How Binance’s hot wallets were drained

One valid Ethereum authorization became a standing drain. Nine other networks used ordinary signed transfers. Binance has replaced most of the affected backing, but replacement is not recovery and the final net loss is still unknown.

1. The service path remains under investigation

   Binance says it contained the compromised infrastructure, revoked affected authorizations and added controls. Deposits remained available while withdrawals were paused. On October 31 the company still described November 1 as a target for reopening withdrawals; we found no later official confirmation that the service had reopened when this report was updated.

   The distinction matters. A laptop can be the entry point without being the whole mechanism. The unanswered question is how the attacker reached systems able to authorize withdrawals across ten networks.

2. A valid authorization became a standing drain

   Blockaid traced test wallets and a contract deployed before the attack. At 20:20:59 UTC, one transaction carried 50 EIP-7702 authorizations signed with Binance 14’s key. One matched the wallet’s live nonce. Three minutes later, the contract swept the wallet’s ETH and tokens.

   EIP-7702 lets an externally owned account delegate execution to contract code. The authorization remained useful until Binance revoked it, so later deposits could also be moved. Etherscan records 2,961.99 ETH arriving at Binance 14 more than three hours after the authorization was created. No later outgoing transfer appears in the address record.

   A signing service can produce a valid signature without exposing the raw key. That can reconcile the on-chain authorization with Binance’s statement that it found no key leak, but it is still an inference, not a published root cause.

3. Ethereum explains one path, not the whole theft

   TRM estimates that about $6.36 billion left Binance-attributed wallets across ten blockchains, mostly in roughly 20 minutes from 20:05 UTC. It says the nine non-Ethereum networks used ordinary signed transfers. The coordinated pattern points beyond a single smart-contract trick and toward Binance’s wider signing infrastructure. Binance’s technical post-mortem is still pending.

4. A freeze, a replenishment and a recovery are different events

   ~$6.3BBinance’s estimated incident impact

   ~$3BAssets Binance reported frozen on-chain

   90%Affected asset backing Binance said it had replenished

   Issuers can block tokens such as USDT and USDC at named addresses. ETH and BTC have no equivalent issuer freeze. A frozen balance is inaccessible at its current address; it has not been returned to Binance.

   On October 30 Binance said it had set aside more than $6.34 billion and already held $5 billion in the exact affected token assets. On October 31 it said the replenishment ratio had reached 90%, with BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC fully backed. The last 10% consisted of less liquid tokens it was still buying through market and over-the-counter channels.

   Binance says the replacement assets come from SAFU, excess from Futures Insurance Funds and its corporate treasury. It took a new Proof of Reserves snapshot at 00:00 UTC on October 31. The company said the full zero-knowledge proof would take 40 to 50 hours and expected it by November 3. That is progress on customer backing, not a reconciliation of money recovered from the attacker.

5. Aave reopened markets with the attacker assets constrained

   Aave Risk reported one attacker position: $59.9 million USDT collateral against 19,762 WETH debt, valued at $43.8 million in its assessment. The position was over-collateralized and subject to ordinary liquidation.

   Aave initially froze 175 V3 reserves across 16 networks and 117 V4 reserves across four. Its staged rollback reopened reserves while keeping selected assets found in the attacker cluster at zero loan-to-value or zero collateral factor for new borrowing. Risk stewards also removed roughly $3.7 billion of unused V3 borrow capacity and $130 million on V4 before reopening. This was a containment change inside Aave, not a recovery by Binance.

   TRM separately traced $300 million USDT on Tron to a wallet that began supplying it to JustLend. Its report does not quantify a loan from that position, so it is not combined with Aave’s debt.

6. Arbitrum moved related assets to a frozen wallet

   Arbitrum’s Security Council moved 74,559,805 ARB and 8,425 ETH linked to the incident into an intermediate frozen wallet. The assets can move only through another Council action or a DAO vote. The transfer confirms intervention, not a return to Binance.

   The transfer was valued at about $30.5 million. Binance did not itemize whether it was already included in the company’s roughly $3 billion frozen total, so this report does not add it again.

7. The FBI joined the TraderTraitor attribution

   TRM attributed the operation to North Korea’s TraderTraitor group with high confidence based on on-chain and off-chain intelligence. On October 31, the Associated Press reported that the FBI also attributed the theft to TraderTraitor and asked exchanges and analytics firms to block transactions linked to named addresses.

   The FBI attribution raises the claim from a private intelligence assessment to a law-enforcement finding. It does not yet explain Binance’s internal breach sequence or turn frozen balances into recovered funds.

8. The attacker’s dated holdings are not the net loss

   In its October 30 00:30 UTC snapshot, TRM counted more than 420,000 ETH and 18,270 BTC in attacker-controlled wallets, then valued at about $2.4 billion. This is a dated holdings estimate. It excludes other accounting movements and should not be treated as the final unrecovered amount.

9. The last number still does not exist

   Binance has not published the forensic chain from initial access to each wallet signature. It has not reconciled the gross outflow against frozen, returned, replaced and still attacker-controlled assets. The withdrawal reopening, full zero-knowledge reserve proof and technical post-mortem also remained unconfirmed when this report was updated.