A $6.3 Billion Lesson: Inside the Binance Hack, and Exchange Security in the Age of AI Agents

Published: 31 October 2026 (Japan time) The incident is still under investigation, and the amounts and details may change as official updates come in. This article is a technical and security discussion only and is not investment advice.

The short version

• Scale: On 29 October 2026 (UTC), about $6.3 billion was drained from multiple Binance hot wallets across 10 blockchains. It is the largest cryptocurrency theft on record, roughly four times the Bybit theft of February 2025 (about $1.5 billion).
• Method: The attackers did not "break" the blockchain or its cryptography; they got Binance's own signing system to sign malicious transactions. The way in was a compromised laptop belonging to a DevOps engineer. On Ethereum, the attackers used the EIP-7702 delegation mechanism to turn a heavily used hot wallet into a "siphon" that took orders only from them.
• Containment: Stablecoin issuers and others froze about $3 billion in total, and Binance pledged to cover users' losses in full from company funds.
• Attribution: Several on-chain analytics firms attribute the attack to TraderTraitor, the North Korean hacking group behind the Bybit theft.
• The point most worth reflecting on: The attackers moved most of the funds in about 20 minutes, while it took about two hours from the first anomaly to the withdrawal pause. Closing that gap is exactly where AI agents can do the most good. They can detect, block and coordinate a response at machine speed, provided the boundaries are clear: an agent may hold the "brakes", never the "keys".

---

I. What happened: how $6.3 billion was moved out

All times below are UTC; Beijing is UTC+8 and Tokyo UTC+9. For example, the attack began at 20:05 on 29 October (UTC), which was 04:05 on 30 October in Beijing and 05:05 on 30 October in Tokyo.

1. Preparations a day ahead

According to on-chain analysis, the attackers' operating wallet received several small amounts through the mixing service Tornado Cash from the morning of 28 October. On 29 October, the attackers first deployed an initial version of a "sweeper" contract and tested and rehearsed it on wallets they controlled. At 15:59 that day they deployed the final version, which only an operator address of their choosing could call.

2. The way in: one engineer's laptop

Binance's preliminary investigation found that a DevOps engineer's laptop had been compromised. From there the attackers got into a service container and submitted unauthorized withdrawal transactions. On 31 October, Binance's two co-CEOs signed a second update, which made three points:

• Intrusion points other than this laptop have also been found;
• There is so far no evidence that wallet private keys were leaked;
• More technical details are expected within about 48 hours.

The CEO of on-chain security firm Blockaid also described it as misuse of the signing infrastructure rather than theft of private keys. To put it another way, the keys may have stayed locked in the safe the whole time, but someone took control of the "stamping process". Blockaid's later technical analysis, however, concluded that the signing capability of at least one hot wallet had fallen into the attackers' hands. Whether any private key actually left Binance will have to wait for the official technical report.

3. The key move: EIP-7702 turns a hot wallet into a "siphon"

EIP-7702 is a feature Ethereum introduced in its 2025 upgrade. Once an ordinary wallet address (an EOA) signs an "authorization", it can delegate its execution logic to a piece of smart contract code. The intent was to give ordinary wallets capabilities such as batched transactions and sponsored fees. This time it was turned against its purpose, as follows:

1. 20:20:59: The attackers submitted a type-4 transaction bundling 50 EIP-7702 authorizations for the hot wallet "Binance 14", one for each of 50 consecutive nonces.
2. Why 50: Binance 14 was still processing user withdrawals as normal, so its nonce kept changing and the attackers could not predict the exact value. They "cast a net" instead: one match was enough. One did match, and Binance 14's execution logic was delegated to the attackers' sweeper contract.
3. 3 minutes 24 seconds later (20:24:23): The attackers called the sweep function and, in a single transaction, moved out 167,464 ETH and 63 kinds of tokens, including 1.615 billion USDT, worth about $2.5 billion.
4. The delegation stays in force: Once a delegation takes effect, it stays in effect. Binance's automatic consolidation system kept routing user deposits into Binance 14 afterwards, and a second sweep about 40 minutes later (21:04) carried off those newly arrived funds as well.

4. Ten chains, twenty minutes

Meanwhile, multiple Binance hot wallets on 10 chains also signed ordinary transfers to attacker addresses. The 10 chains were Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.

By TRM Labs' count, about $6.36 billion was moved out, most of it within about 20 minutes of 20:05, and the attack window as a whole lasted until 23:56. Binance's own estimate is about $6.3 billion; Chainalysis puts it at about $6.4 billion.

5. Freezes and containment

Note that a freeze is not a recovery. A stablecoin issuer can freeze the tokens it issued, and can later burn them and reissue them to the victim, but that requires a legal process. Assets with no central issuer, such as BTC and ETH, cannot be frozen this way. A sizeable share of the roughly $3.3 billion not yet frozen is exactly this kind of asset.

6. Who is behind it

• TRM Labs attributes the attack "with high confidence" to the North Korean hacking group TraderTraitor.
• Chainalysis reached the same conclusion and noted that the stolen funds were mixed on-chain with funds from the Bitget theft this September. The Bitget theft, about $388 million, has also been attributed to North Korea.
• The US FBI had already determined that the same group was behind the theft of about $1.5 billion from Bybit in February 2025.

Binance itself has not publicly named the attackers.

7. Another attack the same day: Polymarket

A few hours before the Binance incident, the prediction market Polymarket was also attacked. Over roughly an hour from 17:05 UTC, attackers moved about $2.6 million to $2.7 million out of several hundred user accounts.

Polymarket said one of its third-party service providers had been compromised and that its core smart contracts were not affected. Security researchers found suspicious code in a third-party script loaded by its website front end; the code read users' trading sessions, sold their positions and moved the assets out. It was Polymarket's second security incident on a multi-million-dollar scale in four months.

---

II. Why exchanges are always the prime target

In traditional securities markets, "trading" and "custody" are separate: the exchange only matches orders, and securities are held by a dedicated central securities depository. A centralized cryptocurrency exchange combines the two: it matches trades and also holds users' assets in one place. That creates three structural risks:

1. Value is highly concentrated: Breaking into one exchange is like opening millions of users' wallets at once.
2. Hot wallets must stay online: To let users withdraw at any time, an exchange has to keep an online signing capability, so its signing systems stay exposed to the network for long periods.
3. On-chain transfers are irreversible: Traditional finance has clearing, reversal and stop-payment procedures; once an on-chain transaction is confirmed, there is almost no way back, apart from the few stablecoins that can be frozen.

---

III. From Bybit to Binance: the same playbook

Taken together, the three cases share four traits:

1. The targets are people, processes and the supply chain, not cryptography. In none of the cases did anyone "compute the private key". The ways in were a developer's computer, a third-party service and a front-end script.
2. Signing is the last gate. As long as the signing system is willing to sign, cold wallets, multisig and hardware security modules all fail. The signing side must understand for itself what it is signing.
3. Automation cuts both ways. Automatic consolidation and automatic top-ups make operations efficient, but when something goes wrong they keep "feeding the attacker funds".
4. Attack and defense move at very different speeds. The attackers moved most of the funds in about 20 minutes, while the defenders took about two hours from the first anomaly to the withdrawal pause.

---

IV. Was AI used in this attack?

There is no public evidence so far that AI was used in this attack. But it came at a particular moment: the security community has called the whole of October "Black October", after a string of AI-related security incidents:

• Fixes for critical PHP vulnerabilities found with the help of AI (PHP2Shell) were released on 21 October;
• The AI coding-agent platform OpenCode, the developer platform Railway and the AI gateway LiteLLM had security incidents one after another, putting credentials such as customers' API keys at risk of exposure;
• Microsoft Threat Intelligence disclosed that state-backed hacking groups are using AI-driven penetration-testing frameworks.

AI is on the defending side too. Blockaid says its transaction security engine flagged the type-4 transaction that delegated Binance 14 as malicious as soon as it saw it, and confirmed the whole attack mechanism within 11 minutes with the help of AI models.

So the better question is not "does AI make hackers stronger" but whose detection and response can run at machine speed. After "Black October", several security experts have also argued that the core of the next phase of cybersecurity is resilience: how fast you can find an intruder, contain the damage and restore the business.

---

V. A security hardening checklist for trading platforms

None of the following depends on AI. These are the basics every trading platform and wallet provider should have in place first.

1. Development and operations endpoints

• Dedicated workstations: Allow access to production only from dedicated privileged access workstations (PAWs), isolated from the computers used for everyday office work, web browsing and instant messaging.
• No long-lived credentials: Use FIDO2 hardware keys plus short-lived credentials, grant access temporarily per ticket with automatic expiry, and keep no long-lived production credentials on laptops.
• Endpoint protection: Deploy EDR and alert in real time on anomalous processes, remote-control tools, suspicious browser extensions and dependency packages on developer machines.
• Defense against social engineering: Groups like TraderTraitor routinely break into engineers' computers with malicious project code disguised as fake job offers, fake partnerships or "a quick interview exercise". Engineers need dedicated security training.

2. Signing infrastructure (the most important link)

• Separate building from signing: The service that submits transactions and the service that approves signatures must be separate. The signing side (HSM / MPC nodes) needs its own built-in policy engine that decodes and judges each transaction itself, without trusting a "transaction summary" passed down from upstream.
• Deterministic hard rules:
  • Hot wallet keys must never sign EIP-7702 authorizations (an authorization's signing payload starts with the magic byte 0x05, so the signing side can identify it exactly);
  • Never sign approve / permit for contracts that are not on the allowlist;
  • Sign only through the standard withdrawal flow, and only to verified addresses.
• Amount and rate limits: Set outflow caps per transaction, per address, per unit of time and per wallet; anything over the cap needs approval from several people.
• Simulate before signing: Simulate every transaction in a forked environment first and check that the resulting asset changes match the stated intent.
• Keep little in hot wallets: Top up hot wallet balances dynamically to match the next few hours of withdrawal demand, and keep large holdings on the cold side.
• Account state checks: Continuously check the on-chain code field of every hot wallet address. The moment a delegation designator starting with 0xef0100 appears, raise an alert and remove that wallet from consolidation routing.

3. Automated processes need circuit breakers

• Subscribe to wallet health: Every automated job, from consolidation and top-ups to withdrawals, must subscribe to a "wallet health" status and stop sending funds to a wallet automatically as soon as it is flagged as abnormal. The second sweep in this incident carried off exactly the funds that automatic consolidation had sent in.
• Tiered circuit breakers: First throttle, then pause a single chain, and finally pause everything. Circuit-breaker actions must be approved in advance and must be reversible with one click.

4. Front end and third-party dependencies

• Use CSP allowlists and SRI checks, and keep third-party scripts to a minimum; critical trading pages should load no third-party marketing or monitoring scripts.
• Monitor the hashes of front-end build artifacts, and alert immediately whenever the JS actually loaded in production differs from the released version.

5. Incident collaboration channels

• Set up contact channels in advance with stablecoin issuers such as Tether and Circle, on-chain analytics firms and law enforcement, and agree on data formats (addresses, transaction hashes, evidence packages).
• Run a drill every quarter, and bring the target time "from detecting an anomaly to filing a freeze request" down to minutes.

6. Reserves and transparency

• Set up a user protection fund and publish proof of reserves regularly; after an incident, publish proof of reserves and a technical report as quickly as possible to keep users' confidence.

---

VI. Strengthening trading platform security with AI agents: a practical architecture

Core principle: agents hold the brakes, not the keys

1. Asymmetric permissions: An agent can refuse, pause and escalate, but cannot approve, sign or transfer.
2. Deterministic rules as the backstop: Known dangerous patterns (such as a hot wallet signing an EIP-7702 authorization) are blocked by hard rules; the agent's job is to spot new patterns the rules do not cover.
3. Pre-authorized, reversible actions: Playbooks for circuit-breaker actions are approved by people in advance; the agent runs them only when the conditions are met, and they can be rolled back.
4. A human in the loop: Actions that affect users and are hard to undo, such as external notifications, freeze requests and resuming withdrawals, all need human confirmation.

Five agent roles

Running the numbers on this incident's timeline

This table is not a guarantee drawn up with hindsight. Even with AI agents, a manipulated signing system may still sign a few malicious transfers. But amount limits, circuit breakers and coordinated freezes can shrink the time to contain losses from "hours" to "minutes", and at a scale of $6.3 billion that means a difference of billions of dollars.

Securing the agents themselves

AI agents are a new attack surface in their own right and must be protected as "high-value systems":

• Prompt injection defense: On-chain data (token names, memo fields), web pages and ticket contents can all carry prompt injection. Everything external an agent reads must be treated as data, never as instructions.
• Least privilege and short-lived credentials: Keep no production keys in an agent's runtime environment. The credential exposures at an AI gateway and an AI coding platform during "Black October" are a warning.
• Full audit trail: The inputs, reasoning and actions behind every decision can be traced.
• False-positive management: Use tiered responses and start with a trial run in "shadow mode", avoiding both crying wolf and harming legitimate users.
• Regular red teaming: Red-team the agents themselves, including scenarios that try to lure them into exceeding their authority or bypassing the rules.

Rollout roadmap (for small and mid-sized trading platforms and wallet providers)

---

VII. Advice for everyday users

• Spread your holdings: Don't keep all your assets on any single exchange. For long-term holdings, consider self-custody in a hardware wallet, with your seed phrase safely backed up.
• Harden your account: Turn on a withdrawal address allowlist and use a hardware key for two-factor authentication.
• Watch for follow-up phishing: Phishing scams tend to surge after a major incident. Don't click or trust any link, direct message or phone call about "compensation claims" or "asset migration"; rely only on announcements through official channels.
• Pay attention to platform transparency: Keep an eye on a platform's proof of reserves and user protection fund.

---

Conclusion

The core of this $6.3 billion lesson is not stopping every intrusion; it is how quickly a system can detect one and contain the losses once it has happened. Attackers already move at machine speed, and defenders must too. AI agents are no panacea, but within clear permission boundaries they can compress a trading platform's most vulnerable "golden hour" into a few minutes.

SolanaLink provides cloud infrastructure, IT operations and AI agent implementation services. If your team is evaluating ways to harden the security of a trading system, wallet service or web application, please get in touch.

---

References

• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
• Chainalysis: The $6.4 Billion Binance Hack: Tracing the North Korea Link
• Blockaid: Binance $5.5B Hack: Using Advanced AI Models, Blockaid Detects the Biggest Theft in Crypto History
• Cointelegraph: Binance hack may involve private key "misuse," not theft: Blockaid CEO
• The Crypto Times: Binance Hack Explained: How $6.3 Billion Was Drained in 20 Minutes
• HackenProof: Binance Hack 2026: Inside the $6.3B Breach
• NBC News: Binance targeted in $6.3 billion crypto heist, the largest ever
• Reuters (via Yahoo Finance): Binance seeks to shore up confidence after record $6.3 billion heist
• CNBC: Binance's $6.3 billion hack: What we know and what comes next
• CoinDesk: Experts divided over Binance hack asset freezes
• Al Jazeera: Binance says $6.3bn stolen in biggest crypto heist in history: What we know
• TechFlow: Binance second update on the security incident
• The Block: Polymarket resumes trading after $2.65 million exploit
• Axios: Inside "Black October": AI's cyber scare delivers a Y2K lesson
• CNBC: AI's "Black October": Critical PHP flaws set off global security scramble