Crypto Nightmare: Binance Hacked for $5.8 Billion, Recapping the Largest Cyberattack in Crypto History

Author: TechFlow

At 4:20:59 AM Beijing Time on October 30, an unassuming Ethereum transaction was added to the blockchain. This transaction submitted 50 EIP-7702 authorizations to Binance's hot wallet marked as "Binance 14". Three minutes and 24 seconds later, all 167,464 ETH, 1.615 billion USDT, and 63 other tokens including UNI, LINK, AAVE, and PEPE held in this wallet were swept up in a single transaction.

This is the largest exchange theft in cryptocurrency history. On-chain data shows that outflows alone on Ethereum exceeded $3.3 billion, with cross-chain statistics reaching $5.5 billion to $6.2 billion. For comparison, the $1.5 billion theft of a Bybit cold wallet in February 2025 was previously the industry record.

Panic spread to secondary markets within minutes.

Bitcoin quickly fell below $78,500, Ethereum broke support at $2,250, BNB plunged 9% intraday, and the global derivatives market saw $629 million in liquidations within an hour, of which $607 million were long positions.

Binance subsequently urgently suspended withdrawals across multiple networks and Binance Alpha trading, repeatedly stating that user funds were completely safe. Binance founder Changpeng Zhao (CZ) directly stated on X, "It does look like it was hacked," while citing estimates from DefiLlama founder 0xngmi, noting that the actual net loss "might be slightly over $1 billion, but it will be fully covered."

This was not just Binance's battle; the entire crypto industry mobilized.

About 40 minutes after the incident, Tether froze over 1.567 billion USDT, Circle froze over $800 million USDC, Ripple froze approximately $200 million RLUSD, World Liberty Financial froze $27 million USD1, and Paxos froze approximately 1,906 PAXG.

Binance officially announced the latest verified frozen total of $3 billion, stating that this figure may continue to increase.

Lurking for 48 Hours and a Lethal Authorization Request

This was not a spur-of-the-moment raid.

Cobo co-founder and crypto OG Shen Yu released an on-chain review video hours after the incident. Tracing back along the on-chain trail, the attacker's preparations had been underway at least two days prior.

Starting from the afternoon of October 28, the attacker withdrew small amounts of funds three times from the mixer protocol Tornado Cash to serve as gas fees for subsequent contract deployments and rehearsals. From the evening of October 29 to the early morning of the 30th, the attacker used a test wallet to run through the entire attack sequence twice. By the time the final test wrapped up, only three and a half hours remained until the official strike at 4:20 AM.

The weapon that delivered the fatal blow was a new feature recently introduced by Ethereum during last year's Pectra upgrade: EIP-7702.

In traditional Ethereum architecture, regular external accounts (EOAs, i.e., wallets normally controlled by private keys) and smart contract accounts exist in distinctly separate systems. EIP-7702 breached this wall, allowing standard wallets to temporarily delegate control of their accounts to a segment of smart contract code by issuing a special authorization. As long as it is not actively revoked, this program can execute any operations, such as batch transfers, on behalf of the wallet owner.

Decoding the logic of this attack contract in his review, Shen Yu said: “The attacker’s program recognizes only one master and does only one thing: moves money.”

That transaction hitting the sequence number at 4:20:59 AM is what led the "Binance 14" hot wallet to sign a fatal authorization request. Once effective, hackers wouldn't even need to use Binance's private keys each time; they could directly invoke the contract to strip all 64 tokens from the wallet.

By 4:41 AM, a more chilling scene unfolded. Borrowing the legitimate identity of the "Binance 14" hot wallet, the attacker issued commands and directly orchestrated a USDC smart contract wallet under its control, draining 823 million USDC in one go. By 6:40 AM, acting as if entering their own backyard, the attacker made four round trips to the "Binance 14" hot wallet to sweep assets, not even sparing scattered incoming funds. On-chain analyst Ai Yi monitored that the hackers even casually dumped all 7.77 trillion PEPE tokens from the hot wallet on-chain to convert them into ETH.

Why would the world's most highly secured exchange hot wallet use its private key to sign 50 consecutive EIP-7702 malicious authorizations?

“From the chain perspective, the issue lies in the signing process; no contract vulnerabilities were observed,” Shen Yu diagnosed technologically in the video.

Even more puzzling is that at 6:55 AM, Binance's security team themselves used this "Binance 14" private key to sign transactions, transferring the remaining fragmented tokens left in the wallet back to their own secure wallet. More than two hours after the incident, Shen Yu still posted a warning on X: The key was clearly in Binance's hands, yet that lethal EIP-7702 delegation authorization remained unrevoked. At the time, a deposit of approximately 2,961 ETH was stuck on-chain due to low gas fees, posing an immediate risk of being swept away by the hacker's program upon confirmation.

This implies that the hackers likely did not directly steal plaintext private key files. Instead, they probably exploited a breach in Binance's internal automated signing system, permission verification, or operations command pipeline, tricking the signing machine into executing that unauthorized Type-4 transaction.

Everyday is Zero-day

Hours after the Binance incident, Musk posted on X stating "Everyday is Zeroday," implying that AI has pushed the crypto industry into an era of permanently asymmetrical offense and defense.

Blockaid co-founder and CEO Ido Ben-Natan's assessment was more specific: this attack bears "a very close resemblance" to the $1.46 billion Bybit theft in February 2025, with on-chain preparation methods highly aligning with known operational patterns of North Korean hackers.

This is no baseless claim.

Immunefi CEO Mitchell Amador publicly warned multiple times this year that AI has fundamentally tilted the offensive-defensive balance toward attackers, and defenders would need at least three to four years to possibly close the gap.

In past security battles, zero-day vulnerabilities (unexploited, fatal flaws awaiting discovery and patching) were scarce weapons manually excavated by a handful of elite hackers over months. But in 2026, with the explosive computational power of large AI models, the defensive-offensive balance has completely overturned. AI can not only scan open-source protocols and smart contract code globally around the clock without interruption, mass-producing zero-days, but also combine deepfake technology and automated penetration scripts to launch millisecond-precision social engineering and supply chain attacks against exchange operations personnel and internal signing pipelines.

Before 2026 has even ended, over 230 crypto protocols across the network have already been attacked.

According to ValueTheMarkets statistics, in just the first half of 2026, North Korea-linked hacker groups stole $643 million in crypto assets, accounting for 66% of the global total stolen during the same period. From Bybit to Binance, the scale of attacks multiplied several times over eight months.

Even industry giants with the most abundant security budgets face the combined blows of "AI seeking blind spots + state-level hackers conducting pinpoint strikes," and could easily lose everything over a single code update or a blind spot in signature verification.

The industry has already begun an arms race. According to DLNews, multiple leading exchanges and security firms are competing for access to Anthropic's latest Claude Mythos model, attempting to fortify defenses with cutting-edge AI. Cyvers CEO Deddy Lavid stated, the crypto industry is "the first market to truly feel the impact of AI."

But reality is brutal: attackers only need to find one vulnerability, while defenders must protect all of them. When state-level hacker organizations are equipped with AI tools, this mathematical equation is unfavorable to all centralized platforms.