October 30, 2026 — Crypto markets are facing simultaneous pressure from heavy leveraged liquidations and a major security incident involving Binance. TRM Labs traced approximately $6.36 billion in asset transfers from Binance wallets across ten blockchains, making the incident the largest reported crypto theft on record by value. Binance's preliminary investigation points to a potentially compromised DevOps engineer's laptop, while the exchange says it has found no evidence of wallet private keys being leaked. With billions of dollars in assets reportedly frozen and questions remaining over the funds still under attacker control, the incident has renewed scrutiny of exchange custody security, transaction authorization, and counterparty risk.
Binance Security Incident Sends $6.36 Billion Across Ten Blockchains
On October 30, crypto markets came under pressure as leveraged positions were liquidated alongside reports of a major Binance security incident. According to CoinGlass, 239,224 traders were liquidated over the preceding 24 hours, with total liquidations reaching approximately $1.536 billion. The largest single liquidation was valued at around $11.09 million on Binance's BTCUSDT market.
At the same time, TRM Labs tracked approximately $6.36 billion in assets transferred out of Binance wallets across ten blockchains. The scale exceeds the approximately $1.5 billion Bybit incident in February 2025, making it the largest crypto asset theft on record according to TRM's assessment.
The two developments create overlapping sources of market stress. Liquidations can accelerate price movements as leveraged positions are forcibly closed, while a major exchange security incident can raise concerns about custody, withdrawal access, and counterparty exposure. The impact therefore extends beyond short-term price volatility to confidence in centralized trading infrastructure.
How the Attack Exploited EIP-7702 and Hot-Wallet Authorization
TRM Labs said the attackers prepared malicious code in advance and exploited Ethereum's EIP-7702 authorization mechanism, alongside hot-wallet signing processes on other blockchains, to move assets.
On Ethereum, EIP-7702 allows an externally owned account to delegate certain execution behavior to smart contract code through a signed authorization. TRM's investigation indicates that attackers used pre-signed authorizations to make a Binance hot wallet execute transfers under attacker-controlled instructions.
The activity across other chains points to a broader compromise than a single Ethereum-specific vulnerability. TRM observed valid transfers from Binance wallets across multiple networks and assessed that the attackers may have gained access to the exchange's hot-wallet signing infrastructure.
TRM attributed the incident with high confidence to TraderTraitor, a hacking group linked to North Korea. This remains a cybersecurity firm's investigative assessment based on on-chain and off-chain intelligence, rather than an official judicial determination. Binance has said it is working with law enforcement and blockchain intelligence partners to establish the perpetrators' identities.
The incident highlights an important distinction in exchange security: private keys do not necessarily need to be directly extracted for unauthorized transactions to occur. If attackers compromise the systems responsible for requesting, approving, or signing withdrawals, they may be able to exploit legitimate signing mechanisms to move assets.
Binance Cites a Potential DevOps Laptop Compromise and Pledges to Cover Losses
In its preliminary findings published on October 30, Binance said the incident may have involved the compromise of a DevOps engineer's laptop. According to the exchange, this could have allowed an attacker to gain access to service containers and submit unauthorized withdrawal requests.
Binance said it had found no evidence that wallet private keys were leaked. The exchange estimated the total impact at approximately $6.3 billion and stated that it had worked with blockchain partners to freeze around $3 billion in affected assets on-chain. It also pledged to cover all losses through its SAFU Fund and corporate funds.
As an immediate precaution, Binance temporarily suspended deposits and withdrawals while security checks were carried out, revoked the affected address authorization, and engaged law enforcement and blockchain intelligence partners to trace and recover the assets. The exchange said it would publish a detailed technical post-mortem after its investigation was complete and provide an updated Proof of Reserves following remediation.
These measures address immediate recovery and user-loss concerns, but they do not yet provide a complete explanation of how the attackers gained access or how the authorization process was compromised. The full technical report will be important for assessing the incident's root cause and the effectiveness of Binance's security controls.
Frozen Funds and Remaining Assets Keep Exchange Custody Risks in Focus
Although Binance and its partners have frozen approximately $3 billion in affected assets, the amount still under attacker control remains a major concern. On-chain tracking estimates have varied by observation time and methodology. Bitquery's October 30 investigation, for example, estimated that approximately $3.1 billion remained with the attacker at 03:54 UTC, primarily in ETH and BTC. TRM's later assessment reported that the attacker held more than 420,000 ETH and 18,270 BTC, valued at approximately $2.4 billion at the time of its analysis.
These figures should not be treated as directly interchangeable because asset prices, subsequent transactions, and tracking snapshots can change the estimated value. Nevertheless, they show why the recovery process remains important even after substantial freezes.
The incident also exposes the limits of relying on private-key protection as the sole measure of custody security. Exchange infrastructure depends on multiple layers, including employee devices, access permissions, service containers, transaction approval workflows, and signing systems. A weakness in any of these areas can create a path to unauthorized transfers, even if there is no direct evidence of private-key extraction.
For centralized exchanges, stronger privilege separation, multi-layer transaction approvals, monitoring of unusual authorization requests, and independent security reviews are essential to reducing this type of operational risk.
Crypto Market Risks Extend Beyond Liquidations to Counterparty Confidence
When large-scale liquidations coincide with concerns over exchange custody, market risk expands beyond ordinary price volatility. Traders must also consider withdrawal availability, counterparty exposure, potential liquidity discounts, and the possibility that uncertainty could widen spreads or disrupt trading activity.
The Binance incident may also influence how investors distribute assets between centralized exchanges and self-custody solutions. However, the extent of any shift will depend on the restoration of normal services, the transparency of the investigation, and confidence in the exchange's ability to protect and account for customer assets.
For Bitcoin and other crypto assets, the immediate market outlook will depend on both broader liquidity conditions and developments surrounding the incident. Forced liquidations can intensify selling pressure, while uncertainty over custody security may affect trading activity and risk appetite. These factors can interact, but they do not necessarily produce a uniform market direction.
Investors should monitor four developments: the restoration of Binance's deposit and withdrawal services, further movement of assets still attributed to the attacker, changes in the amount of frozen funds, and the release of Binance's technical post-mortem and updated Proof of Reserves. These updates will help determine whether the incident remains a contained security crisis or develops into a broader test of confidence in centralized crypto exchanges.
