A preliminary explanation, not a closed investigation

Binance says a potentially compromised DevOps laptop enabled service-container access and unauthorized withdrawals; it has found no evidence of a wallet private-key leak. Its initial statement leaves the final root cause open.

What blockchain analysis adds

In research describing observations as of October 30 at 00:30 UTC, TRM Labs traced approximately $6.36 billion across ten chains, valuing assets at transfer time. It assessed that the attacker gained control over hot-wallet signing infrastructure. TRM identified EIP-7702 delegation on Ethereum alongside ordinary signed transfers on other networks. That is a reconstruction from transaction evidence and intelligence, not a completed audit of Binance’s internal systems.

What EIP-7702 actually does

The Ethereum specification lets an externally owned account authorize execution of code at another address. It supports features such as transaction batching and sponsored fees. The authorization changes what code can run in the account’s context; it is not merely a token transfer approval. The specification warns that delegated code has broad access and that poorly designed implementations can put the account at risk.

A mechanism is not the point of entry

A blockchain can record a valid authorization without explaining how an attacker obtained the ability to produce it. The same visible result could require investigation of employees’ devices, access permissions, signing requests and service logs. Consequently, finding delegation in a transaction does not by itself prove an Ethereum protocol defect, a leaked private key or the route into an exchange. Those are different technical questions. This distinction is our interpretation of the difference between the protocol record and an internal incident investigation.

Who is making the attribution?

TRM assigns high confidence to a North Korea-linked TraderTraitor attribution, citing onchain and offchain intelligence. Readers should retain that attribution label: this is TRM’s conclusion, not a perpetrator announcement by Binance or a new FBI determination. A security firm’s confidence assessment is important evidence, but it does not turn every detail of an evolving incident into an established fact.

Later tracing update: a reported Ether transfer

In a 05:24 UTC post on October 30, Arkham reported a transfer of Ether valued at $38.82 million to a new wallet. This is Arkham's dated tracing claim, not independent transaction verification by The Token Press. The post did not establish a mixer deposit or recovered funds.

The evidence to watch next

A useful postmortem would connect the initial access route to the approval and signing controls, identify the affected systems, and explain which safeguards stopped further unauthorized activity. Transaction-by-transaction findings and an explicit boundary between confirmed facts and hypotheses would help readers evaluate that account. Until then, precise language matters more than a definitive-sounding attack label.

For background on the difference between exchange custody and a wallet you control, read Wallets, private keys and custody. These concepts help explain responsibility and access; they do not resolve this incident.

For the current operational picture, see our Binance incident overview and latest service status.

Sources

Updated October 30, 2026, 05:52 UTC to add Arkham's 05:24 UTC tracing statement. Earlier investigation sources checked at 05:13 UTC. Developing story; company statements, third-party analysis and unresolved questions remain distinct.

Seven-token swap report: October 30, 01:01 UTC

In a separate tracing update, Lookonchain reported that the attacker had exchanged seven altcoin positions for 70,480 ETH, valued at approximately $158.25 million. Its breakdown covered UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD; UNI was the largest reported component at $39.63 million. These are the analytics firm’s reported swaps and valuations, not an additional loss estimate or funds recovered. The Token Press has not independently reconstructed the underlying transactions. Conversion into ETH does not itself establish a fiat cash-out, a mixer deposit or disposal of every stolen asset.