At 20:05 UTC on October 29, funds began leaving Binance’s hot wallets across ten blockchains. Roughly twenty minutes later, $6.3 billion was gone, completely gone, in what is now recorded as the largest crypto theft ever, roughly four times what North Korea’s TraderTraitor unit took from Bybit in February 2025. TRM Labs and Chainalysis both attribute this attack to the same group, with TRM citing “high confidence” in the link. No government has officially confirmed the attribution yet.
Binance’s early findings point to a compromised DevOps engineer’s laptop as the entry point, giving the attacker access to a service container that let it push unauthorized withdrawals. Binance says no private keys were leaked, but TRM reads the on-chain evidence differently. Wallets across different chains, using different key types and signing schemes, all produced valid signatures for the attacker within roughly half an hour. That points to a broader compromise of Binance’s hot wallet signing infrastructure, not a single stolen key.
The Ethereum side of the attack was the most carefully planned part of the operation. The attacker used EIP-7702, a feature introduced with Ethereum’s Pectra upgrade in May 2025 that allows a wallet to delegate control to a smart contract. Each delegation only works at one exact transaction count, and a busy exchange hot wallet never stops moving. The attacker’s solution was to pre-sign 50 authorizations in sequence, covering 50 consecutive transaction counts, guaranteeing one would still be valid when the moment came. Three minutes and 24 seconds after taking control, it emptied the wallet in a single transaction, taking 167,464 ETH and 63 tokens, including 1.615 billion USDT. The delegation stayed active afterward, allowing the attacker to sweep new deposits at least six more times over the following three and a half hours.
Tether, Circle, Ripple, and World Liberty Financial together froze approximately $3 billion in assets, but the attacker still managed to move ahead of the freezes. Around 325 million USDT was sold to market makers at more than a 10% discount. At 20:58 UTC, roughly 40 minutes after the initial drain, the attacker deposited $60 million in USDT into Aave as collateral and borrowed 19,762 wrapped ETH, worth approximately $44.6 million, three minutes before Tether froze the address. The USDT collateral is now frozen. The ETH is not. Aave froze 292 reserves across its V3 and V4 markets as a precaution, but the position itself remains overcollateralized at $59.9 million in collateral against $43.8 million in debt, leaving no loss exposure for Aave’s liquidity providers.
Binance says it will cover every dollar of user losses. Co-founder Yi He said withdrawals would start resuming within 48 hours of the announcement.
A few other stories worth your attention this week:
- Binance introduced trading restrictions in Brazil while it seeks a local crypto license. Spot trading and payments remain available during the regulatory review.
- The OCC approved Ripple National Trust Bank, which will manage RLUSD reserves and offer crypto custody. A company that spent years in court with U.S. regulators now holds a federal charter.
- A DBS survey found that 88% of businesses are using or testing tokenized money to manage cash and reach new markets. The figure includes businesses still in testing, not just live deployments, but the breadth of adoption across non-crypto firms is notable.
- Christine Lagarde announces plans to leave the ECB on February 7, 2027, months before her term ends in October, citing the upcoming French elections as a reason to step back. Her departure creates an opening for a new ECB president at a critical moment for the digital euro rollout and MiCA enforcement across the bloc.
- CZ shared security tips after four data breaches hit crypto platforms and South Korean firms this week, raising fresh concerns about phishing and SIM-swapping attacks using leaked customer data.
In AI, Vitalik Buterin backed Kimi 3.1’s decision to remove advanced hacking capabilities from its training data to reduce cyber risk. Separately, a Paribu survey found that 53% of Turkish crypto traders regularly use AI tools, rising to 87% among daily active traders.
The Binance hack alone would have made this a week worth remembering, yet there was more. If you missed anything, here’s your catch-up.
Lead Story of the Week:
Binance Hack Drains $6.3B Across 10 Blockchains (Read More)
Binance confirms a $6.3 billion security incident, reportedly the largest crypto theft on record, four times Bybit’s 2025 hack. (Read The Full Story)
Market Highlights
- Binance Restricts Trading as It Seeks Brazil Crypto License
Binance seeks a Brazil crypto license, allowing spot trading and payments during regulatory review. (Read More)
- Ripple Wins OCC Trust Bank Charter, Boosting RLUSD and XRP
OCC approves Ripple National Trust Bank to manage RLUSD reserves and offer crypto custody services. (Read More)
- DBS Survey: 88% of Firms Test or Use Tokenized Money
DBS reveals that 88% of businesses are using or testing tokenized money to manage cash and access new markets. (Read More)
- CZ Shares Security Tips After Four Data Leaks (Read More)
Four data breaches hit crypto platforms and South Korean firms, raising phishing and SIM-swapping risks. (Read More)
Latest News For You
Christine Lagarde to Leave ECB in February 2027 (Read More)
Christine Lagarde plans to leave the ECB on February 7, 2027, months before her term ends in October. (Read More)
AI News Highlights
- Vitalik Buterin Backs AI Safeguards Against Advanced Hacking
Vitalik Buterin backs Kimi 3.1’s removal of advanced hacking skills from AI training data to reduce cyber risks. (Read More)
- 53% of Turkish Crypto Traders Use AI, Survey Finds
A Paribu survey finds 53% of Turkish crypto traders often use AI tools, rising to 87% among daily active traders. (Read More)
Market Movers
Top Gainers 📈
- Infinity Ground (AIN) +301.78%
Infinity Ground (AIN) is rising due to a $3M buyback and recovery from its September flash crash.
Top Losers 📉
- FUNToken (FUN) −16.68%
FUNToken (FUN) is dropping due to a massive offloading of stolen tokens linked to the recent Binance Hack
Source: CoinGecko
Country Spotlight
Türkiye Unveils Digital Sovereignty Strategy
Türkiye has launched a new Digital Sovereignty Strategy to protect its national infrastructure and reduce its dependence on foreign technology. President Recep Tayyip Erdoğan presented the plan during a high-level Cybersecurity Board meeting at the Presidential Complex in Ankara. The strategy aims to reduce reliance on foreign software, expand domestic high-tech manufacturing, and protect critical networks from international cyber threats. (Read More)
Disclaimer: This roundup is intended solely for informational purposes and should not be considered trading or investment advice. Nothing herein should be construed as financial, legal, or tax advice. Trading or investing in cryptocurrencies carries a considerable risk of financial loss. Always conduct due diligence
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
