The Binance Hack Is a Payments Story: What $6.3 Billion in 20 Minutes Teaches Every Merchant

As of Saturday, 31 October 2026, investigations are ongoing. Estimates and attribution may change as more evidence emerges.

The Binance hack is being measured in billions, but its most important lesson for payment leaders is about control: who can authorise a transfer, who can stop one, and how quickly organisations can respond when something goes wrong.

On 29 October, funds began leaving Binance hot wallets across multiple blockchains. Investigators estimate that about $6.3 billion was taken, with most of the transfers occurring within roughly 20 minutes. The incident offers a stark view of the different risks built into digital money. Some stolen assets could be frozen by their issuers. Others could not.

For merchants considering stablecoin payments, the event is not simply a warning about crypto security. It is a case study in payment authorisation, settlement and recovery.

What happened, and what is known so far

Binance’s initial estimate put the impact at about $6.3 billion. Chainalysis estimated approximately $6.4 billion, while TRM Labs put the total at about $6.36 billion across 10 blockchains. The difference reflects estimates from separate investigations, rather than a final confirmed loss.

Binance said its initial investigation pointed to a compromised DevOps engineer’s laptop, which may have given an attacker access to an internal service container used to submit withdrawal transactions. The exchange said it had found no evidence that wallet private keys were leaked. It later reportedly identified multiple breach points, so the exact route into its systems remains under investigation.

Binance temporarily suspended withdrawals while carrying out security checks, while deposits continued. It said it would cover all losses using its SAFU emergency fund and company funds, and that customer assets were safe. The company’s security update reported roughly $3 billion frozen on chain.

Chainalysis attributed the attack to TraderTraitor, a North Korean state sponsored group. The firm said funds from the Binance theft commingled on chain with assets linked to a $387 million Bitget theft in September, also attributed to North Korean actors. TRM Labs also assessed the attribution with high confidence. These are investigators’ assessments, not a public confirmation of responsibility by a government.

How the attack worked: from laptop to signing container

The reported attack path matters because it was not simply a case of someone stealing a private key or exploiting a flaw in a blockchain.

Binance’s initial account describes a route from a compromised laptop into internal systems and a service container involved in transaction signing. Investigators reported that the attacker obtained valid transaction authorisations without directly stealing wallet private keys. That distinction is central: a signing system can produce a cryptographically valid transaction that does not reflect the organisation’s intended payment.

On Ethereum, the attacker reportedly used EIP 7702 to delegate control of a hot wallet to an attacker deployed sweeper contract. As CoinDesk’s technical explainer describes, EIP 7702 enables an account to delegate its execution behaviour through a signed authorisation. The reported attack was not evidence that EIP 7702 itself was defective. It showed the potential consequences when an attacker can obtain valid authorisations from compromised signing infrastructure.

Because the wallet’s nonce changed rapidly with regular activity, the attacker reportedly bundled 50 authorisations covering consecutive nonce values into a single transaction, increasing the chance that one would match the wallet’s current state.

The wider lesson extends beyond Ethereum. Investigators reported unauthorised transfers across multiple networks, including transfers made through ordinary signed transactions. The blockchain was not necessarily the weak link. The risk lay in the systems and permissions that decided what to sign.

For payment teams, that distinction is familiar. A transaction can pass technical checks while still being commercially unauthorised. Any process that treats a valid signature as proof of legitimate intent needs a second look.

The freeze race: what stablecoins can, and cannot, stop

The stolen assets did not all have the same recovery prospects. Issuers of stablecoins such as USDT and USDC can freeze tokens at the contract level. Bitcoin and Ether do not have a central issuer with that power.

Chainalysis reported that freezes began by about 5:14pm US Eastern time, around 54 minutes after funds began leaving Binance’s wallets. Other reporting put some issuer actions earlier. By Saturday morning, estimates of frozen assets ranged from roughly $2.8 billion to $3 billion.

The attacker reportedly swapped $325 million in stablecoins into about $285 million in Ether over nearly 20 minutes, attempting to move funds beyond issuer control. Chainalysis also described thousands of transactions and repeated transfers involving addresses first funded with exactly 1 TRX, patterns that suggest automated laundering activity.

A freeze is not the same as a recovery. CNBC’s reporting quotes TRM Labs’ Ari Redbord explaining that frozen funds generally require legal process before they can be returned. Stablecoins may be the most recoverable crypto assets because issuers can freeze, burn and reissue tokens. Bitcoin and Ether can still be traced, but recovery usually depends on cooperation from exchanges or other services.

That issuer control is a double edged feature. It can support intervention in a crisis, but it also introduces a party with the ability to restrict transfers. Businesses using stablecoin payments should understand who can exercise that control, under what authority and with what effect on settlement.

The broader question of how fast digital money moves, and how slowly it can get caught at the edges, is explored in our article on the stablecoin sandwich. The Binance incident adds another edge case: funds may move quickly, but they can also be stopped quickly.

What merchants and payment teams should do

This incident does not mean that every merchant should avoid stablecoin payments. It does mean that settlement design needs to account for both rail risk and counterparty risk. A blockchain may be available while a provider’s service is restricted. A stablecoin may be transferable until its issuer freezes it. A transaction may be validly signed but still be unauthorised by the business.

Use this checklist to test your readiness:

This focus on controls is consistent with the broader move towards more configurable business payments. Our analysis of transaction level controls in B2B payment automation looks at why granular permissioning is becoming more important as payment workflows automate. For stablecoin settlement, the same principle applies: define what can move, who can authorise it and what happens when controls are triggered.

Frequently asked questions

What happened in the Binance hack?

On 29 October 2026, funds began leaving Binance hot wallets across multiple blockchains. Binance estimated the impact at about $6.3 billion. Investigations are ongoing, and reported totals vary slightly.

Who is believed to be behind it?

Chainalysis and TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state sponsored group. Attribution remains an assessment by investigators.

How much has been recovered so far?

By Saturday morning, roughly $2.8 billion to $3 billion was reported frozen. A freeze prevents transfers but does not itself return assets. Final recovery depends on legal processes and cooperation among relevant organisations.

What should merchants do?

Map where stablecoins enter payment and settlement flows, understand issuer controls, get providers’ recovery procedures in writing, and review signing permissions and contingency plans.

What to watch next

Binance was expected to resume withdrawals by Sunday, 1 November, according to reporting at the time. The next indicators are whether withdrawals resume as expected, whether outflows remain orderly and whether investigators or issuers report further freezes.

For payments leaders, the deeper test is whether this incident marks a new operational benchmark. The response involved stablecoin issuers, law enforcement, analytics firms and exchanges, with freezes beginning within about an hour. As stablecoin settlement becomes more widely used, the ability to coordinate a fast response will matter as much as transaction speed. The question for merchants is not only how quickly money can move, but how clearly they understand who can authorise, stop and help recover it.