The Binance hack of October 29, 2026, took about $6.3 billion from the exchange’s hot wallets in roughly 20 minutes. No blockchain was broken. North Korean hackers got into the systems around Binance’s wallets and appear to have made the exchange’s own software approve the transfers.
Most Binance hack news has covered who stole the money and how much came back. However, companies that build or run crypto products need to know where the attackers got in. That entry point matters because a blockchain accepts any transfer with a valid signature and never checks who asked for the approval.
Redwerk’s blockchain development team builds wallets, payment flows and smart contracts. Below is our engineering read of how the attack worked, why it hit hot wallets, and how to protect each layer of a crypto platform.
What Happened in the Binance Hack?
On the afternoon of October 29, attackers emptied Binance hot wallets on 10 blockchains, including Bitcoin, Ethereum, Tron and Solana. A hot wallet stays online so an exchange can pay out customer withdrawals within minutes. At about $6.3 billion, the theft is the largest crypto hack on record, more than four times the $1.5 billion taken from the Bybit exchange in 2025.
Two days later, the FBI named North Korea as responsible for the theft of more than $6 billion and identified the attackers as a group it calls TraderTraitor. To slow the laundering, the bureau published 628 wallet addresses linked to the stolen funds, most of them on Ethereum. The alert asked exchanges, decentralized finance (DeFi) services and other crypto businesses to block any transaction connected to that list.
Part of the stolen money could still be stopped, because stablecoin issuers such as Tether and Circle can block their own dollar-backed tokens. Blocking began less than an hour after the attack started, and about $2.8 billion had been frozen by October 30, according to Chainalysis. Unlike those tokens, Ether has no central issuer, so the attackers rushed to swap stablecoins into it while they still could.
Binance promised that customers would not bear the loss and covered it from two reserve funds and its own treasury. Even so, customers pulled out a net $3.6 billion, about 2.1% of the exchange’s assets, on November 1, the first day withdrawals reopened.
How Did Attackers Get Past Binance's Transaction Signing Security?
Evidence so far suggests the attackers took control of the system that signs Binance’s transfers. That control was enough, because every crypto transfer needs only a digital signature made with the wallet’s private key, a secret code that proves the owner approved the payment. Large exchanges keep those keys inside a signing service that handles thousands of withdrawals a day with no person involved.
According to Binance, the breach may have started with a compromised DevOps engineer’s laptop. DevOps engineers run the servers and tools that keep an exchange’s software working. From that laptop, the attackers reportedly reached a service container, a small isolated program inside Binance’s infrastructure, and used it to submit withdrawals. At the same time, the exchange said it had found no evidence that a wallet private key leaked. As the investigation continued, co-CEO Richard Teng reported that his team had uncovered additional points of breach. He added that the attackers had also used tools that deleted their own traces along the way.
From the blockchain’s side, a stolen key and a hijacked signer look the same. A stolen key lets an outsider produce signatures, while a hijacked signing service makes the real key approve whatever the outsider sends. In both cases, every transfer looks properly authorized.
That is why each of the 10 blockchains recorded the transfers exactly as designed. The weak point sat in the devices, software and access rights around the ledgers. Investigators believe one signing system served Binance’s wallets on every chain, which would explain how a single breach opened all of those wallets within minutes. Strong encryption protects the keys, but transaction signing security also depends on every device and account that can send a request to the signer.
What Role Did EIP-7702 Play on Ethereum?
On Ethereum, the attackers took one extra step using EIP-7702, a feature added to the network in 2025. The feature lets an ordinary wallet run the code of a smart contract, a program that lives on the blockchain and works exactly as written. To switch this on, the owner signs a permission, and from then on the contract’s instructions take effect whenever someone calls the wallet.
The attackers got one of Binance’s hot wallets to sign such a permission for a contract that took orders only from them. With that in place, a single transaction emptied the wallet of about $2.5 billion, according to on-chain analyses. The contract kept control until Binance signed a new permission almost four hours later.
EIP-7702 itself is a legitimate tool, which businesses use to pay network fees for their customers or to bundle several actions into one. However, for an exchange, each new wallet feature is also a new way to move funds.
Hot Wallet vs Cold Wallet: Why Were Only Hot Wallets Drained?
In the Binance hack, the attackers could reach only hot wallets, because those stay connected to the exchange’s automatic payout systems. By contrast, a cold wallet keeps its keys on a device that never touches the internet. Any transfer out of cold storage needs people to approve it by hand, often in several locations.
Most exchanges therefore keep the bulk of customer funds cold and leave a smaller share online, so withdrawals still arrive in minutes. That split is a trade-off between speed and exposure, since every automated payout path also gives an attacker something to target. Any business that holds crypto for customers faces the same choice, from trading platforms to crypto banking app development projects.
Hot wallet security starts with giving each wallet type a clear role. The table below compares hot and cold storage on six practical points.
Network access
Online and linked to the payout systems
Offline, on hardware kept apart from the network
Transfer approval
Software, automatically
People, through manual steps
Typical use
Daily customer withdrawals
Long-term storage of most customer funds
Payout speed
Minutes
Hours or days
Main risk
Remote takeover of the signer or the accounts that control it
Physical theft, insider abuse or handling mistakes
Loss control
Little money kept online and caps on hourly outflows
Approval from several people in separate places
Keeping just a little money in hot wallets limits the damage, but only if the signing system can’t move more funds into them from cold storage when an attacker asks. Refills should therefore follow set amounts, a regular schedule and preapproved destination addresses. Those rules are easiest to add while the wallet system is still being designed. It also ranks among the main factors in cryptocurrency exchange app development cost.
What Should Change in Crypto Exchange Security?
Crypto exchange security has to cover every system that can ask for a signature, from engineers’ laptops to the wallets themselves.
Who Can Reach the Signing System?
The Binance hack reportedly began on one engineer’s laptop, which makes staff devices part of an exchange’s defenses. Teams that run live systems need access that is narrow, temporary and recorded:
- Separate devices for work on live systems, with no email or everyday browsing
- Sign-in with hardware security keys, small physical devices that fake login pages can’t trick
- Access granted for one task at a time and removed automatically when the work is done
- No single account able to reach the signing service on its own
- A record of every change to live systems, stored where the engineers who made it can’t edit it
Access rules hold only when the systems enforce them automatically, which is why setting them up is a core part of DevOps consulting work.
Can the Signing Service Refuse a Bad Request?
A signing service should check every request against rules it enforces itself, so a hacked server elsewhere in the system can’t just order a payout. The rules that work best are simple:
- Limits on how much each wallet can send per hour and per day
- An approved list of destinations for transfers between the exchange’s own wallets
- Extra approval for large amounts from people who work on separate systems
Multi-signature wallets and multi-party computation are two common ways to split control, so several separate approvers must agree before funds move. However, if one compromised server can collect every approval, the split adds nothing.
How Fast Can You Spot a Drain?
In the Binance case, most of the money left within 20 minutes, well before the first freezes. Monitoring has to react faster than that:
- Alerts on unusual outflows, such as a sudden jump in withdrawals, new destination addresses or funds leaving several chains at once
- An automatic pause on withdrawals when several of those alerts go off together
- Contacts at stablecoin issuers and blockchain analytics firms, arranged before any incident
- A clear count of how much money in hot wallets is held in tokens an issuer can freeze
An automatic pause will sometimes stop legitimate withdrawals, too. Still, a short delay for customers costs far less than an empty wallet, so it is worth setting the alert threshold low.
Which Wallet Features Does Your Exchange Allow?
Before hot wallets use a feature like EIP-7702, the security team should decide whether the exchange needs it at all. If the answer is yes, the rules have to state which contracts a wallet may hand permissions to and who approves each change. An ordinary hot wallet holds no program code, so any wallet that suddenly gains some should trigger an alert.
How Often Is the Whole Setup Tested?
Many crypto security reviews focus on code that lives on the blockchain. A smart contract audit checklist covers that layer well, but the Binance hack started elsewhere. A full review also traces the signing service, the cloud and release tools, and every account with access to live systems.
When Redwerk runs a software development audit on a crypto platform, our engineers follow every path that can end in a signature. Our team has done similar work on Freenet, an open-source peer-to-peer network built for anonymity. There, we investigated the platform’s vulnerabilities and added protection against forged requests to one of its plugins. After an audit, the client receives a ranked list of findings and decides which fixes come first.
Is Blockchain Still Safe After the Binance Hack?
Yes, the blockchains themselves stayed secure. Their public records even worked in investigators’ favor, because every stolen coin left a trail that analytics firms and the FBI could follow. The risk lies in each company’s own systems, and most exchanges, wallet providers and crypto apps rely on the same kind of signing setup.
The practical response is to map every path that can lead to a signature and make each route hard to misuse. For an outside view of your own signing setup, ask our engineers for a review.
FAQ
What caused the Binance hack?
The Binance hack of October 2026 began inside the exchange’s own infrastructure. According to Binance, the attackers may have entered through a compromised employee laptop and reached a system that could request withdrawals. From there, Binance’s signing software approved their transfers, so about $6.3 billion left through channels the exchange controlled. The company later reported additional points of breach, and its full report was still pending in early November 2026.
Who was behind the Binance hack?
The FBI attributes the October 2026 Binance hack to North Korea and names a state-backed group it calls TraderTraitor. The group is widely linked to the Lazarus Group and has repeatedly targeted crypto companies, including the 2025 theft of about $1.5 billion from Bybit. Analytics firms had reached the same conclusion a day before the FBI, after stolen Binance funds mixed on-chain with money from a previous North Korean theft.
Hot wallet vs cold wallet: which is safer?
For holding large amounts, a cold wallet is safer, because its private keys are stored offline and every transfer needs manual approval. A hot wallet gives up some of that protection in exchange for speed. Software can approve its payments instantly, so a remote attacker who controls that software can do the same. Exchanges usually combine both, keeping reserves cold and a small working amount hot.
Was the blockchain itself hacked in the Binance attack?
No. Bitcoin, Ethereum and the other networks hit in the Binance attack worked as intended. A blockchain checks that each transfer is properly signed, and every stolen transfer rested on signatures from Binance’s own keys. The exchange’s compromised systems had produced those approvals, so the networks had no reason to reject them. Later, the same public ledgers helped investigators follow the stolen funds.
How can a crypto exchange protect its hot wallets?
Good hot wallet security limits three things: who can trigger a payment, how much can leave, and how long a theft can go unnoticed. In practice, an exchange needs locked-down staff devices with strict access rights and signing rules that cap withdrawals. No single server should be able to override those rules. Real-time alerts should pause withdrawals automatically when outflows look abnormal.
See how Redwerk audited and future-proofed a backend API to lift maintainability by 80% and harden every integration touchpoint before scale.
