How attackers drained an estimated $6.3 billion from Binance — and why Washington is now arguing about it

The largest crypto theft on record unfolded on Thursday, Oct. 29, when attackers moved an estimated $6 billion-plus out of Binance, the world's biggest exchange. A day later the forensic picture, the money trail, and the political fight over what — if anything — would have stopped it are all coming into focus. None of them flatter the current state of centralized-exchange security.

What actually happened

Binance's own initial account, relayed by co-CEO Richard Teng, points to a compromised DevOps engineer's laptop that gave an attacker access to a service container used to submit withdrawal transactions, per The Block. Binance says it has not identified a private-key leak, and Teng has described the attack as more complex than a compromise of one employee's permissions.

Blockchain analytics firms fill in the mechanics. According to TRM Labs, the attacker began staging at least 36 hours ahead of the theft, funding an operational wallet with small Tornado Cash withdrawals, then deploying and testing malicious code across three wallets before executing. On Ethereum, the attacker used EIP-7702 — the account-abstraction upgrade that lets an ordinary wallet temporarily delegate its behavior to contract code — to turn a Binance hot wallet into an attacker-controlled "sweeper," pre-signing 50 authorizations so at least one would still be valid at execution. TRM says coordinated transfers across nine other blockchains point to a compromise of Binance's broader hot-wallet signing infrastructure, not a single wallet.

Elliptic's analysis indicates the attacker kept access after the initial exploit, using one compromised wallet's owner rights to pull funds from another Binance wallet and to repeatedly sweep fresh deposits. A second Ethereum hot wallet sent $174 million straight to the attacker, Elliptic said — again suggesting access to the signing layer rather than a one-off key theft.

The striking part, per Immunefi VP Simone Imbrescia, is how little on-chain code was needed: the sweeper contract ran only about 130 lines. "The hard part sometimes is getting access to a system powerful enough to make very simple code devastating," she said. The attack's sophistication, she argued, lived in the operational layer — the people, infrastructure and workflows that instruct private keys — not in exotic smart-contract bugs.

Following the money

The attacker then moved fast to park funds in assets that issuers can't freeze. Chainalysis tracked thousands of transactions in a short window, with stolen funds circulating repeatedly between addresses. To dodge stablecoin freezes, the attacker converted $325 million in stablecoins into $285 million of ETH over roughly 20 minutes, per Chainalysis — eating a notable haircut for the sake of unfreezable assets. Elliptic reported the attacker swapped hundreds of millions in USDT for ETH through DEXs and market makers, accepting losses of as much as 26% against market prices, and separately deposited $59.9 million of stolen USDT into Aave as collateral to borrow 19,762 ETH — a loan that was still open and near liquidation as of Elliptic's latest update. Aave said Friday it had unfrozen all markets across its V3 and V4 protocols, that its smart contracts were unaffected, and that user positions remained fully collateralized.

Who did it

Chainalysis, Elliptic and TRM all attribute the attack to North Korean hacking groups. TRM goes furthest, tying it to the same unit — which The Block's regulation piece names as TraderTraitor — behind the $1.5 billion Bybit hack, citing the Tornado Cash funding, advance staging and pre-signed authorizations as hallmarks. Chainalysis found on-chain links between the Binance proceeds and last month's Bitget exploit, also attributed to North Korea. Elliptic is more cautious: it notes the overlap with Bitget involved only a small portion of the Binance funds and does not conclusively establish the same attackers.

Key facts

• Amount: More than $6 billion stolen, estimated at ~$6.3 billion — the largest crypto hack on record (TRM Labs, Elliptic, Chainalysis, via The Block). Binance says it has $6.34 billion ready to cover losses (Binance, via The Block).
• Date: Thursday, Oct. 29, 2026; Sen. Cynthia Lummis said the funds left "in less than 4 hours" (Lummis, via The Block).
• Entry point: Compromised DevOps engineer's laptop and access to a service container; no private-key leak identified (Binance/Richard Teng, via The Block).
• Technique: EIP-7702 sweeper on Ethereum, 50 pre-signed authorizations, coordinated transfers across nine other chains; sweeper ~130 lines (TRM Labs; Immunefi, via The Block).
• Laundering: $325M stablecoins → $285M ETH in ~20 min; $59.9M USDT into Aave to borrow 19,762 ETH; up to 26% slippage absorbed (Chainalysis, Elliptic, via The Block).
• Binance's cover: ~$5B affected, ~$1.3B more being bought via market/OTC; proof-of-reserves targeted for Monday, Nov. 2; withdrawals targeted to resume within ~40 hours (Binance/Teng, via The Block).

The real-world read

A few things the statements gloss over.

Binance's "we're covered" number is Binance's. The claim that $6.34 billion is ready to cover a ~$6.3 billion loss comes from the exchange itself, with the proof-of-reserves report not due until Monday. Treat "fully covered" as an unverified assertion by an interested party until that report — and restored withdrawals — actually land.

"No private-key leak" is doing a lot of work. Binance can technically be right that no key leaked while the outcome is identical: if an attacker commandeers the infrastructure that instructs the keys — the reading all three analytics firms converge on — the distinction is cold comfort to customers. It also sits awkwardly with Teng's own admission that this was bigger than one laptop.

The attribution is strong but not uniform. TRM confidently ties this to the Bybit crew; Chainalysis links it to Bitget; Elliptic explicitly warns the Bitget overlap is small and not conclusive. The honest summary: multiple firms independently point to North Korea, but the specific "same group as Bybit" claim is TRM's, and Elliptic would not go as far.

Analytics firms are not neutral bystanders. Chainalysis, Elliptic, TRM and Immunefi all sell security and investigation services. Their forensics here are detailed and mutually corroborating, but a breach of this scale is also a marketing moment for the tracing industry — worth remembering when the takeaway is "you need tools like ours."

The regulatory fight is partly self-serving. CFTC Chair Michael Selig told CNBC the hack "proves our exact point" — made on Oct. 5, when his agency proposed a crypto framework; a regulator citing a disaster as vindication for its own pending rules is advocacy, not analysis. The Digital Chamber and the Solana Policy Institute, both industry bodies pushing for the Clarity Act, have an obvious stake in the "pass our bill" conclusion. And the claim that the Clarity Act would have let firms freeze the funds is openly contested: Lummis says it would have given legal cover for instant freezes; Better Markets' Amanda Fischer counters the bill required a court order to freeze stablecoins; the Solana Policy Institute's Patrick Wilson says a specific provision protected issuers making voluntary, temporary holds without a court order. Those readings can't all be right, and no one has resolved them.

The pardon in the room. Any Binance-accountability story now runs through the fact that former CEO Changpeng Zhao pleaded guilty in 2023 to failing to maintain AML controls as part of a $4 billion settlement — and was later pardoned by Trump, the same president now saying he's "looking into" the hack. The stalled Clarity Act, by The Block's account, stalled partly over Democrats' objections to Trump's own crypto holdings via World Liberty Financial and the TRUMP memecoin. The conflicts are not incidental to this story; they're why the legislative fix is stuck.

Opinion, and whose

• TD Cowen analysts: the breach highlights custody and cybersecurity risk at centralized intermediaries but doesn't undermine the broader asset class — "we do not stop using dollars when a bank is robbed." (Attributed opinion; TD Cowen sells research to institutional clients.)
• CFTC Chair Michael Selig: the "real issue" is unregulated offshore exchanges lacking US safeguards. (A sitting regulator promoting his agency's own proposal.)
• Sen. Cynthia Lummis (R-Wyo.): the Clarity Act would have let firms freeze suspicious transactions on law-enforcement contact. (Disputed by Better Markets and partly by the Solana Policy Institute — see above.)
• Rep. Tom Timmons (R-S.C.): frames the theft as a national-security problem — "rogue regimes" financing weapons programs.
• Immunefi's Simone Imbrescia: the lesson is that transaction-authorization processes must be secured as hard as the keys themselves.

Sources

• The Block, "Inside the largest crypto hack on record" (reputable secondary) — the forensic timeline, EIP-7702 mechanics, laundering figures, attribution, Binance's financial position and TD Cowen's take; itself citing TRM Labs, Elliptic, Chainalysis and Immunefi as primary analysts, and Binance/Teng as the interested party.
• The Block, "Trump says they're looking into Binance hack" (reputable secondary) — Trump's comments, CFTC Chair Selig's CNBC remarks, the Clarity Act dispute (Lummis, Fischer, Wilson), the CZ settlement and pardon, and the Digital Chamber letter.
• Decrypt, "Binance Hack Shows Why Offshore Exchanges Need US Oversight, CFTC Chair Says" (reputable secondary) — corroborates the CFTC-chair oversight framing in its headline.

No sponsored or press-release material was used; Binance's own loss-coverage figures and the analytics firms' commentary are flagged above as interested-party sources.

This is news reporting, not financial advice; nothing here is a recommendation to buy or sell anything.