How Hackers Used EIP-7702 to Take Control of Binance 14
One of the most significant parts of the attack occurred on Ethereum. The attacker used EIP-7702, a feature introduced through Ethereum's Pectra upgrade in May 2025. It allows a standard Ethereum wallet, normally controlled directly by a private key, to temporarily delegate transaction execution to smart-contract code.
The attacker deployed a malicious sweeper contract and prepared 50 authorizations signed for a Binance-associated wallet labeled Binance 14. The authorizations pointed the wallet toward the attacker's contract and covered consecutive nonce values from 18,914,775 to 18,914,824. Only one authorization, associated with nonce 18,914,809, was accepted by the network.
At approximately 20:24:23 UTC, the attacker executed the malicious code through Binance 14. The transaction transferred roughly 167,464 ETH and 63 tokens, including approximately 1.6 billion USDT. The attacker subsequently swept additional deposits arriving at the wallet and used the delegated code to issue instructions to another Binance smart wallet, Hot Wallet 34. The movement of approximately 823 million USDC from that wallet was also identified in the investigation. The Ethereum transaction records provide an onchain record of the main sweeper transaction.
Stolen Bitcoin Exceeds Tesla's Holdings and El Salvador's Reserve
The breach also resulted in the theft of approximately 18,270 BTC, worth around $1.4 billion at a Bitcoin price of $78,500. This amount exceeded Tesla's disclosed holdings of 11,509 BTC and was more than twice El Salvador's reported national reserve of approximately 7,820 BTC.
The stolen Bitcoin amount was also close to SpaceX's disclosed holdings of 18,712 BTC, falling short by approximately 442 coins. The comparison illustrates the scale of the Bitcoin portion of the theft, although the stolen BTC represents only part of Binance's estimated $6.3 billion total loss.
The attacker distributed the Bitcoin across 19 addresses. Seventeen addresses received exactly 1,000 BTC each, while the remaining two held approximately 833 BTC and 438 BTC. The coins had not moved from those addresses as of the early October 31 tracking snapshot. Their movement and any subsequent transfers remain important indicators for investigators attempting to trace the stolen funds.
Investigators Link the Attack to North Korea
Blockchain intelligence firms TRM Labs and Chainalysis attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group. Their assessments cited links between the stolen Binance assets and funds associated with an earlier Bitget theft, along with similarities to previous attacks attributed to North Korean operators.
Binance has not independently confirmed the identity of the attackers. The exchange said it was cooperating with law enforcement and security specialists to establish the complete attack sequence. The FBI and U.S. Secret Service were also reported to be working with Binance following the incident. The FBI confirmed that it was aware of the activity and was coordinating with public- and private-sector partners.
The TRM Labs investigation outlines the firm's attribution assessment and its efforts to track the stolen assets. The attribution remains an intelligence assessment rather than a publicly established criminal finding.
Hackers Used Automated Laundering Techniques to Obscure Funds
The movement of stolen assets became another major part of the investigation. Chainalysis identified what it described as previously unseen laundering patterns involving thousands of transactions within a short period. Instead of sending funds through a simple sequence of wallets, the attackers repeatedly circulated assets between addresses, including addresses that had appeared earlier in the transaction trail.
The activity suggested the use of automated scripts to complicate blockchain tracing. Investigators also identified efforts to exchange stablecoins for cryptocurrencies that cannot be frozen by a token issuer in the same way. Chainalysis described a sequence in which approximately $500 million in stablecoins was moved into a wallet used for conversions. Around $325 million in stablecoins was exchanged for approximately $285 million in ETH over nearly 20 minutes, while another $175 million was moved through intermediary wallets.
These transactions were part of an effort to move funds before issuers could block affected addresses. The Chainalysis investigation and response updates provide further details on the suspected automated activity and the industry's response.
Tether, Circle and Other Partners Freeze Billions
The attackers' efforts to move funds were met with intervention from cryptocurrency issuers and blockchain partners. Tether, Circle, Ripple and other organizations used their ability to freeze certain token balances associated with identified addresses. These interventions affected assets including USDT, USDC and other stablecoins.
Circle froze approximately $823 million in USDC linked to the incident, while Tether froze more than $1.5 billion in associated assets. Ripple and other issuers also took action. The Arbitrum Security Council separately intervened to move certain assets out of the attacker's reach.
Binance said approximately $3 billion had been frozen onchain by October 30. Other investigators published figures that differed according to the time and assets included in their calculations. Importantly, frozen assets are not automatically recovered funds: they may be blocked from movement but still require legal, operational and technical steps before they can be returned.
The response demonstrated how stablecoin issuers and blockchain networks can intervene in certain situations. However, Bitcoin and Ether do not have the same issuer-controlled freezing mechanism, making the recovery of those assets dependent on tracing, cooperation with exchanges and other investigative measures.
Binance Reveals Additional Breach Points
Binance's initial explanation pointed to a potentially compromised DevOps engineer's laptop. The suspected access may have allowed an attacker to enter a service container and submit unauthorized withdrawal transactions. Co-CEO Richard Teng stressed that the incident was more complex than a single employee action.
"The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," Teng said. "It involved a more complex attack process."
The exchange later disclosed that its investigation had identified additional breach points beyond the initially suspected laptop. Binance said it had found no evidence that wallet private keys were leaked. It also indicated that the attackers had bypassed normal security checks and that a mechanism had been used to erase evidence. The precise sequence and the way the 50 Ethereum authorizations were obtained remained under investigation.
Binance revoked the malicious authorization associated with Binance 14 at approximately 00:10:35 UTC on October 30, ending the delegation. It also contained affected infrastructure, introduced additional security controls and worked with law enforcement and blockchain partners to trace the stolen assets.
Binance Suspends Withdrawals and Announces a $6.34B Recovery Plan
Following the breach, Binance temporarily suspended withdrawals while conducting security checks and reviewing affected systems. Deposits and other unaffected services remained operational. The exchange initially targeted a withdrawal restart within approximately 34 hours, subject to the completion of security checks, with services expected to return through a phased process.
On October 30, Binance announced that it had prepared more than $6.34 billion in company funds to cover the losses. Of that amount, approximately $5 billion was already held in the exact token assets affected by the incident, including USDC, USDT, BTC, ETH and BNB. Binance said it was purchasing the remaining assets through market and over-the-counter channels.
The company said it would cover all losses through its Secure Asset Fund for Users (SAFU) and corporate treasury rather than passing the financial impact to customers. It also planned an updated Proof of Reserves snapshot, with results expected by November 2, 2026, to provide users with updated information about platform holdings and the backing of customer balances. The official Binance security incident update outlines the recovery commitments, frozen assets and withdrawal restoration plan.
Binance's Bitcoin Holdings Become a Point of Comparison
The size of the Bitcoin theft prompted comparisons between the attacker's holdings and those of major corporate and national Bitcoin holders. The 18,270 BTC taken from Binance exceeded Tesla's reported Bitcoin holdings and more than doubled El Salvador's reserve. It also approached SpaceX's disclosed Bitcoin position.
These comparisons put the scale of the stolen Bitcoin into perspective, but they do not mean the attacker has successfully liquidated the assets. The coins were spread across 19 addresses and remained visible on the public blockchain. Their movement can therefore be monitored, even though tracking does not guarantee recovery.
Binance's own financial response also became part of the discussion. The exchange said its $6.34 billion allocation was intended to match the value and type of assets affected, with $5 billion already held in corresponding tokens. The company said it would purchase the remaining amount rather than relying solely on the recovery of frozen funds.
Crypto Markets React, but Analysts Disagree on the Long-Term Impact
The breach triggered selling across digital assets and publicly traded cryptocurrency companies. Bitcoin fell below $79,000 and later traded around the mid-$70,000 range, while Ether also declined. Crypto-linked equities came under pressure, with Coinbase falling more than 13% on Friday, Circle dropping more than 9% and Strategy losing approximately 8% in the reported session.
The market response was significant but did not resemble Bitcoin's sharper reaction to the 2018 Binance security incident, when its price fell by nearly 11% in minutes. The broader cryptocurrency market has since grown substantially, and spot Bitcoin exchange-traded funds and institutional participation have changed the market structure. Those differences provide context, but they do not establish that future exchange failures would have a limited effect.
Wall Street analysts at Cantor Fitzgerald, TD Cowen and Compass Point argued that the hack did not necessarily undermine the wider cryptocurrency market. Some viewed the selloff in crypto-linked stocks as a potential buying opportunity, while others warned that uncertainty around withdrawals, liquidity and customer confidence could create further pressure. Their views were assessments, not guarantees about market performance.
CZ and Elon Musk Exchange Remarks Over SpaceX Holdings
The breach also prompted a public exchange between Binance co-founder Changpeng Zhao, known as CZ, and Elon Musk. Musk reacted to the incident with posts that Zhao viewed as inappropriate given the scale of the security crisis. Zhao asked Musk to stop trolling and referred to Binance's $500 million investment connected to Musk's 2022 Twitter acquisition.
Zhao said the investment had become associated with SpaceX shares worth more than $1 billion. He also discussed Binance's ability to absorb the financial impact, referring to frozen assets and the exchange's available funds. The exchange's leadership separately said it had sufficient company resources and would not need to rely on selling those shares to cover the losses.
The exchange between the two public figures became a side story during the incident, but it did not change Binance's stated recovery plan or establish that SpaceX shares would be sold.
What Happens Next for Binance?
As of Binance's October 30 update, the exchange's immediate priorities were restoring withdrawals safely, completing its security investigation, recovering frozen assets and publishing an updated Proof of Reserves report. The company also committed to releasing a technical post-mortem once the findings had been verified and could be disclosed without compromising the investigation.
The recovery process remains distinct from the promise to cover customer losses. Frozen assets may still require further action before they can be returned, while assets that remain under attacker control may be more difficult to recover. Binance's commitment to replenish the affected tokens is intended to address the financial shortfall regardless of how much of the stolen cryptocurrency is ultimately recovered.
The Binance incident has become a major test of exchange security, onchain investigation and industry coordination. Its final impact will depend on the progress of asset recovery, the restoration of normal withdrawals, the results of the technical investigation and the ability of Binance to demonstrate that customer balances remain fully backed.
