Blockchain analytics firm BitOK has released a comprehensive transaction-by-transaction breakdown revealing how an attacker drained $6.15 billion across nine blockchains from Binance in just 31 minutes on October 29, 2026. While Binance initially estimated its losses at $6.3 billion after binance hot wallets were drained, technical analysis confirms the perpetrator compromised an internal DevOps laptop to manipulate the exchange's own signing systems without stealing private keys.
Rehearsals, System Breach, and EIP-7702 Exploitation
Preparations began on October 28 when six Tornado Cash withdrawals funded the attacker's primary wallet and two helpers. On October 29, the attacker conducted two separate rehearsals between 02:28 UTC and 16:47 UTC using smart contracts to test permissions under Ethereum's EIP-7702 framework. After verifying control by draining test amounts of USDT and USDC, the attacker deployed a refined smart contract capable of executing arbitrary calls on behalf of delegating wallets.
By compromising a Binance DevOps engineer's laptop, the attacker accessed internal service containers to issue fake withdrawal orders. At 20:20:59 UTC, the attacker bypassed Ethereum nonce counter restrictions on the Binance 14 hot wallet by tricking the system into signing 50 authorization slips simultaneously. This single move allowed the malicious contract to take control and execute a single transaction draining 65 different tokens worth over $2.2 billion, including 1.615 billion USDT and 167,464 ETH, alongside 823 million USDC. A second wallet, Binance 16, was simultaneously exploited for 28,005.6 ETH and 55.7 million USDT via nine falsified transfers.
Multi-Chain Theft Breakdown and Unfreezable Swaps
Between 20:04 UTC and 20:35 UTC, hot wallets across XRP Ledger, Solana, Bitcoin, Ethereum, Tron, Base, Optimism, Arbitrum, and Avalanche were systematically drained. Total stolen assets included 18,270.2 BTC, 197,540 ETH, 2.49 billion USDT, 823 million USDC, 233.46 million XRP, and 970,522 SOL. Transactions exhibited non-standard formatting and paid gas fees 2 to 2.7 times higher than normal network rates.
- $6.15 billion stolen in 31 minutes across 9 blockchain networks.
- EIP-7702 exploited via a 50-key nonce brute-force attempt against the Binance 14 wallet.
- Over $2.2 billion swept in a single Ethereum transaction covering 65 token types.
- Rapid laundering via Uniswap, Aave, and SunSwap to evade centralized stablecoin freezes.
To prevent issuer freezes from Tether and Circle as Binance investigated the security incident, the attacker quickly converted stablecoins into unfreezable native assets. On Ethereum, 435 million USDT was swapped for ETH via Uniswap between 20:34 UTC and 21:09 UTC, while 60 million USDT was deposited into Aave to borrow 19,762 ETH. On Tron, 612.7 million USDT left the Binance-Hot 7 wallet, with 234 million USDT converted into 638.2 million TRX across 16 transactions on SunSwap.
Why It Matters
This investigation highlights critical structural vulnerabilities in automated exchange payout architectures and DevOps security controls. By leveraging smart contract delegation features like EIP-7702 alongside internal service container access, attackers can subvert multi-sig and signing infrastructure without ever needing raw private keys. As decentralized finance protocols and token issuers refine freezing mechanisms, the speed at which exploits cycle through DEXs underscores the ongoing challenge centralized platforms face in mitigating real-time exploit losses.
