Binance lost $6 billion, and a freeze button saved almost half

At 20:20:59 UTC on October 29, 2026, a transaction with a fee of $14.46 landed on the Ethereum network. It moved no money. The value field reads zero. Earlier that same day, the attacker had rehearsed the scheme on wallets of his own, moving $2 to $6 at a time. Three and a half minutes later, 167,464 ether and $1.6 billion in USDT stablecoins left a Binance hot wallet that analysts know as Binance 14. By morning the exchange put the damage at roughly $6.3 billion. Outside analysts so far count less, between $5.3 billion and $5.9 billion. The previous record, the theft from the Bybit exchange in February 2025, was about $1.5 billion.

Yet the size is not the strangest part. Nearly half of the loot, about $3 billion, was stopped within hours. Not by the police, and not by “the blockchain itself,” but by a handful of companies that have a freeze button. Cryptocurrencies were invented precisely so that nobody would have one.

A fourteen-dollar power of attorney

An exchange keeps customer money in two kinds of wallets. Cold wallets are offline and hold the main reserve. Hot wallets are always connected: daily withdrawals run through them, so they always hold a working balance. At the world’s largest exchange, that balance runs into billions.

The key to the attack was a feature called EIP-7702. It arrived on Ethereum on May 7, 2025 with the Pectra upgrade. Put simply, it is a power of attorney: an ordinary wallet authorizes an outside program to act on its behalf. It was designed for convenience, to bundle several actions into one click or to let someone else pay the fee. Only the wallet itself can sign such an authorization. It stays in force until the owner revokes it.

The $14.46 transaction was exactly that kind of authorization. It carried 50 of them, each handing Binance 14 over to a “sweeper” program the attacker had deployed four hours earlier. One of the fifty worked. Picture a checkbook where an authorization is only good for a check with one specific number. A hot wallet writes those “checks” nonstop, so the next number is hard to guess. Fifty signatures in a row look like a way to make sure one of them hits.

The sweeper emptied Binance 14 in a single operation, leaving 1 ether behind. Over the next 12 minutes, money from ten more of the exchange’s hot wallets on four networks flowed to the same address. That is how Blockaid, a blockchain security company, reconstructed the attack.

How the attacker got the wallet’s signature is still unclear. According to Binance’s preliminary account, it started with a compromised laptop belonging to a DevOps engineer, the kind of employee who runs servers and software deployment. Through that laptop the intruder reached a service container and submitted unauthorized withdrawals from there. The exchange says it found no evidence that any wallet private key leaked. If that holds, the thief never needed to steal a key. He got the exchange’s own system to sign the authorization for him.

The button bitcoin doesn’t have

USDT and USDC are called stablecoins. They are digital dollars issued by two private companies, Tether and Circle, each of which promises to redeem its token for a dollar. One of their features rarely comes up. The issuer can block any address on the network. In the USDC terms, Circle explicitly reserves the right to block transfers to and from an address. Tether has the same ability.

That night, they did. Tether CEO Paolo Ardoino wrote that the company had frozen more than 1.567 billion USDT. Circle CEO Jeremy Allaire said more than 800 million USDC had been blocked in coordination with law enforcement. Ripple stopped about $200 million of its stablecoin, World Liberty Financial about $27 million. Even Arbitrum, a network usually described as decentralized, froze 74.56 million ARB tokens by decision of its Security Council.

Ether and bitcoin were another story. No issuer, no button. Analytics firm Glassnode counted 17,985 bitcoin among the stolen assets, about $1.45 billion. The ether from the first sweep also stayed with the attacker. Nobody on earth can reverse a transfer signed with the right key. For a thief, that is bitcoin’s best feature. How the attacker reached the exchange’s separate bitcoin wallets, Binance has not yet disclosed. The service-container theory, in which the system itself signed the withdrawals, would explain it.

A rescuer with a veto

It is absurd, really. The largest theft in crypto history was almost half stopped by tools that “real” cryptocurrency is not supposed to have. Bitcoin behaved exactly as its creator intended: a signed transfer is final. The digital dollars behaved like a bank.

The button that took a billion and a half away from a thief works against anyone. A company presses it, not a court. It takes minutes. Someone holding USDT owns not a dollar in an account but Tether’s promise to redeem the token, and that promise comes with a caveat. Many people will find the trade reasonable: banks block suspicious transfers too. It is just that a stablecoin is closer to a bank account than to cash in your pocket, and this night showed the difference better than any lecture.

What it means for Binance customers

According to the exchange itself, Binance has more than 335 million registered users. On the night of the hack it halted deposits and withdrawals, and by the morning of October 30 it had not said when they would resume. Binance co-founder Yi He promised the exchange “will cover all hacking losses” from its SAFU insurance fund and its own money. Founder Changpeng Zhao followed the theft almost as a spectator. “It does look like a hack on Binance,” he wrote on X, noting in the same post that he no longer manages the exchange but expects user funds to be fully covered.

Since February 2026 the SAFU fund has been held in bitcoin, 15,000 of them. At the October 30 price that is roughly $1.2 billion. If the exchange’s own estimate is right, the unfrozen part of the loss, about $3.3 billion, is nearly three times larger. So most of the hole will have to be filled with the exchange’s own money. The fund itself, incidentally, holds fewer bitcoin than the attacker took.

Markets reacted at once, though weak earnings from tech companies were weighing on them too. Bitcoin fell below $77,000, a six-week low. BNB, the exchange’s own token, lost more than 8% in a day.

Who did it is unknown. Blockchain sleuth ZachXBT and the company Blockaid named North Korea as the likely culprit, but no one has officially attributed the attack yet. The FBI did attribute the Bybit theft to North Korea. According to Blockaid, the attacker funded the first operations through Tornado Cash, a mixer that obscures the trail of transfers. Binance promises a detailed technical post-mortem once the facts are verified.

For years the crypto community has argued over whether money needs a stop button. In a single night, one saved about $3 billion. The argument will probably shift now: who decides, and by what rules, when to press it?