Summary
Blockchain researchers and industry media say multiple Binance hot wallets moved an estimated $5.8 billion to $6.3 billion in assets in late October, although the figures and final net loss remain disputed. The incident has renewed questions about transaction authorization, institutional custody, cross-chain tracing and the role of stablecoin issuers in emergency response.
A major exchange-security incident with unresolved figures
A large-scale movement of assets from Binance-controlled hot wallets in late October has become one of the most consequential security incidents recently reported in crypto markets. Blockchain researchers and industry publications have estimated the value of the transferred assets at roughly $5.8 billion to $6.3 billion. One reconstruction counted activity across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche and Optimism.
The numbers should be treated carefully. Blockchain-based estimates can differ depending on the valuation timestamp, whether subsequent transfers are counted again, how assets are grouped across addresses, and whether the calculation measures gross outflows or the exchange’s eventual net loss. Some reports also cited Binance as saying that user funds remained safe and that a substantial portion of affected assets had been restored or would be covered. Those statements are not directly equivalent to the gross value observed moving on-chain.
A complete accounting would require an official reconciliation of exchange liabilities, internal wallet ownership, frozen assets, recovered assets and any insurance or balance-sheet response. Until that information is available, the reported value of the transfers should not automatically be described as the final economic loss to customers or to Binance.
Why EIP-7702 is central to the investigation
According to transaction-level reviews, a wallet labeled “Binance 14” submitted a series of EIP-7702 authorizations before large quantities of ETH, USDT and other tokens were swept from the address. EIP-7702 is an Ethereum feature that allows a traditional externally owned account to delegate execution authority to smart-contract code through a signed authorization. It is designed to support more flexible account behavior and batch operations, but it also makes the authorization message a critical security boundary.
The public evidence so far points investigators toward the signing and permission-control layer rather than a confirmed vulnerability in an underlying token or wallet contract. That distinction matters. A security failure can occur even when the contract performs exactly as designed if an unauthorized party obtains a valid signature, if a signing service approves an overly broad delegation, or if the human-readable review process fails to show the practical consequences of the authorization.
In this case, the reported sweeper logic appears to have been designed for one purpose: moving assets once the relevant authority was available. A wallet that has signed a broad delegation may expose many different token balances to a single automated sequence. The risk is therefore not limited to the value of one transaction. It can extend to every asset held by the account, as well as wallets that recognize the compromised address as an authorized or trusted controller.
Reports also described substantial USDC transfers from a smart-wallet structure that trusted the affected Binance address. If confirmed, that would illustrate how internal trust relationships can amplify the impact of a compromised signer. Security controls must therefore examine not only private-key custody, but also contract permissions, wallet-to-wallet trust, token allowances and the ability to revoke or isolate authority quickly.
Evidence of preparation before the attack
Blockchain tracking cited in the reports suggests that the attacker did not act entirely opportunistically. Small amounts of ETH were allegedly withdrawn from Tornado Cash before the incident, apparently to fund later transactions. The attacker was also reported to have deployed a sweeper contract and tested parts of the authorization and transfer sequence in separate wallets before targeting exchange-controlled addresses.
If those observations are confirmed, the operation involved several stages: preparing transaction fees, deploying code, rehearsing the execution path, obtaining or abusing a signing capability, and dispersing the assets across new addresses and networks. That sequence has implications for how centralized exchanges monitor their operational environments. Detecting suspicious behavior only after a large transfer has been mined is often too late, particularly when automated contracts can move assets within minutes.
The reported timeline also underlines the importance of pre-transaction simulation. A signing system should be able to identify not only the immediate recipient and token amount, but also the effective authority granted by a new account feature. It should flag unusual combinations such as repeated authorizations, broad delegation, access to a high-value hot wallet, or a transaction that can move dozens of unrelated tokens.
For institutional custody providers and exchange operators, the relevant controls may include separate approval paths for new account features, strict limits on hot-wallet balances, independent policy engines, address and contract allowlists, rapid revocation procedures, and continuous monitoring of unusual call patterns. None of these measures can guarantee that an incident will not occur, but they can reduce the blast radius and shorten the time between detection and containment.
Stablecoin issuers became part of the response layer
Several reports said that Tether, Circle, Ripple, Paxos and other issuers froze portions of the assets associated with the attack. Published estimates of the frozen amount ranged from approximately $2.8 billion to $3 billion, with figures changing as analysts identified additional addresses. The numbers should be viewed as provisional because asset prices, address attribution and subsequent movements can change the calculation.
The response demonstrates a distinctive feature of stablecoins: although transfers settle on public blockchains, the issuer may retain the ability to freeze or restrict tokens under defined legal, compliance or security procedures. That capability can prevent some funds from being converted or moved further, particularly when issuers coordinate quickly with exchanges and blockchain investigators.
It also raises difficult governance questions. A freeze can improve recovery prospects during a confirmed theft, but it concentrates significant authority in the issuer. Errors in address attribution, conflicting legal orders, cross-border jurisdiction and user appeals all become relevant. The incident therefore sits at the intersection of technical security, financial compliance and payment-system governance.
For institutions, asset protection cannot be evaluated solely by asking whether a private key is stored offline. The operating environment may include stablecoin issuer policies, bridge contracts, exchange screening, token permissions and emergency communication channels. Custody risk is increasingly a network-level issue rather than a single-device issue.
Attribution remains an allegation, not a conclusion
Some reporting cited external assessments that North Korea-linked actors may have been involved. Other reports said that the attribution was denied. At this stage, the available material does not support presenting that claim as a settled fact.
Cyber-attack attribution generally requires more than a similar technique or a familiar money-laundering pattern. Investigators may combine infrastructure records, malware or code reuse, wallet histories, operational behavior, intelligence reporting and law-enforcement evidence. Blockchain movements can help map the flow of funds, but they do not by themselves establish who controlled the relevant keys or infrastructure.
That distinction is important for both compliance teams and the public. Premature attribution can affect sanctions screening, investigations and diplomatic responses, while an overly narrow assumption about the attacker can cause institutions to overlook other threat actors or access paths.
Market confidence and the meaning of withdrawal pressure
The attack was reported to have prompted Binance to suspend withdrawals on several networks and to generate substantial user outflows over the following days. Market reports also described short-term declines in major crypto assets and derivatives liquidations. These movements are best understood as signs of heightened uncertainty and a reassessment of counterparty risk, not as a basis for trading decisions.
The more important questions concern the structure of customer protection. Can an exchange show which assets are held in customer-controlled or exchange-controlled wallets? Are liabilities reconciled continuously? What conditions permit a withdrawal suspension? How quickly can users receive a verifiable explanation of affected addresses, frozen assets and recovery efforts? And can the exchange demonstrate that a hot-wallet incident does not impair the broader customer balance sheet?
These questions extend beyond Binance. Centralized exchanges, custodians and payment platforms increasingly operate across multiple chains and interact with programmable wallets, automated signing systems and stablecoin issuers. A failure in one authorization path can therefore have consequences across an entire network of counterparties.
From key protection to verifiable control systems
The central lesson of the incident is not simply that one wallet was compromised. It is that institutional digital-asset security is a system involving keys, permissions, software upgrades, contract behavior, operational staff, issuer policies and emergency coordination.
New account features can improve efficiency while creating unfamiliar authorization risks. Cross-chain tools can expand access to liquidity while allowing an attacker to distribute funds rapidly across jurisdictions and monitoring systems. Automated signing can reduce operational friction while making a mistaken or malicious approval more scalable.
Future reviews are likely to focus on authorization simulation, transaction limits, multi-party approvals, minimum-privilege design, real-time monitoring, hot-and-cold wallet separation, contract allowlists, incident disclosure and recovery testing. Regulators and industry bodies may also revisit standards for exchange proof of assets and liabilities, third-party custody responsibility, stablecoin freezing procedures and cross-border cooperation.
Until a fuller investigation is published, the precise net loss, the final recovery amount and the identity of the attacker should remain open questions. But regardless of the final figure, the event reinforces a broader principle: institutional wallet security is not only about keeping keys secret. It is about making every authorization, transfer and emergency decision limited, explainable, traceable and independently reviewable.
Source: link