Inside the Binance Hack: What the Blockchain Reveals About Its Signing Systems and Reserves

The attacker had 50 pre-signed authorizations from Binance 14. It submitted all 50 in a single Ethereum transaction. Only one matched the wallet's nonce and was accepted.

The October 29 attack ultimately moved about $6.36 billion from Binance wallets across 10 blockchains, according to blockchain intelligence firm TRM Labs. TRM's analysis suggests the Ethereum incident was part of a wider compromise of Binance's hot-wallet signing infrastructure.

The theft raised questions about how Binance's wallets authorized transactions and how its internal controls handled withdrawal requests. It also put the exchange's reserve disclosures under scrutiny. One of the drained wallets had appeared in Binance's October 1 Proof of Reserves report.

Binance says its hot wallets were compromised, customer funds are safe and it will cover the losses through SAFU and company funds. The public blockchain provides a way to trace the transactions. It cannot, by itself, show how the attackers reached Binance's internal systems or how the exchange classified every asset involved.

Why Only One of 50 Authorizations Worked

The attacker used Ethereum's EIP-7702 standard to delegate execution from Binance 14 to code associated with another address.

EIP-7702 allows an externally owned account, the standard type of Ethereum wallet, to adopt code delegated to another address. The wallet retains its original address, but calls to it can execute that code in the wallet's own context. The authorization does not transfer ownership of the account.

In Binance's case, the attacker had obtained valid, pre-signed authorizations from Binance 14. The on-chain record shows that Ethereum accepted one of them. It does not establish how the signatures were obtained or whether the wallet's private key was exposed.

The 50 authorizations covered consecutive nonce values, from 18,914,775 to 18,914,824. A nonce is a number Ethereum uses to track transactions from an account. It advances as the account processes transactions and helps prevent the same transaction from being replayed.

Binance 14 was processing withdrawals rapidly, causing its nonce to advance. The attacker had prepared authorizations for a range of consecutive values, allowing one to match the wallet's nonce when the transaction was processed. Ethereum accepted authorization 18,914,809 and ignored the other 49.

That authorization allowed the attacker to use a sweeper contract to move assets out of Binance 14. CoinDesk reported that the first major transfer moved about 167,464 ETH, along with dozens of other tokens. A second Ethereum hot wallet, Binance 16, transferred another 28,005.6 ETH.

Those two transfers totaled about 195,470 ETH. TRM's wider tally of Ethereum outflows reached approximately 200,630 ETH, including additional activity beyond those initial transfers.

The first sweep was not the last. The delegation remained active, and as more funds arrived in Binance 14, the attacker used the same access to move them. TRM also found that the compromised wallet acted as an executor for a separate Binance smart account, identified as Hot Wallet 34, allowing the attacker to move about $823 million in USDC.

The activity was not confined to Ethereum. TRM found that Binance wallets on nine other blockchains also sent funds through ordinary signed transfers. Those networks do not use EIP-7702. The transactions involved their own signing mechanisms.

The pattern across all 10 networks is why TRM believes the incident involved a broader compromise of Binance's hot-wallet signing infrastructure. The blockchain shows that multiple wallets sent valid transfers. It does not reveal precisely how the attackers reached the systems behind them.

Binance's initial explanation said the incident may have involved a compromised DevOps engineer's laptop, which could have provided access to an internal service container used to submit unauthorized withdrawal transactions. The exchange later disclosed that investigators had found additional points of compromise.

Related: What Happened to LEASH? Inside the Shiba Inu Token’s Supply Controversy and V2 Migration

Co-CEO Richard Teng subsequently said the attack was not simply a matter of one engineer's permissions or a single 'one-click' action. He described a more complex process and said Binance had not attributed responsibility to any individual.

Teng also described a self-destruct mechanism that destroyed tools and traces associated with the operation, according to reports of his October 30 remarks. That account has not been independently established through a public technical post-mortem.

Binance has said it found no evidence that wallet private keys were leaked. That does not rule out access to internal systems or other parts of the exchange's signing infrastructure.

In an October 31 update, Binance said its investigation was still ongoing and that it expected to publish verified technical findings. Until then, important parts of the breach remain unexplained.

The Drained Wallet Appeared in Binance's Reserve Report

The incident also drew attention to Binance 14's appearance in the exchange's October 1 Proof of Reserves disclosure.

A CoinDesk review found that the wallet held about 89,475 ETH and 1.26 billion USDT at the time. The address was among those used to demonstrate that Binance held assets backing customer balances. Binance reported an Ethereum reserve ratio of 100% in that snapshot.

Proof of Reserves is a point-in-time snapshot. It shows assets and liabilities at a particular moment. It is not a full financial audit, and it does not provide a live view of an exchange's balance sheet.

The timing raises an accounting question. Binance says the breach affected its hot wallets and that customer funds were unaffected. But Binance 14 also appeared in a disclosure used to demonstrate customer-asset backing.

Binance's public disclosures do not explain whether the assets held in Binance 14 were classified as customer backing, company-owned funds or a combination of the two.

CoinDesk's analysis suggested the theft likely pushed Binance's reported ETH backing below 100% until the assets were replaced. The publication estimated that the ratio could have fallen to roughly 94%, based on the amount of ETH taken and the reserves reported in the snapshot. That is a third-party estimate, not an independently audited finding about Binance's overall financial position. It does not establish that customers suffered losses or that Binance misrepresented its reserves.

Binance planned another Proof of Reserves snapshot for November 1, with results targeted for November 2. The exchange has said the replacement assets will be reflected in its updated disclosure. The report may offer a clearer view of Binance's holdings, although a snapshot alone will not explain when the assets were acquired, how they were funded or how they were classified.

Frozen Assets Are Not Automatically Recovered

A freeze can stop stolen tokens from moving. It does not necessarily put them back in Binance's hands.

TRM estimated that stablecoin issuers froze about $2.67 billion connected to the incident. Binance separately reported roughly $3 billion in frozen assets on-chain. These are separate estimates, reported at different times and potentially covering different assets. They should not be added together.

The Arbitrum Security Council also intervened. It moved 8,425 ETH and 74,559,805.2 ARB to a restricted address. Those assets can only be moved through an Arbitrum DAO governance vote.

That intervention was specific to the Arbitrum network. It was not the same as a stablecoin issuer placing an address on a blacklist, and it did not automatically return the assets to Binance.

Other funds remained beyond the reach of issuer freezes. In its October 30 assessment, TRM said more than 420,000 ETH and 18,270 BTC remained outside those restrictions, with a combined value of about $2.4 billion at the prices used in its analysis. Those figures describe the situation at the time of the assessment, not a live balance. ETH and BTC cannot be frozen by a token issuer in the same way that centralized stablecoins can.

The attacker also moved funds through decentralized finance platforms. TRM estimated that about $325 million in USDT was exchanged for roughly 122,300 ETH through market makers and routing services. TRM put the implied price at about $2,650 per ETH, compared with a market price in the range of $2,300 to $2,350. The attacker effectively sold the USDT at a discount of more than 10% to obtain ETH, according to TRM's analysis.

Related: The Shib Army Put Down Roots; Five Years Later, the Work Continues

A separate analysis by LlamaRisk found that the attacker supplied 60 million USDT as collateral on Aave, a decentralized lending protocol, and borrowed 19,762 WETH. LlamaRisk valued the collateral at about $59.9 million and the borrowed assets at roughly $43.8 million at the time.

Aave froze new supply and borrowing in the affected markets. Existing positions remained subject to the protocol's normal rules: users could still repay loans and withdraw eligible collateral, while liquidations continued. The intervention did not seize the attacker's collateral or automatically return the borrowed WETH to Binance.

Binance's $6.34 Billion Commitment Needs a Breakdown

Binance says it has set aside more than $6.34 billion to cover the losses from the incident. In its October 30 update, the exchange said it already held more than $5 billion in the exact affected token assets, including USDC, USDT, BTC, ETH and BNB. It said the remaining assets would be acquired through market purchases and over-the-counter transactions.

Binance said the coverage would come from its SAFU fund and corporate treasury.

The headline figure is substantial, but the public explanation leaves several details unanswered. Binance has not provided a full token-by-token reconciliation showing how much of the commitment comes from existing holdings, how much will be purchased, where the replacement assets are held or how they will appear in future reserve disclosures.

There is also an unanswered question about timing. Binance said the $5 billion in matching assets was already in its custody, but did not disclose when those holdings were acquired. Cointelegraph reported that the exchange declined to provide that information.

Were those assets already included in Binance's October 1 Proof of Reserves disclosure, or were some acquired after the theft? The public information does not yet answer that question.

Binance also told CoinDesk that the $6.34 billion commitment did not include approximately $3 billion in frozen or protected assets. The exchange is treating those funds as a separate recovery effort, rather than counting them as part of the replacement coverage.

A pledge to cover a loss is not the same as a published reconciliation showing that every affected token has been replaced.

There is also a separate question about SAFU, Binance's emergency insurance fund. In February 2026, Binance converted about $1 billion of SAFU holdings into 15,000 BTC. The conversion was completed on February 12, with the holdings valued at roughly $1.005 billion at a bitcoin price of about $67,000. Binance published the associated wallet address.

That wallet provides a public reference point for part of SAFU's holdings. Its market value changes with the price of bitcoin. The address does not establish that all the visible BTC is available for this incident, or that it should be counted as an additional pool on top of the $6.34 billion commitment.

The next Proof of Reserves disclosure may show how Binance's holdings have changed. But without a detailed reconciliation, outside observers cannot determine from the headline commitment alone how much has already been replaced, when those assets were acquired or how the exchange has allocated the funds.

Who Was Behind the Attack?

TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group, with high confidence. The firm said its assessment drew on on-chain and off-chain intelligence.

The name has appeared in previous investigations. The FBI identified TraderTraitor in its attribution of the February 2025 Bybit theft. That earlier finding provides context, but it does not independently establish who carried out the Binance attack.

Binance has not publicly confirmed the identity of the perpetrators. TRM's assessment remains a private-sector attribution, not a public finding by law enforcement.

The exchange says customer funds are safe and has committed billions of dollars to covering the losses. Its updated reserve disclosure may answer some questions about the replacement assets. The central security question remains harder to resolve from public records: how did attackers obtain valid signing authorizations across Binance's networks, and why did the exchange's internal controls fail to stop them?