How $6.3 Billion Left Binance (What We Know So Far)

Binance says the total impact of the 29 October 2026 attack is about $6.3 billion, and TRM Labs says most of the money moved in about twenty minutes. This deep dive follows the money out of Binance's hot wallets across ten blockchains and explains why the chains saw nothing wrong: every transfer carried a valid signature from Binance's own wallets. We cover what Binance has said so far (a preliminary finding about a compromised engineer's laptop, no evidence of a private key leak, additional points of breach), what TRM describes on Ethereum (an EIP-7702 delegation to an attacker-prepared contract, and a rehearsal beforehand), the race between the thief and the Tether and Circle freezes, and who analysts say is behind it (TRM and Chainalysis say TraderTraitor; Binance and law enforcement have not confirmed). Facts as of 30 October 2026: this is a developing story, every claim names who made it, and anything we reason about ourselves is marked as our reading. Nothing here is an exploit guide or financial advice. Facts as of 30 Oct 2026. Chapters 0:00 Cold open 1:02 The till, not the vault 2:17 The chains saw nothing wrong 3:32 How they reached the signer 5:27 The race against the freezes 6:57 Who is blamed, and why Bybit rhymes 8:27 What it means, and what is unknown Sources • Binance: Security Incident Update (30 Oct 2026): https://www.binance.com/en/support/an... • TRM Labs: North Korea steals USD 6.36 billion from Binance in the largest hack in history (30 Oct 2026): https://www.trmlabs.com/resources/blo... • Chainalysis: The $6.4 Billion Binance Exploit, tracing the North Korea link (30 Oct 2026): https://www.chainalysis.com/blog/bina... • Bitquery: Binance hack, $6.3B drained on 9 chains (on-chain investigation): https://www.bitquery.io/investigation... • TechCrunch: Binance pauses withdrawals as hackers suspected of stealing billions in crypto (29 Oct 2026): https://techcrunch.com/2026/10/29/bin... • CoinDesk: Binance loses over $6 billion in the largest crypto hack to date (29 Oct 2026): https://www.coindesk.com/business/202... • NBC News: Binance targeted in $6.3 billion crypto heist, the largest ever (29 Oct 2026): https://www.nbcnews.com/business/mark... • CryptoTicker: Crypto crash after the Binance hack, the timeline of the night (30 Oct 2026): https://cryptoticker.io/en/crypto-cra... • The Next Web: Binance says its $6.3bn hack involved more than a compromised laptop (30 Oct 2026): https://thenextweb.com/news/binance-h... • EIP-7702: Set Code for EOAs (Ethereum Improvement Proposal): https://eips.ethereum.org/EIPS/eip-7702 • FBI IC3 PSA250226: North Korea responsible for $1.5 billion Bybit hack (26 Feb 2025): https://www.ic3.gov/PSA/2025/PSA250226 • Safe Ecosystem Foundation: Statement on the Bybit incident (28 Feb 2025): https://safefoundation.org/blog/safe-... • Cointelegraph: Bitget CEO suspects North Korea behind the hack, citing IP clues: https://cointelegraph.com/news/bitget... • Binance: Proof of Reserves: https://www.binance.com/en/proof-of-r... Logos belong to their owners and are shown to identify the companies. Animation drawn in code; every fact is sourced above. #SystemDesign #BinanceHack #BinanceHackExplained #BinanceStolen #TechExplained