20 Minutes, $6.3 Billion, and 50 Pre-Signed Signatures: Inside the Largest Heist in History
20 Minutes, $6.3 Billion, and 50 Pre-Signed Signatures: Inside the Largest Heist in History
Published: October 30, 2026 | Reading Time: ~5 minutes | Channel: techminute
Sometime around 4 p.m. ET on Thursday, October 29, the largest theft in the history of money — any money — began. In roughly 20 minutes, starting at 20:05 UTC, an attacker drained approximately $6.36 billion in crypto from Binance, the world's largest cryptocurrency exchange, sweeping wallets across ten blockchains into a single set of attacker-controlled addresses. That's about four times the previous record, the $1.5 billion Bybit hack of February 2025. Three blockchain-intelligence firms — TRM Labs, Chainalysis, and Elliptic — point to TraderTraitor, North Korea's elite crypto-hacking unit, with TRM saying "high confidence." The money is still moving. About $2.7 billion has been frozen by stablecoin issuers racing the attacker in real time. The rest — roughly $3.3 billion, mostly Bitcoin, Ether, and XRP — is, in the words of Elliptic co-founder Tom Robinson, something "no one can freeze."
Here's what the on-chain forensics actually show, and why the cleverest part of this heist wasn't the theft at all. It was the countdown.
The 20-Minute Timeline
According to TRM Labs' reconstruction, this wasn't a smash-and-grab. It was choreography:
- Oct 28, morning (T-36 hours): The attacker's operator wallet starts receiving small withdrawals from Tornado Cash, the crypto mixer — funding the operation while obscuring its origin. This funding-then-staging pattern matches the Bybit heist exactly.
- Oct 29, early: The attacker deploys a first version of the attack code and tests it on two wallets. Later, they rehearse the final version on a third, then route the test funds back to themselves. Dress rehearsal, complete.
- Four hours after the rehearsal: The same code is installed on a Binance hot wallet.
- 20:05–20:09 UTC: Five Binance wallets on the XRP Ledger send 233.46 million XRP (~$296M) to one attacker address, each left at its minimum balance. That XRP hasn't moved since.
- ~20:10 UTC: Solana and Optimism wallets follow — 970,500 SOL (~$96M) among them.
- 20:20 UTC: A Binance Bitcoin hot wallet sends 18,270 BTC (~$1.47B), which immediately begins splitting into round 1,000- and 100-BTC pieces within the same block — a "peel chain" that fragments the trail. Two minutes later, a Tron wallet sends 612.7M USDT (~$628M).
- 20:22–23:05 UTC: The Ethereum main event (below), followed by re-sweeps at 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56 — every time fresh deposits land, they're swept again. A second wave hits Avalanche and Polygon at 23:05.
By the end, Ethereum accounted for about $3.79 billion of the haul — 200,630 ETH plus 185 other tokens, including $1.875 billion in USDT and $823 million in USDC.
The Crypto Trick: Fifty Signatures and a Moving Target
The Ethereum attack used a feature that shipped with Ethereum's own Pectra upgrade in May 2025: EIP-7702 delegation, which lets a normal wallet hand control of its behavior to a smart contract by signing an authorization. The delegation sticks until the wallet signs a new one.
The problem for an attacker: every Ethereum wallet has a nonce — a transaction counter that ticks up with each withdrawal. An authorization is only valid at the exact count the wallet has reached when it executes. And Binance's hot wallet, which processes a steady stream of customer withdrawals, never stops counting.
So the attacker solved it with brute-force elegance: a single transaction containing 50 pre-signed authorizations, each signed by Binance's own hot wallet, each pointing to a sequential future nonce, each delegating the wallet to a sweeper contract that only accepts instructions from the operator. Like buying fifty consecutive raffle tickets for a drawing whose number keeps advancing — you only need one to land. One did.
Three minutes and 24 seconds after the delegation executed, the operator told the Binance wallet to send its entire balance to an attacker address: one transaction, 167,464 ETH and 63 tokens, including $1.615 billion in USDT. The delegation stayed in place and kept sweeping for hours.
And here's the part that should worry every exchange: the other nine chains weren't drained via delegation at all — their wallets produced ordinary, validly-signed transfers to the attacker, across different chains, key types, and signing schemes, all within about half an hour. TRM's assessment: the attacker didn't phish fifty signatures in isolation. They most likely gained control of Binance's hot-wallet signing infrastructure itself — the system that makes wallets sign. Binance's own statement is telling: an initial investigation suggested "a compromised laptop" belonging to an engineer, but the company now says it "has uncovered additional points of breach" and has not published a root cause. The batch of 50 pre-signed authorizations suggests the access was time-limited, or that signatures had to flow through a system the attacker could influence — briefly.
The Freeze Race
What happened next was genuinely novel: stablecoin issuers ran a live counter-attack, block by block:
- 21:01 UTC (37 minutes after the main sweep): Tether froze 971.1M USDT in the main receiving wallet — and later freezes landed into already-frozen wallets. Total: ~1.77 billion USDT.
- 21:04 UTC: Circle froze the 823M USDC, coordinated with law enforcement.
- 22:01 UTC: Ripple froze the wallet holding stolen RLUSD (40.5M of 88.5M remained), and also froze RLUSD sitting in the compromised Binance hot wallet — so new deposits couldn't be swept.
- 22:10 UTC: World Liberty Financial (yes, the Trump-linked one) froze 27.8M USD1.
- 00:08 UTC: Arbitrum's Security Council used emergency powers to force 8,426 ETH and 74.6M ARB (~$30M) out of the attacker's reach.
Total frozen: ~$2.7 billion on-chain as of 00:30 UTC per TRM. (Binance's own verified count was $2.54 billion at 23:35 UTC; The Guardian and CNBC round up to "about $3 billion" — the discrepancy is definitional, and worth keeping honest.)
The attacker, meanwhile, raced the freezes by dumping: selling 325M USDT through UniswapX at an implied ~$2,650 per ETH against a market of $2,300–2,350 — a discount of more than 10% — to buy unfreezeable ether. Per TRM, the attacker now holds more than 420,000 ETH and 18,270 BTC, roughly $2.4 billion beyond any issuer's reach. Elliptic puts the total un-frozen share at ~$3.3 billion (~56%) and doesn't expect it to shrink much: "Some will be caught over the coming months, but I don't expect the frozen share to rise much further."
Recovery is a different clock entirely. "A freeze stops the money from moving, and recovery follows through legal process," TRM's Ari Redbord — a former US federal prosecutor — told CNBC. Chainalysis's Eric Jardine: "A technical freeze may happen quickly, while returning funds can take months or years."
Why It Matters
First, the sheer scale. North Korea is estimated to have stolen roughly $3 billion total in crypto per year in recent era peaks; Elliptic's Robinson notes that if Pyongyang is behind this — as three tracing firms assess — "this one theft would almost double everything the regime has stolen in crypto to date." The previous FBI-attributed record, Bybit's $1.5B in February 2025, fell by a factor of four. One GSR executive told The Guardian plainly: "It's the biggest hack in history."
Second, the lesson isn't about wallets — it's about signing. Multi-sig, hardware isolation, per-transaction approvals: all of it protects the keys. This attack went after the machinery that uses them. TRM's read — that Binance's signing infrastructure was compromised across ten heterogeneous chains simultaneously — reframes hot-wallet security as a systems problem, not a key-custody problem. Expect every exchange on earth to audit its signing pipelines this week.
Third, the market verdict, for now, is oddly calm. Binance — 335 million registered users, ~$162.8 billion in assets under custody — suspended all deposits and withdrawals, and co-CEO Richard Teng said: "Bottom line – your money is safe, and we're covering every loss." Founder Changpeng Zhao posted "User funds are safe!" Bitcoin dipped about 3% to a six-week low of $76,368 — painful, but not a collapse. Fundstrat's Sean Farrell sees "no meaningful solvency risk," noting the ~$1.2 billion SAFU fund could cover roughly a third of the un-frozen losses. He adds the honest caveat: the real test is whether withdrawals resume quickly and outflows stay orderly. Polymarket — hit by a separate, unrelated third-party breach the same day — resumed trading and is reimbursing users.
One more thing worth sitting with. Binance's initial theory was a compromised engineer's laptop. The final attack moved through fifty pre-signed authorizations across ten blockchains in twenty minutes — choreographed with 36 hours of rehearsal, funded through a mixer, executed with the patience of a state actor. As TraderTraitor demonstrated with Bybit, and just re-demonstrated at 4× the scale: the frontier of financial crime isn't breaking the vault anymore. It's briefly becoming the person who builds the vault's doors.
📚 Sources
- TRM Labs — "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History" (Gold — full on-chain forensic reconstruction, October 29, 2026). https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
- WIRED — "The $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes" by Matt Burgess (Elliptic, Sophos, Chainalysis quotes; Tornado Cash staging; laundering analysis). https://www.wired.com/story/the-dollar63-billion-binance-hack-was-pulled-off-in-just-20-minutes/
- The Guardian — "North Korean group blamed for $6.3bn Binance hack in biggest ever crypto heist" (Binance statements, Yi He, Teng, CZ, market reaction, user/custody figures). https://www.theguardian.com/business/2026/oct/29/binance-crypto-exchange-hack
- CNBC — "Binance's $6.3 billion hack: What we know and what comes next" (Redbord and Jardine on recovery, Farrell/Fundstrat solvency analysis, Perkins on security standards). https://www.cnbc.com/2026/10/30/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next-.html
All claims verified against Gold-tier (TRM Labs on-chain forensics, company statements) and Silver-tier (WIRED, The Guardian, CNBC) sources. Each source URL was scraped and confirmed accessible. Attribution to TraderTraitor reflects the assessment of blockchain-intelligence firms, not an official law-enforcement or Binance determination; Binance has not published a root cause. Figures are as of TRM's on-chain snapshot at 00:30 UTC, October 30, 2026. Last verified: 2026-10-30.