Attackers transferred around $6.34 billion in cryptocurrencies from at least 11 Binance wallets on Oct. 29, using authorizations that kept working after the exchange suspended withdrawals and shut down hot-wallet services. Dark Reading reported that Binance detected suspicious activity within minutes, but stopping the transfers required revoking permissions recorded on the blockchain.
The incident has practical consequences for exchanges and other firms processing cryptocurrency transactions in real time: a withdrawal shutdown may leave an attacker’s existing authority intact. Binance’s Nov. 3 post-mortem, quoted by Dark Reading, said those permissions allowed attackers to move assets independently of its normal withdrawal infrastructure.
The attack ran from 20:05 UTC until the last recorded transaction at 23:56 UTC, nearly four hours later. Dark Reading reported that Binance subsequently froze and recovered about $2.85 billion in attempted stolen assets.
How the authorization survived the shutdown
The attackers exploited Ethereum’s EIP-7702 mechanism, introduced in 2025, which allows an account to delegate execution to smart-contract code—software that runs on the blockchain. They used that authority to install a “sweeper,” code that automatically moves funds to an attacker-controlled address.
Blockchain security firm BlockAid’s analysis found that a primary Binance treasury wallet held more than five dozen cryptocurrencies worth approximately $2.5 billion. The sweeper transferred those assets to an address created minutes earlier, leaving the wallet with a single ETH coin.
BlockAid co-founder and CEO Ido Ben-Natan explained that an EIP-7702 authorization creates a standing delegation. Once recorded on the blockchain, the attacker’s code can move both existing funds and later deposits until the wallet revokes that authority. The authorization itself specifies neither an amount nor a destination, putting it outside the transaction details that withdrawal controls normally inspect.
Large transfers from other wallets to the same address triggered Binance’s internal alerts. The exchange took countermeasures, but its post-mortem said additional blockchain transactions were necessary to revoke the authorizations; stopping its own withdrawal services did not invalidate them.
Compromised developers led to signing access
Binance’s post-mortem described two routes into developers’ systems. One developer downloaded a compromised version of Homebrew, an open-source package manager for Macs. Another completed a software assignment during a fake job interview, compromising that developer’s machine.
The attackers used access to those two systems and a third developer’s system to obtain signing privileges—the authority needed to approve blockchain actions. They prepared 50 signed authorizations targeting the wallet blockchain analysts call “Binance 14.”
The attackers submitted all 50 together to accommodate the wallet’s nonce, a sequential counter used to validate transactions. By preparing a window of possible counter values, they needed only one authorization to match.
Dark Reading reported that the FBI attributed the attack to North Korean operators associated with TraderTraitor. The bureau released more than 600 Ethereum addresses, 19 Bitcoin addresses and one SOL address linked to the group.
Sygnia’s vice president for North America, Avi Sambira, compared the developer targeting with the Feb. 21, 2025, ByBit theft, in which Sygnia found that attackers compromised a Safe{Wallet} developer’s Mac nearly three weeks before the theft, then used an AWS token to operate in its cloud environment for roughly two weeks before altering the signing interface.
Sambira said Binance’s disclosure appeared consistent with a similar progression from compromised endpoints and internal tools to credentials, tokens or container access supporting wallet signing. His broader warning was that developer identities, code repositories, software build-and-deployment pipelines, cloud administration systems and third-party integrations can sit only one or two trust boundaries from withdrawal authority.
A known technique, with a larger consequence
EIP-7702 sweeper attacks had already caused documented losses. Research presented at USENIX Security in August 2026 by researchers from Hong Kong University of Science and Technology and two other Chinese schools identified at least 924 malicious smart contracts enabled through the mechanism, causing at least $2.3 million in losses.
BlockAid separately reported at least $1.1 million in losses across four instances and had predicted a billion-dollar attack before the end of 2026.
Experts quoted by Dark Reading questioned whether Binance had sufficient controls to identify malicious authorizations and disable them quickly. The exchange emphasized monitoring and anomaly detection in its account of the incident; it did not respond to Dark Reading’s requests for comment.
What cryptocurrency firms should prepare
Ben-Natan recommends that firms processing cryptocurrency transactions use simulations to detect malicious rules, enforce limits on transaction amounts and destinations, and alert on bursts of large transfers. He also recommends a prebuilt, tested emergency switch that pauses signing and stops wallet refills, limiting what a sweeper can take while responders revoke its authority.
Sambira recommends visibility across identities and their permissions, infrastructure integrity, custody and transaction approval, and detection both on and off the blockchain. Monitoring blockchain transactions alone catches the attack too late in its progression, he said.
Firms should track every identity and system able to initiate, approve, modify or execute transactions, and prepare to suspend those privileges. Response capabilities should include revoking identities and tokens, pausing transfers, isolating wallets and rebuilding compromised infrastructure within minutes, with authority to act established beforehand.
TRM Labs’ global head of policy, Ari Redbord, said rapid monitoring and relationships with relevant stakeholders can help responders limit losses. Cryptocurrency transfers let thieves move funds in real time, making response speed particularly consequential. Firms should test their containment controls before an incident and rehearse them regularly so responders can use them in the first minutes of an attack.
