- TRM Labs says about $6.36 billion left Binance wallets on ten blockchains on October 29. It says the attacker likely gained control of Binance's signing system.
- Most wallets signed for the attacker within about half an hour. Avalanche and Polygon wallets followed about two and a half hours later. Binance has not published a root cause.
- Ask your team who and what can request a signature from your treasury wallets, and whether one compromised system could approve transfers on every chain you use.
The lock may not be the weak point
A vault can be well built and still be opened if someone persuades the guard. That may be the lesson of the Binance case. For any organisation holding digital assets, the question is not only who holds the keys. It is also what is allowed to ask for a signature.
TRM Labs, a blockchain intelligence firm, traced the loss. It reports that about $6.36 billion left Binance wallets on ten blockchains on October 29. Binance has said user funds are safe. It has also said it suspended withdrawals on multiple networks. It has not published a root cause.
What happened on Ethereum
Ethereum added a feature called EIP-7702 in its Pectra upgrade in May 2025. A normal wallet can sign a permission that points it at a smart contract, which is a small program stored on the blockchain. From then on, the wallet runs that program's code whenever it is called.
TRM says the attacker sent one transaction carrying 50 of these permissions. Each was signed by a Binance hot wallet. A hot wallet is an internet-connected wallet that an exchange uses to pay out customers. Each permission pointed to a contract that obeyed only the attacker.
Why 50? Each wallet numbers its transactions. A permission works only if it carries the number the wallet has reached when it runs. The Binance wallet was busy, so its number kept rising. TRM says the attacker signed for 50 consecutive numbers so that one would still fit. One did.
Three minutes and 24 seconds later, the attacker told the wallet to send out everything it held. TRM says that one transfer included 167,464 ETH and 63 tokens. Among them was 1.615 billion USDT.
Why the signing system is the suspect
Early signs on Ethereum pointed to phishing. TRM says that idea explains Ethereum only. On the other chains, Binance wallets sent funds through plain signed transfers, such as on Bitcoin, Tron and Solana. TRM describes these as standard signed transfers, not delegations.
Those networks use different key types and signing methods. Yet TRM found that the wallets produced valid signatures for the attacker inside roughly a 30-minute window. Binance wallets on Avalanche and Polygon followed around 23:05 UTC, about two and a half hours later.
TRM's assessment is that the attacker most likely gained the power to steer the system that signs Binance's hot wallet transactions. That would let one actor get valid signatures on ten chains within hours.
SecurityWeek adds Binance's early view. Binance said its first investigation suggests the incident may involve a compromised DevOps engineer's laptop, which may have given access to a service container used to submit unauthorized withdrawals. Binance said it found no evidence of a wallet private key leak.
That fits TRM's picture. The keys may not have been stolen. The system that uses them may simply have been told what to sign.
A patient, rehearsed operation
The groundwork began at least 36 hours before the money moved, TRM says. Three small Tornado Cash withdrawals funded the attacker's operator wallet. Tornado Cash is a service that hides where coins came from.
The attacker tested code on two wallets and rehearsed the final version on a third. Four hours after that rehearsal, the code went onto a Binance hot wallet.
TRM attributes the attack with high confidence to TraderTraitor, a North Korean state-sponsored group. In TRM's account, the FBI earlier named that same group as responsible for the Bybit theft of $1.5 billion in February 2025. SecurityWeek reports that Chainalysis chief executive Jonathan Levin also thinks TraderTraitor is the likely culprit. Binance has not publicly named the attackers.
Freezes helped, but only in part
Stablecoin issuers acted quickly. As of 00:30 UTC on October 30, TRM's tally of assets frozen onchain stood near $2.7 billion. TRM puts the assets the attacker holds beyond any issuer's reach at about $2.4 billion.
The attacker paid a price to get around the freezes. TRM says about 325 million USDT was sold to market makers for roughly 122,300 ETH. That was a discount of more than 10%.
Questions to put to your team
TRM gives treasury teams practical advice. Watch Ethereum-compatible wallets for EIP-7702 delegations. One shows up as code at an address that should hold none. Reject such permissions unless you expect them. Keep a tested, pre-approved way to sign a revocation.
TRM adds a warning sign for signing policies. If someone asks for a whole run of permissions spread over a range of transaction numbers, TRM says to treat that as evidence of compromise. It also advises separating signing systems and approval paths by chain and wallet tier.
Leaders can turn that into four questions. Which systems can request a signature from our treasury wallets? Would a compromised engineer laptop reach any of them? Can one breach approve transfers on every chain we use? Who is alerted if a wallet suddenly gains code?
If TRM is right, the lesson is that the key matters less than who can ask it to sign. Protect the request path, not only the vault.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: TRM Labs.
