools. Per the summaries that circulated (we could not locate Binance's original post), the attacks "did not cause damage to its systems nor result in any loss of user or platform assets."

We are not saying that notice was false. It may have been entirely accurate about the attacks Binance saw. We are saying that the most consequential sentence an exchange can publish about North Korean social engineering is not we blocked it this week. It is here is what a single engineer's laptop can reach. On October 29, according to Binance, one could reach a container that could get Binance's keys to sign whatever it submitted.

Binance has also not said whether the engineer whose laptop was compromised was among the targets of the campaign it described on October 27. That is a question with a yes-or-no answer.

The freeze worked where someone could freeze

The largest theft on record is also, so far, the largest freeze of stolen funds we know of, and the reason is specific.

About $2.7 billion was frozen by 7:30 PM Central on October 29 by TRM's count, and about $3 billion by Binance's, and almost all of it was money that had an issuer. Tether froze about 1.77 billion USDT across Ethereum, Tron, Avalanche and Polygon. Circle froze 823 million USDC in a single action at 4:04 PM Central and later more, about 825 million in total. Ripple froze 40.5 million RLUSD. World Liberty Financial froze 27.8 million USD1. Paxos froze 1,907 ounces' worth of PAXG. Each of those tokens is a database entry maintained by a company that can decline to honor it. Arbitrum's Security Council, a governance body with emergency powers over that network, forced 8,426 ETH and 74.6 million ARB out of the attacker's control at 7:08 PM Central, about $30 million, an intervention that will be argued about for years. Aave froze the affected lending markets so the attacker could not borrow against stolen collateral.

What could not be frozen was what had no issuer. By TRM's count the attacker still controls more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach. TRM saw about 325 million USDT sold through UniswapX and intent-based contracts for about 122,300 ETH at a discount of more than ten percent, 60 million USDT posted to Aave as collateral to borrow about 19,760 ETH, and 300 million USDT routed to Tron's JustLend before Tether could act. The attacker moved first on exactly the assets that someone could stop. TRM expects the rest to go through bridges, swap services and over-the-counter brokers, the same path Bybit's $1.5 billion took in 2025.

For a regulated institution, the lesson in that split is not ideological. Dollar tokens with an issuer who can freeze them behaved, on Thursday, like wire transfers that a correspondent bank recalls. Native assets behaved like cash in a duffel bag. A treasury or a fund that holds digital assets should know, for each holding, which of the two it is.

How much was hot

Every exchange keeps some assets in hot wallets, online and signing automatically, so that withdrawals clear in minutes. The rest sits in cold storage behind slower, human-gated processes. The ratio is a risk decision, and it is one of the least disclosed numbers in the industry.

Binance has been here before. On May 7, 2019, an attacker withdrew more than 7,000 BTC from Binance's Bitcoin hot wallet in a single transaction. Changpeng Zhao, then CEO, wrote that the hackers "had the patience to wait" and that the affected hot wallet held about two percent of Binance's total BTC holdings. The SAFU fund, created in 2018 for exactly that purpose, covered the loss.

On Thursday, one Binance Bitcoin hot-wallet address handed over 18,270.2 BTC, about $1.47 billion by TRM's valuation (about $1.44 billion at Thursday evening's price), in eleven transactions confirmed in a single block. Binance 14, a single Ethereum hot wallet, held 167,464 ETH and more than 1.6 billion USDT at the moment it was swept. A separate smart-contract hot wallet held at least 780 million USDC. We do not know Binance's total holdings or its hot-to-cold ratio, and Binance has not said. We do know the absolute size of what sat online and signable: roughly $6.3 billion across ten chains, in wallets that a container could ask to sign.

The backstop has a size too. Binance finished converting the SAFU fund to bitcoin on February 12, 2026, when it reached 15,000 BTC, about $1.0 billion at the time. Binance said then that if the fund's market value falls below $800 million it will rebalance to restore $1 billion. At Thursday's bitcoin price of about $78,700, 15,000 BTC is worth about $1.18 billion. About $6.3 billion lost, less the roughly $3 billion Binance says is frozen, leaves about $3.3 billion. SAFU covers about a third of that. The rest, Binance says, comes from corporate funds. Binance is a private company; its corporate balance sheet is not public. The updated Proof of Reserves it has promised will show customer liabilities against assets. It will not, by design, show whether Binance can absorb $3.3 billion without consequence.

The market priced that uncertainty on Thursday night. BNB, Binance's own token, fell about 7% to $706.51 by Investing.com's count. Bitcoin fell 3.2%.

This attack is ten years old

Strip away the tokens and the chain names and Thursday's theft has a familiar shape: get inside the institution, then make the institution's own payment system send the money. North Korea has run that play against financial institutions for a decade, and each time the public record afterward said, in plain language, how it was done.

February 2016, Bangladesh Bank. Operators later charged by the U.S. Justice Department as part of a North Korean government conspiracy got into the central bank's network and used its own SWIFT connection to send payment instructions to the Federal Reserve Bank of New York. About $81 million reached accounts in the Philippines. The messages were authentic in the only sense the system checked: they came from the bank's own terminal. Assistant Attorney General John Demers said in 2018 that the complaint alleged the North Korean government had "robbed a central bank and citizens of other nations."

April 2022, the federal advisory. The FBI, CISA and Treasury published joint advisory AA22-108A on TraderTraitor. It described phishing messages over LinkedIn, Slack and Telegram, posing as recruiters, aimed at crypto company employees, "especially those in DevOps, IT, or system admin roles," per Wiz's summary of the advisory, delivering trojanized applications. The techniques it catalogued (phishing via service, T1566.003; user execution, T1204.002; code signing abuse, T1553.002) are the ones every incident since has repeated.

July 2023, JumpCloud. The same unit compromised an identity provider through spear-phishing, then used the vendor's privileged access to push malicious commands to a handful of its crypto customers. Mandiant attributed it. The lesson was that a trusted administrative channel delivers whatever is put into it.

May 2024, DMM Bitcoin. In December 2024 the FBI, the Defense Department's Cyber Crime Center and Japan's National Police Agency said TraderTraitor had approached an employee of Ginco, DMM's wallet-software vendor, on LinkedIn posing as a recruiter, sent a pre-employment coding test on GitHub, and compromised the employee's computer. The actors "exploited session cookie information to impersonate the compromised employee" and "likely used this access to manipulate a legitimate transaction request by a DMM employee." The loss was 4,502.9 BTC, then about $308 million.

February 2025, Bybit. A developer workstation at Safe{Wallet}, the multi-signature wallet Bybit used, was compromised through a malicious application. The attackers used AWS session tokens taken from it, which bypassed multi-factor authentication, to alter the JavaScript Bybit's signers loaded. The signers approved what their screens showed them. The FBI attributed the $1.5 billion theft to TraderTraitor on February 26, 2025. Cloudskope's record of Bybit summarized it then: the private keys were never broken; the attackers compromised what the signers saw.

October 2026, Binance. A DevOps engineer's laptop. A container that could submit transactions. A signer that signed them. If TRM is right about the actor, the same unit has now taken, in the three exchange thefts above spanning 29 months, more than $8.1 billion at the time of each theft, every one through a person's computer and an automated or semi-automated approval path, and never once by breaking cryptography.

The fix has been public as long as the pattern. It is not a product. It is three rules. First, the systems that hold signing authority accept instructions only from a narrow set of hardened, monitored, non-developer endpoints, and nobody's everyday laptop is one of them. Second, the signer enforces policy itself, on the transaction it is asked to sign, without trusting the system that asked: allowed transaction types, allowed destinations, rate and value limits, and a human for anything outside them. Third, the institution watches its own wallets the way an attacker does, and pulls the plug in minutes, not hours. Bybit's signers had a human in the loop and the humans were deceived. Binance, on the chain's evidence, had a loop with no human in it.

Why this matters to a bank that will never touch crypto

Cloudskope advises banks, credit unions, CPA firms and wealth managers that have no exposure to Binance at all. This is the incident they should study this quarter, for one reason: the architecture is theirs.

A modern payment operation is a signer behind a queue. A wire room releases payments that an upstream system has staged. An ACH origination platform transmits files that an integration has built. A treasury management portal approves transfers that a client-side workflow has prepared. A payments hub, the kind of shared infrastructure an extortion group claimed this month to have breached at the bank payments vendor Finzly, as American Banker reported on October 20 (a claim that remains unverified), sits between dozens of banks and the rails. In every one of those, the question Binance's incident poses is the same: if an attacker controls the thing that submits, what does the thing that signs refuse to do?

The honest answer at many institutions is less than the board assumes. Dual control often lives in the user interface, which is what Bybit's attackers rewrote. Velocity limits are often configured per user, not per system account, and the system account is what an integration runs as. Allowed-beneficiary lists exist for consumers and not for the automated sweep that moves corporate cash between correspondent accounts. And the release service, the one that holds the HSM credentials or the SWIFT keys, trusts its upstream because that is how it was built to be fast.

DPRK operators have now done this, by the Justice Department's account, through a central bank's SWIFT terminal, and by the FBI's account, through a wallet vendor's engineer and a multi-signature interface, and now, by Binance's own account, through a container. The only thing that changes is the rail.

What Binance should have done by now

Set aside whether the theft could have been prevented. What is not hard is what an exchange that holds other people's money should say in the 24 hours after it loses $6.3 billion.

1. Publish an incident page with a timeline. When the attacker gained access, when the first unauthorized transaction was signed, when Binance detected it, when each network was halted, and when the Ethereum delegation was revoked. The chain already shows the last of those: 7:10:35 PM Central, 3 hours, 49 minutes and 36 seconds after it was installed. Binance should explain the gap.
2. Publish the affected addresses and amounts by chain. Third parties have already done it. Binance confirming them helps every exchange, market maker and bridge that is screening deposits right now, which is exactly what the FBI asked of the industry after Bybit.
3. State what the container could do. Did it call a signing service, or hold key material? Was there any policy layer between it and the signer? Why did one submission produce fifty signed EIP-7702 authorizations, a transaction type that is not a withdrawal?
4. State whether any customer was harmed. Were any withdrawals submitted between 3:05 and 5:15 PM Central lost, delayed or misdirected? Were any customer balances debited?
5. Connect or disconnect the October 27 notice. Was the compromised engineer a target of the Contagious Interview campaign Binance said it had blocked two days earlier?
6. Say who it has told. Which regulators, in which jurisdictions, and when. Binance operates licensed entities in multiple countries and has said it is working with law enforcement. The list of supervisors is not a secret.
7. Show the balance sheet behind the promise. SAFU is worth about $1.18 billion at Thursday's price. Binance's $6.3 billion estimate, less the roughly $3 billion it says is frozen, leaves about $3.3 billion. An updated Proof of Reserves shows assets against customer liabilities. It does not show who absorbs the gap. A statement from the board, or an independent attestation of the corporate funds committed, would.

Seven things. The post-mortem Binance has promised may answer most of them. Until it does, the public account of the largest theft in the history of digital assets is a Binance Square post, a co-founder's update on X, and the blockchain.

What boards should be asking this week

For boards of institutions with any digital-asset exposure (exchange accounts, custodial relationships, fund investments, treasury holdings, collateral posted for derivatives), five questions for Monday.

First, what did we have on Binance on Thursday at 3:00 PM Central, in which entity, and what is its status now? If the answer requires a phone call to find out, that is the first finding.

Second, for each digital-asset counterparty we use, what share of our assets sits in hot wallets, and who decided that? Most institutions do not know, because most counterparties do not say.

Third, which of our holdings have an issuer who can freeze and reissue (USDC, USDT, RLUSD, tokenized treasuries) and which do not? On Thursday that line separated money that was recovered from money that was not.

For every institution, digital assets or not, two more.

Fourth, for every system in our company that signs or releases payments automatically (wire release, ACH origination, treasury sweeps, card settlement, payroll), what does the signer itself refuse to sign, regardless of what the upstream system asks? Ask for the list, not the description. If the answer is "the upstream system checks that," the answer is nothing.

Fifth, which of our engineers and administrators can reach that upstream system from the laptop they use for email, chat and job-site messages? Binance's own October 27 notice describes multiple fake-interview attacks on its engineers in a single week. The question is not whether they will reach one of our engineers. It is what that engineer's laptop can reach when they do.

For sponsors, allocators and acquirers

For limited partners and allocators, Thursday is a counterparty event before it is a security event. Funds that trade on centralized exchanges should be able to say, within an hour, their exposure by venue and by legal entity, whether assets sat in exchange wallets or with an off-exchange custodian, and how long a withdrawal halt they can survive. Binance has said withdrawals should resume within 48 hours of 11:17 PM Central Thursday. A halt of that length is a liquidity event for anyone running a strategy that assumed same-day access.

For deal teams diligencing fintech, payments, custody or treasury-technology targets, add three requests to the list. The signing architecture diagram, showing every path by which a transaction reaches a key, and which of those paths a developer workstation can touch. The signer's policy configuration, exported, not described. And the time from the last unexpected change to a production wallet, payment queue or release service to the moment a human was alerted. That last number is the one that would have mattered most at 3:20 PM on Thursday, and it is rarely in a data room.

For acquirers of crypto businesses specifically: the hot-wallet ratio and the SAFU-equivalent reserve are balance-sheet items, not security items. Price them that way.

What we are not saying

We are not saying North Korea did this. TRM attributes it to TraderTraitor with high confidence; we have no independent basis to confirm or refute that, and no government has yet made a public attribution. We are not saying Binance's private keys were stolen; Binance says there is no evidence of that, and the evidence on the chain is consistent with its account. We are not saying the October 27 notice was false. We are not saying any customer lost money; Binance says it will cover all losses, and we have seen no customer claim of loss. We are not saying the outgoing transfers from Binance 14 after 3:20:59 PM were customer withdrawals; that is our inference from their pattern, labeled as such. We are not saying the totals reported by TRM, CertiK's engineer, Glassnode or Coinbase's Conor Grogan are wrong; we verified individual legs, not the sum. We are not saying Arbitrum's Security Council or any stablecoin issuer acted improperly or properly; that is a separate argument. And we are not saying the Polymarket incident earlier the same day, which TechCrunch reported involved a compromised third-party provider and about $2 million, is connected.

We are saying that the public record, read in order and checked against the chain, shows an exchange whose own keys signed the largest theft in the history of digital assets, including a transaction type that is not a withdrawal, fifty times over; a wallet that kept paying out after it had been handed to someone else; a delegation that stayed in place for nearly four hours; a warning about exactly this kind of social engineering published by the FBI in 2022 and by Binance itself two days before; and a public account so far that names a laptop and a container and leaves the signer out. If Binance would like to correct any of that, this page will be updated the same hour.

Our record of these incidents

• Binance Hot-Wallet Theft, October 2026, the verified timeline and running list of unknowns
• Bybit Exchange Hack 2025, the $1.5 billion precedent and the signing-interface lesson
• One Stolen Key. 300+ Companies' Email., a vendor-held credential that bypassed every control its customers owned
• PwC Won't Name the Vendor, on reading a company's statement clause by clause

Sources

• TRM Labs, North Korea Steals USD 6.36 Billion from Binance in the Largest Hack in History, October 29, 2026
• Binance News, Binance Square, initial investigation statement, October 30, 2026
• drk, How Binance 14 was emptied through an EIP-7702 delegation, October 30, 2026
• Dickson Wu (CertiK, SEAL), compiled by TechFlow, Binance Hot Wallets on 8 Chains Hacked for $6.28 Billion: Full Breakdown, October 30, 2026
• Zack Whittaker, TechCrunch, Binance pauses withdrawals as hackers suspected of stealing billions in crypto, October 29, 2026
• Jason Shubnell and Yogita Khatri, The Block, Binance investigating hack as suspicious outflows reach up to $5.8 billion, October 29, 2026
• Ambar Warrick, Investing.com via Yahoo Finance, Binance halts withdrawals after $5.3 bln hack, October 29, 2026
• Felix Ng, Cointelegraph, Binance-linked wallet faces possible exploit, blockchain researcher warns (live updates), October 29 to 30, 2026
• Alex Lekander, CyberInsider, Binance links $6.3 billion security incident to compromised laptop, October 30, 2026
• FinanceFeeds, Binance Withdrawals Expected Back Within 48 Hours, October 30, 2026
• Federal Bureau of Investigation, North Korea Responsible for $1.5 Billion Bybit Hack (I-022625-PSA), February 26, 2025
• Bill Toulas, BleepingComputer, FBI links North Korean hackers to $308 million crypto heist, December 24, 2024
• Merav Bar, Wiz Threat Research, TraderTraitor: Deep Dive, July 28, 2025
• Naga Avan-Nomayo, The Block, Binance finalizes $1 billion SAFU reserve conversion into bitcoin, February 12, 2026
• Bloomberg News via American Banker, Giant crypto-exchange Binance reports hack of 7,000 bitcoins, May 8, 2019
• Zack Abrams, The Block, Wintermute warns Pectra upgrade leaves Ethereum users at risk of automated attacks, June 1, 2025
• AICoin, Binance Blocks North Korean Hackers: A Job Trap Battle, October 27, 2026
• American Banker, Extortion group threatens to leak bank vendor's secrets, October 20, 2026
• Finextra, US charges North Korean over Bangladesh Bank hack, September 2018
• Cloudskope, on-chain verification log (Ethereum JSON-RPC via publicnode, Blockscout, mempool.space, TronGrid), October 30, 2026, 2:00 to 2:20 AM Central