The Largest Theft in History Took Twenty Minutes. The Cleanup Took Four Freeze Buttons.

A compromised signing system let an attacker move $6.36 billion across ten blockchains in about twenty minutes. The recovery ran through four stablecoin issuers, a security council and Binance's own balance sheet — the part the industry would rather not discuss.

At 20:05 UTC on Thursday, money began leaving Binance. It left the XRP Ledger first — five wallets, drained to their minimum balances — then Solana and Optimism, then Bitcoin, then Tron. By 20:20 the attacker had a Binance Ethereum hot wallet under a delegation it controlled, and three minutes later that wallet sent its entire balance out in a single transaction: 167,464 ETH and 63 tokens, including 1.615 billion USDT.

By the time the night was over, roughly $6.36 billion had moved across ten blockchains, most of it inside twenty minutes. The previous record, the $1.5 billion Bybit theft in February 2025, had just been multiplied by four. The FBI says the same group did both.

What makes this one worth more than a headline is how it was done, and how it was stopped. The heist was a supply-chain attack on the machinery that signs transactions. The recovery was four stablecoin issuers pressing freeze buttons and a Layer 2 council rewriting a wallet's state. Between them, those two facts say more about the state of crypto in 2026 than any price chart.

Twenty minutes, ten chains

TRM Labs, which traced every transfer from Binance-attributed wallets, puts the total at about $6.36 billion valued at the moment of theft. Ethereum accounted for $3.79 billion of it. Bitcoin outflows were 18,270 BTC, about $1.47 billion. Tron lost $628 million in USDT and TRX, the XRP Ledger $296 million, Solana $96 million. Arbitrum, Optimism and Base together came to about $39 million. Avalanche and Polygon were hit in a second wave around 23:05 UTC.

The preparation started at least 36 hours earlier. The attacker's operator wallet received three small withdrawals from Tornado Cash on the morning of October 28. Early on October 29, the operator deployed a first version of the attack code and tested it on two wallets, then rehearsed the final version on a third and routed the test funds back to itself. Four hours after that rehearsal, the same code was running on a Binance hot wallet.

The Bitcoin leg shows the tradecraft: 18,270 BTC left a Binance hot wallet at 20:20 and was split into round 1,000 BTC and 100 BTC pieces inside the same block — a peel chain, built to make the money harder to follow.

The signatures were the target

The interesting part is Ethereum, because that is where the attacker did something new.

EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025, lets an ordinary wallet hand control of its behaviour to a smart contract by signing an authorization. From then on, every call to that wallet runs the contract's code. At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet. Each pointed the wallet at a sweeper contract that would accept instructions only from the operator.

The trick is the nonce. A wallet counts its transactions, and an authorization only works at the count the wallet has reached when it executes. Binance's hot wallet processes a steady flow of withdrawals, so its count keeps moving. By preparing signatures across 50 consecutive counts, the attacker guaranteed that one would still be valid when the batch landed. One matched. That was enough.

Then the delegation stayed in place. As new customer funds arrived, the operator swept them again — at 20:41, 20:59, 21:04, 21:44, 22:39, 23:56. The compromised wallet also served as the executor for a separate Binance smart account, which let the attacker pull 823 million USDC out of it. Circle froze that USDC at 21:04, about forty minutes after the main sweep.

Early readings blamed phishing, which would explain Ethereum and nothing else. In the same window, Binance wallets on nine other chains — different keys, different signing schemes — produced valid signatures for the same attacker. All of them, within about half an hour. TRM's assessment is that the attacker could make Binance's hot wallet signing system sign transactions of its choosing across chains. Binance has not published a root cause. Richard Teng, its co-chief executive, described a "complex attack" involving a compromised laptop and malware built to delete evidence of itself. Both things can be true at once: a laptop is how you get into a signing system. What you do once you are inside is the part that cost six billion dollars.

The buttons nobody wanted to need

The recovery ran through chokepoints that crypto's founding story was supposed to eliminate.

Tether froze about 1.77 billion USDT. Circle froze about 825 million USDC, in coordination with law enforcement. Ripple froze 40.5 million RLUSD with 48 million already sold through decentralized exchanges. World Liberty Financial froze 27.8 million USD1. Arbitrum's Security Council used emergency powers to force two transfers out of the attacker's wallet, recovering 8,426 ETH and 74.6 million ARB — about $30 million. Total frozen: roughly $2.7 billion.

That is a central bank's toolkit, operated by four companies and a security council, and it worked because the attacker had to move through assets that someone can switch off. The attacker knew it. Within the first hours it was dumping USDT to market makers through intent-based contracts at more than a 10 per cent discount — about 325 million USDT swapped for roughly 122,300 ETH when ETH was trading near $2,300. It also supplied 60 million USDT to Aave and borrowed about 19,760 ETH against it. The remaining USDT in that batch was frozen.

What is left is about $2.4 billion the issuers cannot touch: more than 420,000 ETH and 18,270 BTC, sitting in wallets with no compliance desk. That is still larger than any previous crypto theft, and it is the number that matters for laundering. The Bitcoin peel chain has to reach an exchange, a swap service or an over-the-counter desk eventually, and every one of those is now watching labeled addresses.

Binance chose to be a bank

The other half of the story is a balance sheet.

Binance froze withdrawals, then set aside about $6.34 billion of company funds to cover the loss. It said it had replenished 90 per cent of what was taken, using part of its $1 billion secure asset fund for users, some of its futures insurance fund, and its own corporate treasury. The remaining 10 per cent was in less liquid tokens that would take longer to buy. Teng said the company was committed to covering that too, and that users would not bear the financial impact.

Withdrawals reopened in phases from 2pm Singapore time on Sunday, starting with 15 networks and assets including ETH, USDT and USDC on Ethereum and some assets on BNB Smart Chain, with Dogecoin and Avalanche following later. Customers pulled $4.6 billion and deposited $1 billion, a net outflow of about $3.6 billion — 2.1 per cent of Binance's $171 billion in assets under management. Bitcoin fell nearly 5 per cent on the news, Ethereum nearly 6, and BNB nearly 10.

A 2.1 per cent run is not a bank run. But the mechanism was identical to one: customers tested whether the institution could pay, and the institution paid. Not because a protocol guaranteed it, and not because an insurance market priced it, but because a privately held company had a fund, a treasury and a founder willing to absorb a six-billion-dollar hole. That is deposit insurance with extra steps and no regulator.

A revenue model with a missile programme attached

The FBI's statement on Saturday named TraderTraitor, part of the Lazarus Group, and said it had observed the actors converting stolen assets into Ethereum and expected further laundering through decentralized finance and instant swap services. It urged private companies to block transactions tied to the addresses.

The larger context is fiscal. A 2024 UN panel of experts reviewed 58 suspected North Korean cyber-attacks on crypto companies between 2017 and 2023, worth $3 billion, and said the proceeds were estimated to generate half of the country's foreign currency income. One unnamed country went further, estimating the stolen billions fund 40 per cent of the regime's weapons of mass destruction programmes. There were as many as 17 crypto hacks in 2023 alone, worth $750 million.

Ciaran Martin, the former head of the UK's National Cyber Security Centre, put the asymmetry plainly: hackers have walked off with nine- or ten-figure sums from crypto on more than 30 occasions in a decade, while the number of traditional banks that lost more than $100 million to a cyber-attack in the same period is "zero or one." North Korea's last big attempt on a real bank, Bangladesh Bank in 2016, tried to move $951 million and got $81 million, stopped partly by a coincidence of street names that tripped a sanctions filter. This week it got $6.36 billion, and kept $2.4 billion.

What the next month decides

Three things worth watching. Whether Binance publishes a root cause that explains ten chains rather than one laptop. Whether other exchanges treat EIP-7702 delegations as an alert rather than an edge case — TRM's advice is to reject unexpected authorizations and to keep a tested revocation path ready, which is the kind of guidance that gets adopted after the fact. And whether the freeze response gets faster. Tether moved 37 minutes after the main sweep. In a system where the attacker's whole edge is speed, 37 minutes is both impressive and far too slow.

The industry spent a decade arguing it would never need a bank. This week it needed four compliance desks, one security council, and a company willing to eat the loss. The crypto did not save itself. The institutions around it did, and they did it with exactly the powers the ideology says nobody should have.

Sources: TRM Labs — North Korea steals $6.36bn from Binance, The Guardian — Binance resumes withdrawals after record $6.3bn hack, The Guardian — investors pull billions from Binance, The Guardian — how crypto hacking funds North Korea, PBS NewsHour — FBI blames North Korea