by Coinstrooper Crypto Articles
Quick Take
  • Instead, they made Binance’s own systems approve the theft.
  • This guide follows the heist in order and explains each technical term along the way.
  • Hot wallets are an exchange’s online wallets, kept connected so withdrawals go out quickly.
  • Every transfer must be approved with a wallet’s private key, a secret number.

What Happened

October 28: Preparation Before the Hack

Market Context

On October 29, 2026, an attacker drained about $6.15 billion from Binance in 31 minutes, one of the largest thefts in crypto history, or rather, internet history.

Binance first put losses at $6.3 billion; blockchain analytics firm BitOK’s transaction-by-transaction tracing puts them at $6.15 billion across nine blockchains.

Why It Matters

Before touching Binance, the attacker practised on their own wallets, the way a burglar might test a lock-pick on their own front door first.

The final version had one extra power: it could make a wallet do anything, not just send tokens. That night, this let it order a Binance wallet to release 823 million USDC. A tool this tailored suggests the attacker already knew how Binance’s wallets were set up.

“The difference between the two versions was critical. The main contract included a function that could execute arbitrary calls on behalf of a wallet that had delegated control to it. The attacker later used that function to drain 823 million USDC from a Binance smart wallet,” BitOK explained.

Details

The attacker never stole Binance’s private keys. Instead, they made Binance’s own systems approve the theft. This guide follows the heist in order and explains each technical term along the way. All times are UTC.

The Basics: How an Exchange Moves Money

Hot wallets are an exchange’s online wallets, kept connected so withdrawals go out quickly.

Signing. Every transfer must be approved with a wallet’s private key, a secret number. Exchanges use automated systems to sign thousands of payouts a day.

Nonces are an Ethereum wallet’s transaction counter. A busy wallet’s nonce rises constantly.

Freezable coins. Stablecoin issuers such as Tether (USDT) and Circle (USDC) can freeze addresses. Nobody can freeze native coins like BTC, ETH or TRX.

Every blockchain transaction costs a small fee. To fund their wallets without leaving a trail, the attacker used Tornado Cash, a “mixer” that pools many users’ coins so withdrawals cannot be linked to deposits.

Six Tornado Cash withdrawals funded the operator’s wallet and two helpers.

October 29, 02:28–16:47 UTC: Two Rehearsals

The tool was a smart contract: a program that sits on Ethereum and does exactly what its code says. This one was built to empty any wallet that gives it permission to act on the wallet’s behalf. (Ethereum’s EIP-7702 feature allows that kind of permission; more on it below.)

02:28 — the attacker publishes a test version of the draining program.

13:51–14:24 — first rehearsal. They put small amounts of USDT and USDC into two of their own wallets, give the test program permission over them, and trigger it. Both wallets are emptied. The tool works.

15:59 — they publish the final version, the one later used on Binance.

16:20–16:47 — second rehearsal, repeating the test with the final version.

October 29, 20:04 UTC: The 31-Minute Drain

From 20:04:52 to 20:35:53, the attacker emptied Binance hot wallets on XRP Ledger, Solana, Bitcoin, Ethereum, Tron, Base, Optimism, Arbitrum and Avalanche. The haul included:

18,270.2 BTC,

197,540 ETH,

2.49 billion USDT,

823 million USDC,

233.46 million XRP,

970,522 SOL and dozens of other tokens.