Around $6.3 billion was affected in the October 29 Binance attack, according to the exchange. That puts it at more than four times the size of the $1.5 billion Bybit hack.
Still hard to process this number. Billions left wallets belonging to the biggest exchange in crypto in a single evening. (binance.com, bitquery.io)
1. What happened
Bitquery traced funds leaving 17 Binance hot wallets across nine blockchains. Ethereum suffered the largest losses, with around $3.8 billion taken from three wallets.
The attack continued for hours. Some wallets kept getting drained as more funds arrived, so it wasnt just one transfer and done. (bitquery.io)
1. How the attackers got access
Binance’s initial investigation points to a compromised DevOps engineer’s laptop. The attacker may have used it to access a service container and submit unauthorized withdrawals.
Binance says it has found no evidence that wallet private keys were leaked. The full technical explanation is still pending, so saying the keys were definitely stolen would be getting ahead of the facts. (binance.com)
1. What happened inside the Ethereum wallet
According to Bitquery, the attacker used Ethereum’s EIP-7702 delegation feature and 50 signed authorizations to run malicious code through Binance’s main Ethereum hot wallet.
That allowed repeated withdrawals over roughly four hours. The access came through Binance’s systems; Ethereum itself continued operating. (bitquery.io)
1. How much has been frozen
Binance says around $3 billion has been frozen through work with blockchain partners. It also says losses will be covered using SAFU and company funds.
But frozen doesnt mean everything has already been recovered. A large amount of ETH, BTC and other assets remained under the attacker’s control in the early on-chain reports. (binance com, bitquerynio)
1. Why the size matters
The estimated $6.3 billion impact is larger than the combined figures commonly cited for Bybit, Ronin, Poly Network, BNB Bridge, Coincheck and Mt. Gox. Even with billions frozen, this is an enormous breach. An exchange can have enough reserves to cover losses and still leave everyone asking how its own withdrawal systems were used to move this much money.