Blockaid says a transaction containing 50 signed Ethereum authorizations included one that allowed code at a contract address to act for Binance’s hot wallet, Binance 14. Binance estimates [about $6.3 billion in cryptocurrency was affected](https://crypto.news/?p=14488222), but has not explained what that figure includes or how the attacker obtained a valid authorization.
- One authorization reportedly passed the wallet’s nonce check. It also needed a valid signature.
- Binance 14 lost assets valued at roughly $2.5 billion, according to the reported analysis.
- Binance identified a potentially compromised employee laptop as a lead, not a confirmed cause.
- Some assets were frozen or restricted. That does not mean they were recovered or returned.
How one authorization redirected Binance 14
At 20:20:59 UTC on October 29, 2026, a transaction included [50 EIP-7702 authorization entries](https://dev.to/thevenice/how-a-53b-binance-hot-wallet-hack-worked-eip-7702-50-signatures-and-a-37-minute-race-2lea) targeting Binance 14, according to blockchain security firm Blockaid. The entries covered consecutive nonce values from 18, 914, 775 to 18, 914, 824. Blockaid’s analysis says the authorization for nonce 18, 914, 809 took effect.
A nonce is an account’s transaction counter. It keeps transactions in sequence, but knowing the right nonce is not enough to control a wallet. An [EIP-7702 authorization also needs a valid signature](https://www.binance.com/en/square/post/25053509644681) from the wallet’s authority. Blockaid says one of the submitted entries passed the relevant checks. How the attacker obtained that signed authorization remains unknown.
EIP-7702, introduced in Ethereum’s [2025 Pectra upgrade](https://adbytes.media/blog/ethereums-pectra-upgrade-in-q1-2025-eip-7702-enhances-account-abstraction), lets a regular wallet [delegate its execution](https://snakecharmers.ethereum.org/7702/) to code at a smart-contract address. In this case, the authorization reportedly delegated Binance 14 to code that could move ETH and ERC-20 tokens, including Ethereum-based tokens such as USDT.
The destination contract was unverified, meaning its source code had not been published or matched to the deployed code on a block explorer. That label alone does not prove a contract is malicious. Blockaid’s analysis interpreted the contract’s bytecode as containing a function it called sweep(), which could transfer assets to an attacker-controlled address. The function name was inferred, not confirmed from published source code. The analysis also reported that 1 ETH remained in the wallet, but did not establish why.
At about 20:24 UTC, Binance 14 was [drained of cryptocurrency valued at roughly $2.5 billion](https://mashable.com/tech/binance-hack-cryptocurrency-billions), according to the reported analysis. The transfers included 167, 464 ETH, more than 1.6 billion USDT and other tokens. Binance later said it revoked the affected authorization.
What does Binance’s $6.3 billion figure mean?
Binance estimates that approximately $6.3 billion in cryptocurrency was affected. The exchange has not explained how it calculated that estimate or defined “affected.” The figure should not be read as $6.3 billion stolen, lost by customers or unrecoverable.
The roughly $2.5 billion estimate covers assets drained from Binance 14. It is a different measure from Binance’s broader figure, and the available information does not show how the two relate. The movement of assets alone also does not establish the final customer loss.
Blockaid’s analysis describes related activity involving Binance 16 and wallets on other networks, including Bitcoin, Tron, Arbitrum and Avalanche. Some wallet attributions beyond the Ethereum activity are inferred rather than confirmed, leaving the full cross-chain scope uncertain.
Binance’s suspected entry point is still preliminary
Binance said its initial investigation pointed to a potentially compromised DevOps engineer’s laptop. The laptop may have provided access to an internal service container used to submit withdrawal transactions. Binance said it had found no evidence that a wallet private key had leaked.
Those statements can both be true without proving the signing process was safe. An attacker might gain access to a system that can request or process signatures without extracting a private key. That is one possible explanation, not a confirmed account of what happened. Binance has not established how the authorizations were obtained or publicly linked the suspected laptop to the on-chain activity.
Blockaid’s account traces funding for an operating address through Tornado Cash and says the contract was deployed several hours before the transfers. That tracing claim does not identify the attacker or establish how they got into Binance’s systems.
Some assets were frozen or restricted
Stablecoin issuers can restrict tokens they control. Tether CEO Paolo Ardoino said Tether [froze more than 1.567 billion USDT linked to the suspected breach](https://www.reuters.com/legal/transactional/tether-circle-freeze-238-billion-after-binance-reports-security-incident-2026-10-29/). Circle CEO Jeremy Allaire said Circle froze more than 800 million USDC while coordinating with law enforcement. Ripple stablecoin executive Jack McDonald said Ripple was working with relevant parties to freeze affected RLUSD holdings, but gave no amount.
The Arbitrum Security Council said it moved 74, 559, 805 ARB and 8, 425 ETH linked to the incident into a restricted intermediary wallet. Those assets can move only after further council action or an Arbitrum DAO governance decision.
Binance separately said approximately $3 billion had been frozen across affected assets. The issuer and network figures may overlap with that estimate, and reports give different totals at different points. They should not be added together as if they represented separate pools of funds.
A freeze or restriction is not the same as recovery, and recovery does not guarantee repayment to customers. The available figures do not establish how much was ultimately recovered or returned.
Binance’s response and the questions still open
Binance [temporarily suspended deposits and withdrawals](https://cypro.co.uk/insights/cyber-bulletins/binance-hack-fears-follow-2-billion-outflow/) while it ran security checks. Co-founder Yi He later said deposits were operating normally and withdrawals were expected to resume within the next 48 hours. The reported information does not confirm when withdrawals actually resumed. Binance’s U.S. affiliate said its operations were not affected.
The exchange said it would cover losses using its Secure Asset Fund for Users (SAFU) and company funds. It also said it would publish an updated Proof of Reserves after remediation. That commitment does not settle the final loss or recovery figures, and the available information does not specify the updated disclosure’s methodology.
Founder Changpeng Zhao, who said he no longer managed the exchange, wrote:
“User funds are safe!”
Binance also said it planned to publish a technical post-mortem. That report will matter. The on-chain authorization shows how Binance 14 was redirected more clearly than it shows how the attacker obtained the required signature.
Key questions and answers
-
Did guessing the wallet’s nonce give the attacker control?
No. Blockaid says one of 50 signed EIP-7702 authorizations passed processing. A matching nonce alone cannot replace the required valid signature.
-
Was $6.3 billion stolen?
That has not been established. Binance described approximately $6.3 billion as affected, but has not explained how it calculated the figure or what it includes.
-
Did Binance confirm a private-key leak?
No. Binance said it found no evidence of a leaked wallet private key and identified a potentially compromised DevOps laptop as a preliminary lead. It has not confirmed how the authorization was signed or obtained.
-
Are frozen assets recovered?
Not necessarily. Issuer freezes and Arbitrum’s restriction limit movement, but the reported figures do not establish how much will be recovered or returned to customers.
The security lesson goes beyond private-key custody. Wallet safety also depends on the systems that request signatures, the people and processes that approve them, and the [code a wallet authorizes to act on its behalf](https://adbytes.media/blog/ethereums-pectra-upgrade-eip-7702-exploited-in-phishing-scams-stay-safe). Binance’s post-mortem is needed to establish the full cause, including the role of the [EIP-7702 authorization](https://adbytes.media/blog/ethereums-pectra-upgrade-devnet-6-eip-7702-and-2m-bug-bounty-unveiled) itself.
