A delegated authorization that bypasses controls… and billions slipping away.
Binance faced this scenario last week, and the broad strokes are now known.
An Ethereum feature hijacked to delegate rights to a malicious smart contract
The attack compromised one of Binance’s hot wallets — a wallet connected to the network to enable transactions, unlike the cold wallets stored offline.
This wallet delegated its management and transfer rights to a malicious smart contract. Vector: EIP-7702, a feature introduced to Ethereum in May 2025. With it, a standard wallet can sign an authorization pointing at a contract and then execute the contract’s code with its own assets. Among its potential uses:
- Bundling operations into a single transaction (for example: approving a token and then swapping it)
- Payment of gas fees by a third party
- Temporary or restricted delegation of rights to secondary keys (Web3 gaming, trading bots, etc.)
EIP-7702 permissions stay active until explicitly revoked by signing to an empty address or to another contract. The vulnerability this implies is known. A study presented at the latest USENIX Security Symposium (August 2026) bears testimony to this.
Binance does not claim a keys leak, but admits compromise of a laptop
Binance states that the authorization granted by its hot wallet did not pass through the usual controls. It remains unclear how it could have been signed. To date, the company maintains there is no evidence that keys were leaked. It does point to the compromise of an employee’s laptop… in addition to “other intrusions.”
Once the attacker obtained the signature, they submitted it to the Ethereum network from an address funded via Tornado Cash. Three minutes later, they triggered the smart contract, designed to move the entire wallet’s holdings. It was around 9 p.m. in France on October 29.
TraderTraitor or the North Korea-linked trail
The FBI attributes the attack to the TraderTraitor operating mode, closely tied to the Lazarus group and thus to North Korea. It provides a list of about 600 Ethereum addresses, 20 Bitcoin addresses and one Solana address through which the stolen funds flowed.
There are indeed clues that link the attack to TraderTraitor. Among them is the use of a transit address already exploited in late September after the Bitget hack (about $388 million), attributed to the same modus operandi.
Binance activates three levers to cover the announced $6.3 billion in losses
Binance has pledged to cover losses from its own funds. It has earmarked just over $6.3 billion by drawing on three instruments: its SAFU (Secure Asset Fund for Users), its Futures Insurance Funds and its treasury.
The SAFU is an emergency reserve funded by deductions from transaction fees. It has already been used, for example, to cover the theft of 7,000 bitcoins in 2019. On October 31, Binance shaved half of its balance (7,500 bitcoins, about $600 million). It aims to restore the amount to $1 billion.
The Futures Insurance Funds constitute another safety reserve, dedicated to the leveraged derivatives market. Its main roles, broadly speaking, are:
- Paying winners if Binance cannot recover the money from the losers
- Avoiding automatic deleveraging (forced closing of the positions of the most profitable traders to balance the books)
- Protecting the losers from debt by absorbing the residual shortfall
Binance currently believes there is no need to top up these Futures Insurance Funds. If necessary, it would do so from its own funds, as it has done in the past.
A cryptographic proof of coverage
Binance promptly announced that it had covered the equivalent of $5 billion in the affected currencies. It plans to acquire the remainder on the market or over the counter. The step may take time, it warned, both due to the low liquidity of certain tokens and the settlement delays of some operations.
As of the latest updates, the company has managed to cover 95% of the announced losses. To confirm its claims, it conducted on October 31 a “proof of reserves” snapshot. This mechanism uses a Merkle-tree structure coupled with a form of zero-knowledge proof. It allows anyone to verify that assets in their own account are indeed included in the snapshot and that reserves are covered at least 1:1, without ever revealing a particular user’s balance. The cryptographic proof generation takes 40 to 50 hours. Binance plans another snapshot on November 4.
Withdrawals restored, Binance sees 2% of assets under management flee
Withdrawals, which had been paused, resumed on November 1 at 07:00 in France. The first phase covered 15 assets across as many blockchains. In nine and a half hours, Binance processed $4.649 billion in withdrawals, against $1.01 billion in deposits. A net outflow of $3.64 billion, which, the firm notes, represents only about 2% of its total assets under management (roughly $171 billion). It also adds that withdrawal volumes quickly stabilised, which indeed happened from late morning after a peak between 08:30 and 10:00.
The impact on Bitcoin’s price was relatively modest (a drop of under 5%). Changpeng Zhao, Binance’s cofounder, points this out and offers several angles, notably by comparing it with Mt. Gox. On one hand, far more users and balances on the platform were affected; on the other, while the Binance hack in dollar terms is unprecedented, Mt. Gox had a larger crypto-value loss. Specifically, Mt. Gox reportedly saw between 650,000 and 850,000 BTC stolen—worth roughly $450–$500 million at the time. In Binance’s case, a mix of cryptocurrencies was involved, including about 18,270 BTC and 420,000 ETH, Zhao notes.
Approximately $3 billion frozen
The announced loss does not account for frozen holdings. The latest tally lists more than $3 billion in frozen assets. Leading the pack are stablecoins, which are easier to freeze than decentralised currencies. Tether and Circle froze around $1.57 billion and $823 million in USDT, respectively. Ripple blocked $200 million in issued assets (not XRP, its native token, which cannot be frozen).
Among other techniques, the attackers used lending platforms. Among them, Aave. They deposited nearly $60 million in USDT as collateral and borrowed about 19,800 ETH (roughly $44 million) in return. The USDT ended up in Aave’s reserve rather than at an address that Tether & Co could block. The ETH, however, belonged to the attackers, who followed a similar scheme on the JustLend platform.
Aave apparently has no mechanism to recover the ETH in question. It has currently blocked new deposits and loans. Its community may ultimately agree on transaction reversals, as was done in response to The DAO hack ten years ago.
