How Binance's Own Deposit Pipeline Kept Refilling a Hacked Wallet

On October 29, 2026, attackers drained about $6.4 billion from Binance across ten blockchains. TRM Labs and Chainalysis attribute the theft to North Korea. Most of the money left in about 20 minutes.

The part worth studying came after. On one Ethereum hot wallet, the attacker's access stayed open for nearly four hours. During that time, Binance's normal systems kept routing deposits into the wallet. The attacker kept taking them.

You don't need to care about crypto to learn from this. It is a story about automation that keeps running for whoever controls its target.

Structure as described in PandaSecurity's on-chain analysis and Gizmodo's reporting.

The mechanism: a wallet that runs someone else's code

An exchange hot wallet is an online account that holds funds for fast withdrawals. On Ethereum, a normal account just holds a balance and signs transfers.

EIP-7702, a final Ethereum standard, adds an option. An account owner can sign an "authorization" that points their account at a smart contract. Once a matching authorization is processed, calls to the account run that contract's code, using the account's own balance.

Three rules in the standard matter here:

Each authorization must carry the account's current nonce. A nonce is a counter that goes up with every transaction.
A failed authorization is skipped, not rejected. Processing carries on with the next authorization in the list.
The delegation persists until changed. Nothing expires it.

How the attack used those rules

PandaSecurity's on-chain analysis lays out the steps.

The attacker deployed a "sweeper" contract and tested it on wallets it controlled.
Binance 14, the hot wallet, sent transactions almost every block, so its nonce kept changing. The attacker submitted 50 authorizations signed with Binance 14's key, covering 50 consecutive nonces. The aim was that one would match when the transaction landed. One did.
Binance 14's code now pointed at the sweeper.
The attacker called Binance 14. The sweeper ran as Binance 14 and moved about 167,464 ETH and more than 60 tokens out.
The delegation stayed in place. Binance's systems kept sending deposits and rebalancing transfers into Binance 14.
The attacker swept again.

Sequence from PandaSecurity's analysis; later sweep times from TRM Labs.

The evidence

TRM Labs counts six more sweeps of new funds after the main theft, between 20:41 and 23:56 UTC. Stablecoin issuers began freezing assets from 21:01 UTC. Ripple froze its RLUSD stablecoin in the compromised hot wallet, so new deposits of it could not be swept. Tether, Circle and World Liberty Financial also froze assets.

At 00:10 UTC on October 30, Binance 14 cleared the delegation by authorizing the zero address. The standard allows exactly that. PandaSecurity adds a warning: "Clearing the code removes the attacker's program, but it does not rotate the key." Anyone who could still sign could install a new delegation.

How the attacker got signatures is still unclear. Binance first said a compromised DevOps engineer's laptop gave the attacker access to a service container that could submit withdrawals. It said it found no evidence that private keys leaked. It later said there were additional breach points. Its full postmortem is not out.

What to do

These apply well beyond crypto.

List every automated flow into a sensitive resource. Deposits, syncs, cron jobs, backfills, replication. During an incident, each one may be working for the attacker.
Build one switch that stops them all. Then test it. Revoking access does not stop new data or money flowing in.
Treat "revoke" and "rotate" as separate steps. Removing the attacker's foothold does not remove their ability to get a new one.
Watch for authority changes, not just transfers. A change to what an account can do may matter more than any single payment.

Where this breaks down

The root cause is unconfirmed. No source says when Binance spotted the delegation or paused anything. We also don't know what stopping deposits would have cost customers. Pausing an exchange's deposits is not free.

The totals also vary. TRM says $6.36 billion, valued at the time of each transfer. Chainalysis says about $6.4 billion. Gizmodo reports Binance's own estimate of about $6.3 billion.

The weakest part of this post is the jump from crypto to general advice. EIP-7702 is specific to Ethereum. The lesson about automation is an inference, not something any source here states as a finding.