Binance Theft Tracking 10 Binance Hot Wallet Security Incident: Process, Attack Logic, and Interim Recap: How Were Billions of Dollars Transferred by Hackers? Based on currently available on-chain analysis, the abnormal outflow of funds involving multiple hot wallets may reach $5.5-6 billion. If ultimately confirmed, this could become the largest cryptocurrency theft in history. However, it should be noted that this amount is currently a third-party estimate and not Binance's confirmed final loss. Approximately $3 billion in related assets have already been verified and frozen, and Binance has announced a suspension of deposits and withdrawals and launched a security investigation. I spent some time researching this incident and found that the most concerning aspect is not how much money the hackers transferred, but how they did it. Because this attack may expose a problem that deserves our attention even more than the leakage of private keys. 1️⃣ What exactly did the hackers do? First, understand a concept: hot wallets. Exchanges process a massive volume of deposits and withdrawals daily, making it impractical for staff to handle every transaction with offline hardware wallets. Therefore, they rely on hot wallets capable of online signing and transfers. This allows exchanges to operate efficiently, but it also makes hot wallets a prime target for hackers. According to analysis by security firm Blockaid, attackers had deployed a malicious smart contract and conducted multiple small-scale tests before the incident. Around 4:20 AM Beijing time on October 30th, the attackers submitted a special set of authorizations to the Binance 14 hot wallet. Approximately four minutes later, a large-scale transfer began. The initial transfers alone involved approximately: 167,000 ETH 1.615 billion USDT and dozens of other tokens. Subsequently, other wallets, including Binance 16, also experienced abnormal transfers, with funds from multiple networks converging towards the attack-related address. The entire process was extremely rapid. More importantly, this wasn't simply transferring money to another address; it was a prepared attack involving automated programs. 2️⃣ How did the hackers actually get the money? The most crucial technical clue in this incident is Ethereum's EIP-7702. Many people might lose interest upon seeing this name, but the principle isn't complicated. Normally, a wallet needs a valid signature corresponding to its private key to transfer money. However, EIP-7702 provides a feature that allows ordinary wallets, after authorization, to delegate operations to a piece of smart contract code. This feature was originally intended to make wallets more convenient, such as for batch transactions and automated operations. But it also introduces new risks related to access control. You can think of it this way: You have a safe. Normally, only you with the key can open it. But now the safe has an added function: you can sign an authorization form to allow a machine to manage the contents according to pre-defined rules. If someone tricks you into signing a malicious authorization, the machine could then continuously withdraw assets according to the attacker's rules. This on-chain analysis shows that Binance 14 experienced such malicious delegation. The hacker submitted 50 authorizations with different transaction serial numbers at once, one of which successfully took effect. Subsequently, the malicious program began to mass-purge assets from the wallet, even managing to transfer some of the funds that later entered. However, a crucial question arises: The EIP-7702 authorization itself still requires a valid signature; the hacker cannot gain control of the wallet out of thin air. In other words, the real question to investigate is: how did the attacker obtain this valid authorization? Currently, there are two main possibilities: First, the private key was indeed compromised, and the hacker directly gained signing capabilities. Second, the private key wasn't directly stolen, but the attacker controlled or tricked the signing system, causing it to approve content that shouldn't have been approved. Both scenarios can explain some of the on-chain phenomena, but there is currently insufficient evidence to confirm which one is correct. This is precisely the most intriguing aspect of the entire incident. 3️⃣ Where might the hackers have come from? Many people immediately thought of the North Korean hacking group Lazarus. This speculation isn't entirely without context. In 2025, Bybit suffered a theft of approximately $1.5 billion in cryptocurrency, which the FBI later attributed to attackers linked to North Korea. Both incidents involved the asset security of large centralized institutions, and some security researchers believe that the preparation methods and signature manipulation characteristics of this attack are similar to past professional attacks. However, I believe caution is warranted. Similar attack methods do not necessarily mean the attackers are from the same organization. Currently, there is insufficient public evidence to definitively attribute this Binance incident to Lazarus or any specific country. Based on the observed preparations, multi-wallet operations, and subsequent fund handling, I am more inclined to believe that this was an operation carried out by attackers with strong technical and organizational capabilities, rather than a spur-of-the-moment, ordinary cryptocurrency theft. As to who exactly is responsible, more on-chain evidence, internal system logs, and security investigation results are needed. 4️⃣ With so many assets, could the hacker have taken them all? Not necessarily. After the attack, institutions like Tether and Circle began cooperating to freeze the relevant assets, and Binance is also working with law enforcement and security agencies to track the funds. However, it's important to distinguish three concepts here: The money transferred by the hacker, the money frozen, and the money that is ultimately unrecoverable. These three figures are not the same. Centralized stablecoins like USDT and USDC can be frozen by the issuer under certain conditions. However, native assets like ETH and BTC are handled differently; they cannot be recovered simply by the issuer blacklisting addresses. The hacker clearly knew this. Public analysis shows that after transferring the funds, the attacker split the addresses, exchanged tokens, and even used the Aave lending protocol to collateralize some stablecoins to borrow ETH. The purpose may not have been singular, but the objective effect is that it increases the complexity of asset tracking and disposal. Therefore, it's premature to say that hackers stole $6 billion, or that Binance only needs to bear a certain percentage of the remaining losses. Freezing assets doesn't equate to recovery, and the total amount of assets transferred out doesn't equal the final net loss. The true figures await further investigation and reconciliation. 5️⃣ What lessons can we learn from this incident? I believe at least three aspects deserve serious consideration. 1) First, private key security does not equate to absolute asset security. Many people previously believed that as long as the private key wasn't leaked, the wallet was secure. However, if attackers can manipulate signature requests, deceive approval processes, or abuse obtained authorization, they can still potentially generate valid on-chain transactions. This doesn't mean private key protection is unimportant; rather, it illustrates that security must cover the entire authorization process. 2) Second, decentralized wallets don't necessarily mean truly diversified risk. If multiple wallets use the same signature service, approval system, or share administrative permissions, an attack on one critical link could affect multiple wallets. Truly effective risk isolation is not just about separating assets, but also about maintaining independent control over different assets. 3) Finally, and I believe most importantly: Exchange security shouldn't rely solely on its ability to avoid problems, but on its capacity to bear the consequences if problems occur. Binance has already stated it will cover the related losses and is proceeding with asset freezing and investigation. This is a positive sign. However, we still need to pay attention: Has the attack entry point been found? Has the risk been truly isolated? When will user withdrawals be safely restored? How will the final asset shortfall be filled? I've always believed that in the crypto world, investors often spend a lot of time researching how much an asset can rise in the future, but rarely seriously consider a more fundamental question: If the market direction is correctly predicted, but assets are lost due to hackers, custody issues, or other security problems, what is the point of all the previous investment decisions? This incident also reminds us again that asset security is not just a technical issue; it's also a matter of permissions, trust, and risk-taking. Based on current evidence, we cannot yet determine the hacker's initial intrusion method, nor can we confirm the attacker's identity. The final conclusions await a full investigation. However, one point is worth remembering for all long-term investors: making money requires judgment, but preserving it requires a robust security structure that can withstand unexpected events. For someone aiming for long-term survival in the cryptocurrency market, the latter may be even more crucial than the former. Note: This article is based on publicly available information as of the morning of October 30, 2026. The amounts involved and the attribution of the attacks may still be updated as the investigation progresses.