Inca Digital Special Report: The $6.3 Billion Binance Hack

On October 29, attackers took roughly $6.3 billion from Binance wallets across multiple chains, the largest crypto hack on record and more than four times the size of the $1.5 billion Bybit hack in February 2025.

PREPARATION

On October 28 at 07:39 UTC, a brand-new wallet, 0x7c86, received the first of three 0.1 ETH withdrawals from Tornado Cash. This wallet became the attacker’s relayer, the account used to run the attack. At 15:59 UTC on October 29, the wallet deployed the sweeper contract, 0x63e842.

TAKEOVER

At 20:20:59 UTC, 0x7c86 sent a single EIP-7702 transaction to Binance 14. A wallet can only be delegated under EIP-7702 if its owner signs an authorization. This transaction carried 50 of them, all validly signed with Binance 14’s key.

Each authorization is tied to a nonce, a counter that goes up every time the wallet sends a transaction, and it only works if it matches the wallet’s current count. Binance 14 sends thousands of transactions a day, so the attacker signed a range of 50 consecutive nonces (18914775 to 18914824) to make sure one would line up whenever their transaction landed. Nonce 18914809 matched, and from that moment Binance 14 was delegated to the attacker’s sweeper contract.

EIP-7702 helps explain how the drain worked, but does not establish how the attacker first gained access.

SWEEP

At 20:24:23 UTC, 3 minutes and 24 seconds after the delegation, the relayer called the sweeper contract’s sweep() function on Binance 14. The function empties the wallet of every token and all its ETH except 1 ETH, left behind to cover transaction fees. In a single transaction, Binance 14 sent 167,464 ETH and 63 different tokens to the attacker’s collection address, 0x5227. The largest token holdings taken were 1.615B USDT, 198.4M ENA, 62.6M RLUSD, 27.8M USD1, 6.19M UNI, 2.26M LINK, 127,853 AAVE, 29,934 wBETH, 11,372 XAUt and 7.175T PEPE.

Inca followed $2.4B from the first sweep up to five hops.

At 20:24:47, Binance 16, a second Binance hot wallet, sent 28,005.6 ETH and 55.7M USDT to the same address. Those transfers were signed directly with Binance 16’s own key. At 20:41:23, in a separate transaction, the attacker used Binance 14’s owner role on Binance 34 to move 780M USDC, and another 43M USDC followed at 20:59.

At 21:04, the attacker swept Binance 14 again to collect deposits that had arrived since the first sweep, including 1,699.9 ETH. Because the delegation was still active, no new signature was needed. The sweeps continued. The attacker moved 128 ETH and 122 token transfers to a fresh receiving address, 0xa97bf.

RESPONSE

Binance has confirmed the attack, suspended all withdrawals, and pledged to cover all losses. It estimates that approximately $6.3 billion was impacted.

Binance says around $3 billion in funds have been frozen. Among the freezes, Tether froze more than 1.567 billion USDT, Circle froze more than 823 million USDC and Ripple froze about $200 million. The Arbitrum Security Council froze 74,559,805 ARB and 8,425 ETH, worth about $30.5 million, and World Liberty Financial froze $27 million in USD1.

The attacker also tried to put stolen funds to work, depositing USDT as collateral on Aave and borrowing 20,000 WETH against it. Aave responded by freezing its V3 and V4 lending markets to stop the attacker from borrowing additional funds, adding a protocol-level freeze to the issuer freezes.

Binance says it has set aside more than $6.34 billion of company funds to cover the incident. About $5 billion of that is already held in the same tokens that were stolen. Binance is buying the rest through market and OTC channels so the reserves match the impacted assets token for token, a process it says may take longer for low-liquidity tokens.

Inca’s RAD flagged the freeze chatter on X and Telegram as it broke, clustering it with related posts.

OUR TAKE

Cryptographically valid signatures do not establish legitimate business authorization. Here, signed EIP-7702 authorizations let attacker-controlled code operate Binance 14, reach a dependent wallet and repeatedly sweep new deposits. Binance’s preliminary account points to abuse of its withdrawal infrastructure, with no evidence of leaked private keys. That distinction matters: protecting key material alone cannot prevent a compromised workflow from requesting dangerous signatures. Controls must assess authorization payloads, restrict delegation targets and wallet-to-wallet privileges, and detect changes in account code before automated funding continues.

The Aave transactions show how exposure can spread beyond the compromised custodian. Converting stolen USDT into collateral and borrowing WETH creates claims on a lending pool without exploiting that pool’s code. Monitoring must follow asset provenance through swaps, borrowing and subsequent transfers, while distinguishing the attacker’s position from the protocol’s reserves. The eventual loss depends on whether collateral remains transferable and liquidatable, how liabilities are allocated and what can be recovered; tracing the theft alone does not resolve those downstream exposures.

The rapid freezes are encouraging, but frozen balances are only the starting point for recovery. On-chain flows need to be connected to off-chain identities, service records and evidence of control, with a documented chain of custody and analysis that can withstand legal scrutiny. That record can support preservation and disclosure requests, jurisdiction-specific recovery claims and coordinated action by counsel, issuers and law enforcement. The objective is to turn temporary restrictions into enforceable restitution and pursue the operators and any demonstrably complicit facilitators who enable them to move and monetize stolen assets.

ADDRESSES

As of October 30, 2026.