What the Binance Hack Revealed About How Crypto Markets Work

On the evening of October 29, about $6.3 billion in cryptocurrency drained out of Binance, the world's largest crypto exchange. It was the largest crypto theft on record.

What happened after the money left showed the market's condition more sharply. Stablecoin issuers froze about $3 billion within 70 minutes, analytics firms named the culprit within a day, and the exchange said it had lined up more than $6.3 billion to cover customer losses. Assets that cannot be frozen, by contrast, no one could stop.

This article follows the sequence, attack, freeze, defense, laundering and attribution, to explain in plain terms how the market works.

Why the Money Sits on the Internet

Exchanges keep customer money in two places. Money for immediate trading sits in hot wallets, connected to the internet, and the rest sits in cold wallets, offline vaults. A hot wallet is like a shop's cash register. It has to touch the internet so customers can withdraw at once. That also makes it easier to rob.

Withdrawals are approved by an internal system called signing infrastructure, the place that stamps approval on a withdrawal request. In this hack, the attacker did not steal the private keys, the equivalent of a wallet password. The attacker reached the stamping system instead. So Binance's own systems approved transfers to the attacker. Elliptic, a blockchain analytics firm, put it this way: the cryptography was not broken; the systems and people around the wallets were.

A new feature called EIP-7702 added speed. Introduced in Ethereum's Pectra upgrade in May 2025, it lets an ordinary wallet temporarily borrow the powers of a smart contract, a convenience meant to bundle several transactions or have someone else pay the fees. The attacker handed execution control of Binance's hot wallet to its own sweeper program. A sweeper empties a wallet on a single command. The attacker packed 50 delegation signatures into one transaction, and within about 20 minutes drained some 167,000 ether plus tokens and $823 million in USDC. A delegation stays in force until it is revoked, so the attacker drained six more incoming deposits afterward.

The feature was not the cause of the crime, and that distinction matters. Security firms say it only made the crime faster and cheaper for an attacker who already held signing power.

Stablecoins Have a Kill Switch

More than half of the stolen funds were stablecoins such as USDT and USDC. A stablecoin is pegged to the value of the dollar, and its issuer builds a blacklist function into the smart contract that can stop a specific address from moving funds. Circle froze $800 million in USDC at about 9:18 p.m., Tether froze $1.56 billion in USDT, Ripple froze $200 million in RLUSD and World Liberty Financial blocked $27 million in USD1. About $3 billion was frozen within 70 minutes of detection. Elliptic later put the frozen and seized total at $2.85 billion, 44 percent of the theft.

Bitcoin, ether and XRP have no issuer, so by design no one can freeze them. The $2.4 billion in bitcoin and ether that was stolen can be tracked by the FBI but locked by no one. That is the market's central paradox. The most widely used stablecoins work like bank deposits, with an issuer's switch attached, while the most crypto-native asset, bitcoin, offers no way to get funds back.

Frozen coins did not disappear. Returning them to Binance requires separate legal steps, including court orders in each country.

The Defense Moved on Four Fronts

The first moves came inside the exchange. Within hours of detection, Binance halted deposits and withdrawals, suspended its Binance Alpha trading platform and revoked the attacker's EIP-7702 delegation. Revoking the delegation was essential so the sweeper could not keep draining new deposits. At the same time, all withdrawals were rerouted through newly disclosed wallet addresses, so no money left through addresses the attacker knew.

Money was the second line of defense. Binance said it had lined up more than $6.34 billion of its own funds, about $5 billion of it in the same kinds of coins that were stolen, with the rest being bought on the market. The roughly $3 billion in frozen funds was not counted in that figure. If it is recovered through legal process, it becomes additional recovery. The SAFU emergency fund, built from a share of trading fees, paid out $581 million, and the futures insurance fund and company funds covered the rest. The exchange said replenishment reached 90 percent on October 31 and 95 percent on November 1.

A third front was proof. Binance published a proof-of-reserves snapshot and is preparing a zk-SNARK proof, a cryptographic technique that lets customers verify their own balance is included in the reserves without seeing anyone else's. The snapshot is the exchange's own claim and a picture of one moment in time, and no outside verification exists yet. A technical report on the root cause of the intrusion is promised when the investigation ends.

Even so, the defense stopped halfway. Bitcoin, ether and XRP have no issuer, so no one could stop them, and the attacker rushed to convert stablecoins into those assets before the freezes landed. Circle's freeze of all USDC before a single coin could be swapped was the cleanest defensive success of the episode.

Exchanges No One Can Stop

Before the freezes, the attacker swapped 434 million USDT for ether on a decentralized exchange, 37 minutes before Tether's freeze. A decentralized exchange swaps coins through programs, with no intermediary. There is no bank counter and no manager, so there is no way to block whoever shows up to trade. That is both its strength and its weakness.

Lending services were used the same way. The attacker posted 59.9 million USDT as collateral and borrowed 19,762 ether on Aave. Post collateral and the service lends another coin up to its value. Later the attacker put 128 million TRX into JustLend, a lending vault on Tron, and took it out through 16 new addresses. With no direct transfer record between the deposit address and the withdrawal addresses, the tracking link breaks.

The Technology That Moves the Ledger

A bridge moves coins from one blockchain to another. Each blockchain keeps its own ledger, so every time the chain changes, trackers have to switch ledgers. The attacker used six bridges, later more than seven.

Tron was the center of the laundering. Tron is cheap, fast and carries a large supply of USDT. The attacker split 684.6 million TRX across 7,700 addresses and converted most of it into ether. On October 31, a new route appeared into USDD, a stablecoin promoted as unfreezable.

The basic technique of laundering is splitting. The stolen 18,270 bitcoin were divided into 19 addresses within 30 minutes, and the Tron funds spread across 12,000 wallets. Small amounts do not move prices and attract less notice from exchange checks.

Tornado Cash was used in the preparation stage. It is a service that mixes many people's funds to blur their origin. A day and a half before the theft, the attacker took a small amount from it to pay fees for the operating wallet. In a later stage, coinjoins appeared. Combining many people's bitcoin into one transaction breaks the link between the coins that went in and the coins that came out. From November 1, 28 bitcoin were mixed this way.

The Blockage Comes Only at Cash-Out

However much is laundered, turning coins into real money requires a counterparty such as an exchange or an over-the-counter broker. An over-the-counter broker buys and sells large amounts directly, person to person, away from exchange screens. Elliptic expects the attacker to convert ether into bitcoin bit by bit and cash out over the counter over months. In the Bybit case, all the stolen ether was laundered within ten days, but cashing out took months and eventually ran through Chinese over-the-counter networks, the firm said. The point where investigators can stop the money is the cash-out stage. Until then, the coins simply sit on the public ledger.

Attribution: Wallets Are Visible, People Are Not

Attribution was the work of blockchain analytics firms. TRM Labs named TraderTraitor with high confidence before midnight on October 30. Its evidence was three preparation patterns. First, the small amount from Tornado Cash that paid the operating wallet's fees a day and a half before the theft. Second, delegation signatures gathered in advance and executed at once. Third, a peel-chain pattern that split the stolen bitcoin into units of 1,000 and 100. All three overlapped with the Bybit attack.

Chainalysis followed the money. It said the stolen funds mixed on the blockchain with funds from the September Bitget theft, already attributed to North Korea. Elliptic said about $16 million of the stolen funds went to addresses that also held proceeds of the Bitget theft.

The FBI named TraderTraitor in a formal alert on October 31 and published hundreds of wallet addresses. The Secret Service and the IRS Criminal Investigation division joined the alert. It asked THORChain node operators, decentralized services and analytics firms to block related transactions.

A hard limit applies here. As Elliptic itself noted, a blockchain shows the wallet but not who stands behind it. The word hacker is used to mean whoever controls the wallet. The weight of the attribution rests on on-chain traces overlapping with off-chain information. After the FBI published the addresses, Elliptic put more than 9,500 related addresses on a blocklist so exchanges can screen incoming deposits. The final stage of attribution takes place at the doors of exchanges and over-the-counter brokers.

TraderTraitor is known as a North Korea-linked group under the Lazarus Group that targets cryptocurrency alone. Earlier attributed cases include Bybit at $1.5 billion, DMM Bitcoin at $308 million and the Ronin Network at $620 million. Binance itself has not named the attacker. The root cause remains undisclosed.

Same Event, Different Roles for Each Coin

Each coin played a different role in this episode.

Bitcoin was the final store of value. The stolen 18,270 coins were split into 19 addresses within 30 minutes and then did not move. Bitcoin is the asset the attacker keeps to cash out last. The coins mixed through coinjoins were bitcoin, too.

Ether was the central asset of the theft and the laundering. The sweeper's main haul was ether, and other coins were converted into it. The FBI said the attacker was converting the stolen assets mainly into ether. Some 68,700 laundered ETH sit across 850 addresses, with 89 percent parked in the nine largest.

USDT was the most stolen and the most frozen coin. Tether froze $1.56 billion, but $434 million was converted into ether before that, and $234 million was converted into TRX on Tron. USDC was stopped most cleanly, with Circle freezing all of it before it could be swapped. RLUSD and USD1 were frozen at $200 million and $27 million, respectively. Stablecoins made up 54 percent of the stolen funds, but the freeze function made them the first assets the attacker had to dispose of.

TRX and Tron were the laundering highway. Cheap, fast and rich in USDT. The 684.6 million TRX spread across 7,700 addresses and mostly left as ether. USDD, a stablecoin promoted as unfreezable, appeared as a new laundering route on October 31.

XRP showed the unfreezable point in full. All 233 million coins moved into six wallets within about 80 hours, and with no issuer to stop them, tracking and exchange blocks are the only defense. Half of the SOL moved to new addresses and was then drawn down bit by bit, swapped into USDC and back, and passed through lending vaults. NEAR moved on the morning of November 1 and then stopped. BNB, Binance's own coin, fell 8.6 percent after the incident and showed 101.30 percent in the proof-of-reserves snapshot.

The Market as It Showed Itself

Four facts about the market showed through this process.

First, the market is centralized. When the signing system of a single exchange, the world's largest, was breached, $6.4 billion vanished in 20 minutes. Customer money sits in exchange wallets, so one failure becomes the whole event.

Second, stablecoin issuers act as police in practice. A 44 percent freeze is exceptional next to the 3 percent frozen after the Bybit theft. Yet critics noted the power does not work the same for every victim. Small victims need court orders, while in the Binance case the whole industry moved within an hour. A freeze also settles no question of ownership.

Third, a surveillance industry sits inside the market. TRM Labs, Chainalysis and Elliptic named the culprit within a day of the theft and reconstructed the money flows day by day. A public ledger makes that possible. The limit, that no one behind a wallet can be identified, stands unchanged.

Fourth, speed is asymmetric. The theft took 20 minutes and automated laundering ran at 1,300 transactions an hour, but cashing out takes months. The point where coins become real money is the only bottleneck that can be blocked, which is why the attacker moves slowly and in small amounts. The market shock was large. BNB fell 8.6 percent, bitcoin and ether fell close to 5 percent, liquidations topped $1.5 billion in a day, and shares of Circle and Coinbase fell. A crypto market event reached the stock market.

In sum, the hack showed the structure of the crypto market as it is. Money sits on the internet for convenience, and what protects it is people and systems, not cryptography. A stablecoin is a dollar with a switch, and exchange and movement are designed so no one can stop them. So tracking happens on the public ledger, blocking happens at the cash-out point, and defense rests on the issuers' switches and the exchanges' funds.

Editor's note: This article is based on material published through November 2 (Eastern time). Figures differ by source and the situation continues to change. The root cause of the intrusion is unconfirmed, and the figures cited are the findings of the agencies named, not independently verified by PhillyTalks.