On October 29, attackers took roughly $6.3B from Binance's hot wallets across Ethereum, Bitcoin, Tron, Arbitrum, Optimism and Avalanche. It is the largest theft in crypto history, about four times the Bybit hack of February 2025. Around $3B has been frozen. Several investigators attribute it to North Korea.
The detail that matters most came from Binance itself: no private key leaked. Its initial investigation points to a compromised DevOps engineer's laptop, which gave the attacker access to an internal service container that could submit withdrawal transactions.
In other words, Binance's signing infrastructure did exactly what it was built to do. It signed what a trusted internal service asked it to sign.
Every check passed
- 20:20 UTC
A single transaction carries 50 EIP-7702 authorizations for Binance 14, one of the exchange's busiest Ethereum hot wallets - all validly signed. The attacker couldn't know which nonce would be live mid-withdrawals, so they covered a range. One landed.
- 20:24 UTC
Binance 14 now runs the attacker's sweeper code. One call moves about $2.5B to a fresh address.
- Next 12 minutes
Ten more Binance hot wallets on four chains send ordinary, validly signed transfers to the same address, mixed in with routine withdrawals.
- 21:44 UTC
The still-delegated wallet is swept again for ~$200M in deposits that arrived after the first drain. No new signature required.
The keys were safe. The requests came from a real internal service. The signatures were valid. Nothing in the pipeline asked an independent question.
Six months ago: the same playbook
This is the second time this year. In April, KelpDAO lost $292M. Investigators attribute both attacks to the same North Korean unit, TraderTraitor, and the two playbooks rhyme.
According to LayerZero's post-mortem, the attackers compromised a developer's machine and used it to reach LayerZero's internal RPC infrastructure. They swapped the software on two nodes so they returned forged chain state while looking healthy to monitoring. On the day, they knocked the clean external RPC provider offline with a DDoS, so the verifier failed over onto the poisoned nodes. Kelp's bridge trusted a single verifier, and one forged answer released 116,500 rsETH.
| KelpDAO, April 2026 | Binance, October 2026 | |
|---|---|---|
| Way in | Developer machine compromised | DevOps engineer's laptop compromised |
| What the attacker controlled | Internal RPC nodes - the data | An internal service - the requests |
| What trusted it | A single verifier | The hot-wallet signers |
| Independent check | None | None |
| Loss | $292M | ~$6.3B |
KelpDAO poisoned what the system believed about the chain. Binance poisoned what the system was asked to sign. Both times, one trusted internal source was enough, and nothing checked it against an independent one.
One detail from Kelp is worth holding onto: failover was part of the attack. The attackers didn't only poison nodes. They took down the healthy provider so the system would route to the poisoned ones by itself. Failover without cross-validation isn't resilience. It's a lever.
In a 7702 world, "what is this address?" is a security question
Until recently, an exchange hot wallet was a plain address with no code. A valid signature moved funds, and that was the whole story.
EIP-7702 changed that. Any wallet can now carry code. Binance 14 went from no code to a pointer at the attacker's contract, and that change sat on-chain for 3 minutes and 24 seconds before the $2.5B sweep. It also survives key rotation, because the delegation lives on the address.
So every meaningful check now depends on reading chain state correctly. Is there code at this address? Did it change? Is this destination new? Should this balance be moving?
Those answers come from an RPC. If they come from one provider, every security check built on top inherits that provider's lag, outage or compromise. Chain data is no longer plumbing. It is a security control.
Who verifies what
| Layer | The question it answers | What Oct 29 showed |
|---|---|---|
| Key custody | Is the key safe? | Held - no key leaked |
| Internal services | Did this request come from us? | Yes - from a compromised internal service |
| Signing policy | Should this be signed at all? | A hot wallet signed its own delegation and nine-figure transfers to a brand-new address |
| Chain data | Is the state I'm acting on true? | Every check above and below depends on it |
| Monitoring and response | Did something change on our addresses? | The delegation was visible for 3m24s before the sweep |
The industry has spent a decade hardening the top row. October 29 was decided in the rows below it.
Where Magma stands
Magma's Smart Router is the access layer between institutions and the chain. It routes and cross-validates reads and writes across multiple independent infrastructure providers, deployed inside the customer's own environment, and it runs in production at tier-1 exchanges and custodians.
To be clear about scope: Smart Router does not decide what a signer should sign. That is the signing-policy layer. What we own is the row every other layer stands on - making sure the chain state an institution's policies, monitors and responders act on is verified across independent sources, not trusted from one.
Binance kept its keys and still lost $6B, because a single trusted internal service was enough. The same logic applies to data. Any control that trusts a single source inherits that source's compromise.
Every high-value transaction deserves independent verification. Not just a valid signature. Not just one provider's answer.
Magma Devs builds Smart Router, the enterprise access layer for institutional blockchain infrastructure. SOC 2 Type II compliant and ISO/IEC 27001 certified. Talk to us →
How exposed is your RPC stack?
Take the 2-minute Secure RPC Assessment and get a personalized risk report.
Run the assessment
