Binance Hack On-Chain Analysis: 50 Signatures, 197,460 ETH and $2.83 Billion Frozen

Update 10:45 UTC: trail leads to North Korea, withdrawals within 48 hours. Investigators at TRM Labs attribute the Binance hack with high confidence to North Korea's TraderTraitor group, and Chainalysis points to the same group; Binance has not named an attacker. According to TRM Labs, about $6.36 billion left across ten blockchains, about $2.7 billion is frozen, and the attacker holds more than 420,000 ETH and 18,270 BTC across all wallets. Binance expects to reopen withdrawals within 48 hours; deposits work. Everything in one place: North Korea behind the Binance hack? What we know.

Update 02:30 UTC: Binance puts the damage at $6.3 billion. In an official announcement Binance estimates the total impact at around $6.3 billion, of which about $3 billion is frozen on-chain. According to the initial investigation, a DevOps engineer's laptop was compromised, which let the attacker access a service container and submit unauthorized withdrawal transactions. Binance says it has found no evidence of a private key leak. The exchange will cover all losses from the SAFU fund and company funds; deposits and withdrawals remain suspended, and an updated proof of reserves will follow.

What really happened in the Binance hack? Our analysis of the blockchain data shows: on October 29, 2026 an attacker took control of the hot wallet "Binance 14" with 50 simultaneously submitted signatures and drained about $2.7 billion within seconds. Binance confirmed the hack overnight and says it will cover all losses. According to our measurements and investigators, more than $2.83 billion is frozen, and the attacker is left mainly with 197,460 ETH. Here is what we verified ourselves, what the key voices on X say and where this is heading.

The minute-by-minute account is in our timeline with live ticker, the news itself in our Binance hack report.

Advertisement, for readers in the EU: If you no longer want to keep your coins on Binance after the hack, Bitpanda compares itself with Binance, Kraken, Coinbase and Crypto.com and shows a three-step guide to moving your crypto. Bitpanda is licensed in the EU under MiCA. Other MiCA-licensed alternatives in the EU are Coinbase (licensed via Luxembourg) and OKX (licensed via Malta).

Which EU-licensed exchanges are a Binance alternative, what they charge and how to move your crypto is covered in our guide Binance alternatives: 4 MiCA-licensed exchanges compared.

Hack or internal transfer? The first debate of the night

In the first hour it was not clear there had been an attack at all. Analyst Simba considered a planned migration between Binance wallets possible: the destination was freshly created and had not moved the funds at first.

BREAKING: $2.7 BILLION JUST MOVED OUT OF BINANCE IN 24 SECONDS. Everyone is screaming HACK. But the onchain evidence tells a VERY different story.

Simba (@Simba_crpt) October 29, 2026

The theory did not last. The address behind the attack was funded with 0.1 ETH from the mixer Tornado Cash, the wallet was bound to an outside contract, and shortly after the attacker began spreading tokens across dozens of addresses. At 00:04 UTC Binance co-founder Yi He confirmed the hack:

User funds are safe. Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.

Yi He (@heyibinance) October 30, 2026

How the attack worked: 50 signatures, one hit

Security firm Blockaid found the decisive technical trick, and we verified it directly on-chain. The attack transaction is of the new type 4, which since the Pectra upgrade lets a wallet hand its control to a smart contract via EIP-7702. It contains exactly 50 such authorizations, all for the Binance 14 wallet, all pointing to the same attacker contract, for nonces 18,914,775 to 18,914,824 (transaction on Etherscan).

The attacker didn't know Binance 14's live nonce. So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx. Only 1 of 50 was a hit.

Blockaid (@blockaid_) October 29, 2026

The background: such an authorization is only valid for the nonce the wallet has at the moment of inclusion. Because the hot wallet kept sending withdrawals, the attacker did not know the nonce and fired 50 authorizations at once. One landed. More important is what 50 authorizations require: each must be signed with the wallet's key. The attacker could therefore produce signatures for Binance 14. How he gained that access is for Binance's announced post-mortem to explain. The delegation has since been removed: according to our query at 01:20 UTC the wallet's code is empty again.

Where is the money? Our tally at 01:30 UTC

About $2.7 billion left the two Binance wallets on Ethereum, plus smaller amounts on other chains. Most of it is blocked, but not all. Binance itself now puts the total impact across all chains at around $6.3 billion, about $3 billion of it frozen; the breakdown below shows what is visible on Ethereum.

Update: This brings the total frozen for the Binance exploit so far to over $2.83B

ZachXBT (@zachxbt) October 30, 2026

The Aave trick: why frozen USDT still yielded Ether

The attacker knew Tether could freeze. Within three minutes he supplied 60 million USDT to the lending protocol Aave and borrowed 19,762 wETH, about $45 million. Shortly after, Tether froze the address, and 46 minutes later Aave froze the affected markets. The frozen USDT now sit as collateral on Aave, the borrowed Ether are with the attacker. He will never repay them.

Aave protocol will be fine. The hacker supplied 60M USDT and borrowed 19,762 wETH (~44.9M$) in 3 minutes, before Tether froze their address and before the Aave Guardian froze the Aave V3 Core reserves (46 min later).

Marc Zeller (@mzeller) October 29, 2026

Aave can absorb it, Marc Zeller of the Aave Chan Initiative explains: the position is overcollateralized and will be liquidated automatically once Ether rises about 4% to roughly $2,365. The debt equals 0.9% of the protocol's wETH reserves. A rising Ether price would, of all things, liquidate the attacker's loan.

More on the Binance hack

• Binance hack: how the hot wallet was drained
• Live ticker and timeline: the crypto crash after the hack
• USDT frozen: what Tether and Circle really blocked
• Binance withdrawals: which networks are paused
• Is this the end? Three scenarios for Bitcoin
• Ethereum: the hacker sits on 195,000 ETH
• Solana below $100: is $80 next?
• BNB crash: another FTT moment?
• The biggest crypto hacks in history
• How to short Bitcoin in the crash
• Why is crypto down today?

What the key voices on X are saying

• Yi He, Binance: user funds safe, Binance covers all losses, deposits and withdrawals temporarily suspended, full post-mortem to follow.
• ZachXBT, investigator: more than $2.83 billion frozen.
• Blockaid, security firm: 50 EIP-7702 authorizations in one transaction, one hit. Verified by us on-chain.
• Marc Zeller, Aave Chan Initiative: the attacker borrowed 19,762 wETH before the freeze, manageable for Aave.
• Simba, analyst: initially considered an internal transfer possible, overtaken by Binance's confirmation.
• Bala, commentator: wrote the attacker "walked away" with the Aave trick. True for $45 million, not for the billions.

Our conclusion: where the Binance hack is heading

• For customers: Binance has pledged to cover all losses, and the frozen share makes that credible. The key question is when deposits and withdrawals resume. Until then: patience, and no links from messages promising refunds. Which exchanges hold a licence is shown in our comparison of regulated exchanges. We track the status in Binance withdrawals after the hack.
• For the loot: of about $2.7 billion, more than $2.8 billion across all chains is blocked. On Ethereum the attacker is left mainly with the 197,460 ETH, the Ether from Aave and distributed smaller tokens, roughly $600 million in total. Going by Binance's figures of $6.3 billion in damage and about $3 billion frozen, however, more than $3 billion across all chains is still unaccounted for; where it sits is the open question of the coming days. He will have to launder it over days and weeks, and every move is public.
• For Ethereum: the 197,460 ETH remain an overhang. At the same time a 4% price rise would liquidate the attacker's Aave position. What it means for the price is in Ethereum crash: the Binance hacker sits on 195,000 ETH.
• For the industry: the attack shows a new pattern. Whoever can produce signatures for a wallet needs, thanks to EIP-7702, a single transaction to sweep everything. Exchanges will have to tighten their signing systems and the approval of such delegations.

We keep monitoring the addresses and will update this analysis as funds move or Binance publishes its post-mortem. This article is not investment advice.