Hackers siphoned approximately $6.36 billion from Binance wallets across ten blockchain networks on October 29, 2026, as reported by blockchain intelligence firm TRM Labs. TRM termed the incident the largest cryptocurrency theft ever recorded, nearly four times the $1.5 billion Bybit hack in February 2025. Binance confirmed a security breach, temporarily halting withdrawals on several networks and stating that user funds were safe.
The perpetrators targeted several cryptocurrencies, including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. On Ethereum, the attacker exploited EIP-7702, a feature that allows a normal wallet to delegate its behavior to smart contract code through a signed authorization. Three minutes and 24 seconds after the initial theft, the attacker withdrew 167,464 ETH and 63 tokens, including 1.615 billion USDT, in a single transaction.
TRM indicated that valid signatures across different blockchains pointed to compromised hot wallet signing infrastructure, not simply a single malicious authorization. Ripple restricted 40.5 million RLUSD, and World Liberty Financial froze 27.8 million USD1. The Arbitrum Security Council moved 8,426 ETH and 74.6 million ARB beyond the attacker's control through emergency measures.
For defenders, TRM advised screening deposits against identified attacker addresses, monitoring treasury wallets for unexpected EIP-7702 delegations, and rejecting unapproved authorization requests.
Join 16,000+ SOC teams using ANY.RUN to efficiently investigate threats and reduce manual workload.
