The $6.3 Billion Signature: Halborn and the Binance Hack

On the night of October 29, 2026, somebody moved roughly $6.3 billion out of Binance in under four hours, and nobody had to steal a key to do it. The funds left hot wallets on ten different blockchains, from Ethereum and Bitcoin to the XRP Ledger and Solana, in a burst so fast and so coordinated that by the time the exchange paused withdrawals most of it was already gone. By a wide margin it is the largest cryptocurrency theft ever recorded, about four times the $1.5 billion taken from Bybit in February 2025, according to TRM Labs. The detail that should keep every custodian awake is this: the attacker never needed Binance’s private keys. The signatures that authorized the drain were real, produced by Binance’s own signing systems, on the attacker’s instructions.

When a breach is that strange, the autopsy matters more than the headline. What follows is a reconstruction told through the lens of Halborn, the blockchain security firm whose “Explained” post-mortems have become the closest thing crypto has to a coroner’s report. Halborn did not audit Binance and did not build its wallet stack. But its published breakdown did something most hot takes did not: it treated the hack not as a crypto curiosity but as a warning for the banks now lining up to hold digital assets.

A $6.3 Billion Night, and Not One Stolen Key

The raw numbers are hard to hold in your head. TRM Labs put the theft at about $6.36 billion at the moment it happened; Elliptic, measuring value at transfer time, went slightly higher. Ethereum took the heaviest hit at roughly $3.79 billion across more than 180 tokens, followed by $1.47 billion in Bitcoin, $628 million on Tron, $296 million on the XRP Ledger, and smaller amounts on Solana, Avalanche, Polygon, and the big Ethereum Layer 2s. Industry data compiled by FinanceFeeds later showed this single incident accounted for roughly 73 percent of everything stolen across crypto in all of 2026, a year that already stood as the worst on record.

And yet the forensic story is not about broken cryptography or a leaked seed phrase. Halborn’s central finding, stated flatly, is that “the key was never the target.” Binance’s keys signed every outflow, exactly as they were designed to. The attacker had instead compromised the layer that tells those keys what to sign, which means the exchange’s most expensive security control, the keys themselves, did precisely what it was built to do while $6.3 billion walked out the door. That inversion is the whole lesson, and it is why this hack belongs in the same family as Bybit, Drift, and Bitget rather than in the bucket of smart-contract exploits that defined crypto’s first decade. The novelty here is not a clever bug. It is the discovery that at the scale of the world’s largest exchange, the signature itself can be turned against you.

Who Halborn Is, and Why It Shows Up After the Hack

Halborn is a blockchain security firm founded in Miami in 2019 by Steven Walbroehl and Rob Behnke, who bootstrapped it for about three years before raising a $90 million Series A led by Summit Partners in July 2022. Its early reputation came from offensive work: red-team engagements, penetration testing, and the kind of adversarial review that assumes the attacker is already inside. In September 2024 it brought in Jacques Boschung, a veteran of Kudelski Security and Dell, as chief executive, with Behnke moving to co-founder, executive chairman and president, and Walbroehl staying on as chief technology officer. The hire signaled a deliberate pivot toward banks, custody providers, and tokenized assets, the institutional money that clearer rules on both sides of the Atlantic were starting to pull on-chain.

Halborn did not audit Binance, and that is precisely why its voice carries here. The firm plays coroner, not engineer of record: its “Explained” series has dissected Kelp DAO, Drift, Humanity Protocol, and Bitget this year alone, each time reconstructing what actually failed rather than defending a report it had signed. It also runs an incident-response practice and partnered with Chainalysis back in 2023 to pair preventative work with fund tracing. By its own account Halborn has “advised more than 20 financial institutions on digital asset security,” which is why its Binance writeup reads less like a crypto blog and more like a memo to a bank’s risk committee. When a firm that sells custody assessments dissects the biggest custody failure in history, the sales pitch and the public service happen to point the same way.

That dual role is not unique to Halborn. CertiK, Trail of Bits, and OpenZeppelin have all built post-mortem and monitoring practices alongside their audit desks, because the public reconstruction of a hack is now the single best advertisement a security firm has. The difference is temperament. Halborn came up breaking things rather than reviewing code line by line, and that offensive instinct shapes how it reads an incident: not as a failed audit but as a failed operation, the kind of adversary simulation it runs for a living. For the Binance breach, that lens turned out to be exactly the right one.

What EIP-7702 Actually Does

To understand the Ethereum leg of the attack, you need one piece of plumbing: EIP-7702, a feature that shipped with Ethereum’s Pectra upgrade in May 2025. For most of Ethereum’s life there were two kinds of accounts, ordinary wallets controlled by a private key (externally owned accounts) and smart contracts that run code. EIP-7702 blurred the line. It lets an ordinary wallet temporarily point itself at a smart contract, so that for a stretch of transactions the wallet behaves like that contract while keeping its original address. The delegation is authorized by a short tuple (a chain identifier, the contract address, and a nonce) signed by the account, and on-chain a delegated account carries a small marker: the bytes 0xef0100 followed by the contract it now answers to.

The legitimate uses are genuinely good ones: paying gas in a token instead of ETH, batching several actions into one click, adding social recovery, the kind of friction reduction that makes self-custody survivable for normal people. (HOGE Wire has argued that some friction in a wallet is a feature rather than a bug; see our piece on the case for friction.) The catch is that a delegation is only as safe as the thing you delegate to. Point a wallet at a helpful contract and you get a better wallet. Point it at a contract written to empty you out, and you have signed away the account with a single authorization. There is no second prompt, no multisig to clear, no undo. That is the door the Binance attacker walked through, and it is a door that did not exist two years ago.

This is the same problem that has dogged hardware wallets under a different name: blind signing. A user, or in this case an automated signing service, approves a cryptographic digest without fully parsing what it authorizes. EIP-7702 raises the stakes because a single approved digest does not just move funds once; it rewrites what the account is, handing control to code for as long as the delegation stands. Wallet makers spent 2025 and 2026 racing to display delegations in plain language and to warn on unknown delegate contracts. Exchanges, it turns out, were a step behind on the same question, because almost nobody had written a signing policy that treated a 7702 authorization as the dangerous instruction it is.

Fifty Signatures, One Match

Here is where the craftsmanship shows. According to Halborn’s reconstruction and a parallel technical breakdown from Hypernative, the attacker deployed a purpose-built delegate contract at 15:59 UTC, hours before the drain. Its code hardcodes the operator wallet as the only permitted caller and exposes functions to sweep every token balance, withdraw the ETH, and make arbitrary calls on the hijacked wallet’s behalf. Then, at 20:20:59 UTC, a single carrier transaction landed on Ethereum containing fifty pre-signed EIP-7702 authorizations for the hot wallet known as Binance 14, listed in descending nonce order.

Why fifty? Because the wallet was still being used by Binance for normal business, its nonce (the counter that orders an account’s transactions) kept moving. By stacking fifty authorizations across a range of consecutive nonces, the attacker guaranteed that exactly one would match whatever value the wallet reached, no matter how many legitimate withdrawals fired in between. Halborn notes that “the entry for 18,914,809 was the match.” The descending order ensured only that one took effect, which let the account keep working for Binance and for the attacker at the same time, a delegation hiding in plain sight. Four minutes later, at 20:24:23 UTC, the first sweep pulled 167,464 ETH plus 63 separate tokens into an attacker hub wallet, with a single transfer of roughly 1.6 billion USDT the largest line item. The delegation then sat quietly, used for four more sweeps over the next three hours, until it was finally cleared at 00:10 UTC on October 30. The timeline below shows how patient the setup was.

The Key Was Never the Target

The EIP-7702 trick is the flashy part, but it is not the root cause, and Halborn is careful to say so. A delegation authorization has to be signed by the account’s key. So does a plain Bitcoin transaction, and a Tron transfer, and an XRP payment. The attacker produced valid signatures on all of them, across ten chains, inside about half an hour. You cannot do that by guessing a key. You can only do it if you control the system that asks the key to sign.

Halborn’s read is that the compromise reached the withdrawal-request submission layer, the software upstream of the signer that decides what gets signed and when. The fifty pre-signed authorizations are the tell: they point to “someone who could get the key to sign digests but could not control when, how fast, or how many times.” In other words, the attacker could obtain signatures but had to work around Binance’s own pacing, so they front-loaded a batch and let the nonce catch up. The clincher is a second Ethereum hot wallet, Binance 16, which made “nine ordinary transfers to the attacker worth about $174 million, with no delegation at all.” No EIP-7702, no sweeper contract, just plain withdrawals that the signing stack happily approved. Plain signing was already compromised; the delegation was simply the most efficient way to empty the biggest wallet.

There is a direct line from Bybit to this. In February 2025, attackers did not steal the keys behind Bybit’s multisig either; they corrupted the interface so the signers approved a transaction that did not say what they thought it said. Binance moved the same forgery one layer deeper, to the machine boundary, by compromising the source of the withdrawal request itself. This is the point CertiK co-founder Ronghui Gu has been making all year. “A protocol can pass a flawless code audit and still lose millions because of a compromised admin key,” he told Forbes, adding that attackers now get more return “going after key management, multisig governance, and operational infrastructure than by hunting for bugs in code.” Binance is that thesis at industrial scale. There was no bug to find. The asset-moving machine worked perfectly for the wrong operator.

It Started With a Laptop

So how did the attacker get inside the submission layer? Binance’s own early update pointed at a “compromised DevOps laptop” and a service container used to push withdrawals, with “no evidence of key leak.” A later note conceded that “the laptop was not the only point of breach.” The staging pattern fits: the operator wallet was topped up in tiny amounts through Tornado Cash a day ahead, the delegate contract was deployed and tested, and the attacker ran two rehearsals against a throwaway wallet before going live. This was not a smash-and-grab. It was an operation that had already lived inside Binance’s engineering perimeter long enough to practice the exact sequence it would run with real money.

That entry point, a single human endpoint, is the part Halborn’s co-founder has been warning about for years. Steven Walbroehl told Cointelegraph that attackers increasingly use AI to craft “highly personalized, context-aware attacks that bypass traditional security awareness training.” The groups attributed to North Korea have made the human layer their specialty, from fake recruiters to deepfaked interviews to operatives planted as remote engineers. A developer’s laptop with the right access is worth more than any zero-day, because it sits inside the trust boundary that every other control quietly assumes is clean. Antivirus, hardware security modules, and multisig policies all take for granted that the person at the keyboard, and the machine in front of them, belong there. (For how these lures actually arrive in an inbox or a direct message, see our look at Telegram and Discord phishing in 2026.)

Ten Chains in Four Hours

The multi-chain spread is itself evidence. EIP-7702 only exists on Ethereum and EVM-compatible chains; it cannot touch Bitcoin, the XRP Ledger, Tron, or Solana. Yet the Bitcoin hot wallet sent 18,270 BTC in a single transaction at 20:20 UTC, five XRP wallets were emptied, and Solana and Tron balances moved as plain signed transfers. The only way one actor produces valid signatures across that many unrelated signature schemes within half an hour is if the signing infrastructure behind all of them answered to the same compromised pipeline. The delegation on Ethereum was a convenience for the single richest wallet, not the mechanism of the breach. The table below, drawn from TRM Labs and Halborn, shows where the money went.

Note the shape of it. The first wave hit the chains with the deepest liquidity and the fastest exits; a second wave, nearly three hours later, swept up Avalanche and Polygon almost as an afterthought. By then the money that could be moved had been moved, and the race had shifted from the attacker’s side to the defenders’. What makes the per-chain picture so unsettling for a custodian is how little the chains had in common. Different cryptography, different clients, different wallet software, one pipeline, one result.

The Freeze, and Why It Is Not the Same as Recovery

The one thing that worked was the stablecoin blacklist. Within 37 minutes of the first Ethereum sweep, Tether had begun freezing USDT; Circle followed four minutes later with its USDC; Ripple froze RLUSD and World Liberty Financial froze its USD1. All told, issuers plus an Arbitrum Security Council action locked up somewhere between $2.7 billion and $3 billion, depending on whose tally you use. A centralized stablecoin is, in the end, a database entry its issuer can flip, and that power is the closest thing crypto has to a panic button. The speed this time was unprecedented, the fastest coordinated freeze in the industry’s history.

But Halborn draws a hard line here: “Freezing is not recovering. A blacklisted balance sits in the thief’s address until the issuer burns and reissues it” under a legal process that can run for months. And the attacker knew it, dumping about $786 million of stablecoins into other assets before the freezes bit, accepting a double-digit percentage haircut in exchange for speed. Tether has leaned into its role as the chain’s enforcer; chief executive Paolo Ardoino has said that “USDT is not a safe haven for illicit activity” and that the company acts “immediately and decisively” when credible links to sanctioned entities or criminal networks appear, in a public statement on an earlier seizure. The uncomfortable corollary, as TRM’s Ari Redbord told CNBC, is that “stablecoins are the most recoverable asset class in crypto because the issuer controls the token contract.” The native assets, more than 420,000 ETH and the full 18,270 BTC, carry no such switch, and most of them remain with the thief.

Laundering a Record Haul

What cannot be frozen has to be laundered, and the attacker moved fast. TRM Labs traced roughly 325 million USDT converted into about 122,300 ETH through the UniswapX decentralized exchange at a discount of more than 10 percent, a self-imposed tax to escape freezable assets before the issuers reacted. The operation then borrowed close to 19,760 ETH against 60 million USDT on Aave, supplied USDT into JustLend on Tron, and ran the usual chains of decentralized-exchange swaps and hop wallets. Converting into ETH and BTC is the whole point: those are the assets no one can claw back, the end state every launderer is racing toward while the clock on issuer freezes ticks.

This is also where recovery statistics turn grim. Even with the fastest issuer freezes in history, the attacker kept well over $2 billion out of reach on day one, and industry-wide the share of stolen funds that ever comes home is in the single digits once a sophisticated adversary is involved. The freeze bought real headlines and a real dent, cutting the realized loss by roughly a third, but it did not undo the theft. For a sense of how far short recovery usually falls, and why so much depends on acting inside the first hour, the gap between what gets frozen and what gets returned is the uncomfortable core of every modern post-mortem.

Is It North Korea?

TRM Labs attributes the attack with high confidence to TraderTraitor, the North Korean unit the FBI named for the Bybit hack, citing on-chain and off-chain intelligence plus a familiar signature: small Tornado Cash withdrawals to fund the operator wallet, staging begun well in advance, and a single explosive burst of pre-signed transactions. Elliptic adds that a laundering address overlapped with September’s Bitget theft, and that the staff-targeting echoes earlier operations against exchange employees. The sheer capability to drain ten chains in three hours is itself a fingerprint; very few actors on earth can do it.

The honest caveats are worth stating, because Halborn states them. A shared address could belong to a laundering service used by several clients; the stablecoin holding patterns differ slightly from past North Korean behavior; the cash-out leaned on market makers rather than cross-chain bridges; and no government had issued a formal attribution at the time of writing. Halborn’s practical conclusion is that “the pattern fits and that a compliance team should act on it today rather than wait for a press release.” If the attribution holds, every trading desk that filled the attacker’s stablecoin sales now has a sanctions problem to unwind, which is a very different kind of hangover than a simple loss. It also means the stolen value is not just gone; it is funding a sanctioned weapons program, which is why the FBI, the Treasury, and a dozen analytics firms treat DPRK attribution as a matter of national security rather than crypto housekeeping.

SAFU, Solvency, and the Market Shrug

The reason this did not become a second FTX is that Binance ate the loss. The exchange said it would cover affected users from its SAFU insurance fund and company reserves; Elliptic reported it earmarked about $6.34 billion to do so, and by November 4 Binance said it had restored roughly 98 percent of affected assets, buying what it could not cover from the market and over-the-counter desks. It also rushed out a zero-knowledge proof of reserves to reassure depositors, a move that says as much about trust as about math. (We dug into what those attestations prove, and miss, in our piece on proof of reserves, which went up in the days after this very hack.)

Markets, for once, mostly shrugged. Bitcoin had already slid toward $76,000 in the first hours of the news, then found its feet; by November 4 it was back above $80,000 even as US midterm results added their own noise, according to The Block, with Fortune clocking it near $78,500 that morning before a roughly 4 percent bounce. Analysts kept repeating the key distinction: Binance was hacked, the Bitcoin network was not. “The most important takeaway for markets is that this does not currently appear to create meaningful solvency risk for Binance,” Sean Farrell of Fundstrat Global Advisors told CNBC. The lesson of the last decade, that an exchange can lose a fortune without the underlying chains skipping a beat, held one more time, and it held precisely because the chains themselves were never touched.

That distinction is why the market damage was contained. Research shop Bitwise noted that Bitcoin has actually risen in the months after five of the ten biggest hacks on record, because a theft from one company says nothing about the scarcity or settlement of the asset itself. It is also why Binance covering the loss mattered so much: the post-FTX standard is that a solvent exchange absorbs the hit from its own balance sheet rather than passing it to depositors, and Binance, flush from years of fees, could write a ten-figure check without threatening its own books. A smaller venue could not have, and that is the quiet systemic risk the headline number hides.

What It Means for Bank Custody

This is the section Halborn wrote for its institutional readers, and it is the most important part of the whole post-mortem. “For a bank this is not a crypto story,” the firm argues. “It is a demonstration that one engineering endpoint reached the asset-moving path.” Strip away the tokens and the blockchains and you are left with a plain operational-risk failure: a privileged laptop reached the system that moves money, and the money moved. Any custodian, whether a crypto-native exchange or a 200-year-old bank now minting tokenized deposits, has that same shape of risk. The asset is different. The failure is identical.

Halborn’s prescription turns on a single architectural idea: policy has to be enforced inside the signer, not in the orchestration software above it. “A fully compromised upstream component cannot produce a valid signature outside policy,” the firm writes, and the test it proposes is brutally simple, “change a material field after approval and watch the signer reject it.” Binance’s signer did not do that; it signed whatever the compromised pipeline handed it, including a request to delegate the account to attacker code. From there the recommendations read like a custody checklist that most of the industry has not finished writing:

• Size the hot tier to the most you can stand to lose in twenty minutes, enforced with hard value caps, per-chain velocity limits, and circuit breakers, and replenish only through intermediate wallets with independent human sign-off.
• Segment keys and signing infrastructure by chain and by tier, so that no single service can request signatures for every chain at once.
• Map authority relationships: one wallet holding about $823 million in USDC was never itself breached, it was simply reachable through the operator rights of the hijacked account.
• Treat engineering endpoints as tier zero, with hardware-bound authentication and just-in-time credentials, isolated from signing infrastructure, and brief staff on state-sponsored recruitment lures.
• Write an explicit EIP-7702 policy that rejects delegations by default, alerts on suspicious nonce ranges, and watches for the 0xef0100 delegation marker on any account that should never carry one.

None of this is exotic. It is the discipline regulated finance already applies to payment systems, now demanded of anyone holding digital assets at scale. Halborn, not coincidentally, sells exactly this work: custody and key-management assessments, red-team exercises that simulate the laptop-to-withdrawal path, technical due diligence on third-party custodians, and compliance readiness. That is the commercial logic behind the Wall Street pivot Boschung was hired to run. As banks and asset managers push deeper into crypto custody on the back of the altcoin ETF wave, the firms that can prove their signer says no are the ones that will win the mandates, and the ones that cannot will find out the hard way, in public, the way Binance just did.

The Regulators: DORA, MiCA, and a US Gap

Here the jurisdictions diverge sharply. In the United States, there is no rule that tells an exchange how to architect its signing stack. The Securities and Exchange Commission’s cyber-disclosure regime, in force since late 2023, requires public companies to disclose a material incident within four business days, but it governs what you tell investors, not how you defend the vault. Under chair Paul Atkins, the SEC’s Project Crypto agenda has focused on token classification and market structure, not on custody engineering standards. Oversight of how a US venue secures customer assets remains a patchwork of state money-transmitter rules and the occasional enforcement action after the fact.

Europe is further along, and Halborn flags it directly. Under the Digital Operational Resilience Act (DORA), a regulated financial entity must file an initial notification of a major information and communications technology incident within hours, and crucially, a custody provider’s signing path counts as third-party ICT risk that has to be governed and tested, the exact category this breach lived in. Under MiCA, Halborn notes, a crypto-asset service provider “is liable to clients for the loss of crypto-assets resulting from an ICT incident attributable to it, up to the market value at the time of loss.” That is a real balance-sheet consequence for running too large a hot tier, and it is one reason the hot-tier sizing point above is not merely good hygiene but a provisioning question. The deeper problem of who actually answers when something breaks in a less centralized setting is one we have explored in our look at DeFi compliance; for a custodial exchange, at least, the liable party is not in doubt.

The Audit Industry’s Uncomfortable Year

Zoom out and 2026 is the worst year for crypto theft on record, and it is not close. By the end of October, trackers counted more than $8.7 billion stolen across the year, over three times the same stretch of 2025. Strip out Binance and the picture changes completely: the other 300-plus incidents add up to roughly $2.4 billion, an unremarkable year. One hack bent the entire curve, and it was a hack no smart-contract audit could have prevented, because there was no contract to audit. The casebook Halborn itself has assembled this year tells the story at a glance.

Only one entry, Liquid, is a genuine code bug, and even that was introduced by a fix. The rest are keys, configs, laptops, and signers. This is the paradox the audit industry has spent the year absorbing: a smart-contract audit catches the most common class of vulnerability but no longer the most costly one. The market has reacted the way markets do, with consolidation (the competitive-audit platform Code4rena wound down in 2026, its clients and researchers absorbed by Immunefi), with rebrands toward monitoring and “trust layers,” and with firms like Halborn pushing past code review into offensive testing, incident response, and custody architecture. No US agency accredits a smart-contract auditor or a custody engineer, so reputation remains the only real court, and a year like this one is how reputations get repriced.

The Binance hack will be studied for a long time, not because the technique was unbeatable but because it was ordinary dressed up as novel: a phished endpoint, a signing system that trusted its inputs, and a new Ethereum feature used exactly as designed by the wrong hands. The $6.3 billion figure is the shock. The lesson is smaller and harder. In 2026, the vault is only as honest as the machine that tells the keys to sign, and most vaults have not yet taught that machine to say no.

Frequently Asked Questions

How much was stolen in the Binance hack?

About $6.3 billion, which TRM Labs pegged at $6.36 billion at the time of theft, making it the largest cryptocurrency theft on record, roughly four times the $1.5 billion Bybit hack of February 2025. The funds were drained from hot wallets across ten blockchains, and between $2.7 billion and $3 billion was later frozen by stablecoin issuers.

How did the Binance hack happen without stealing a private key?

The attacker compromised Binance’s signing and withdrawal-submission infrastructure, reportedly starting from a compromised DevOps engineer’s laptop, rather than stealing the keys themselves. That let them get Binance’s own systems to produce valid signatures for the attacker’s transactions, so every outflow looked legitimate on-chain.

What is EIP-7702 and how was it used in the attack?

EIP-7702 is an Ethereum feature from the May 2025 Pectra upgrade that lets an ordinary wallet temporarily delegate its behavior to smart-contract code. The attacker used a single signed authorization to point a Binance hot wallet at a malicious sweeper contract, then drained it; fifty authorizations were stacked so one would match the wallet’s moving nonce.

Will Binance users lose money?

Binance said it would cover affected users from its SAFU insurance fund and company reserves, reserved about $6.34 billion to do so, and reported restoring roughly 98 percent of affected assets by November 4, buying the remainder from the market and OTC desks. On that basis customer balances were made whole.

Who was behind the Binance hack?

TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-linked unit also blamed for the 2025 Bybit hack, and Elliptic noted laundering overlaps with September’s Bitget theft. No government had issued a formal attribution at the time of writing, and analysts noted a few patterns that differ from past DPRK operations.

Anneke de Vries covers security and exploits for HOGE Wire.