Binance hacker swaps stolen funds into 420,000 Ether

The attacker behind the $6.3 billion theft from Binance now controls more than 420,000 Ether Ethereum ↗ 0.18% and 18,270 Bitcoin ↗ 0.09%. Blockchain analytics firm TRM Labs puts those holdings at about $2.4 billion, and no issuer can freeze them, according to TRM Labs. Analysts say it is the largest crypto theft on record. While freezes by stablecoin issuers have locked up a large share of the loot, the attacker has been turning what remains into assets that cannot be seized.trmlabs.com

Lookonchain found that the hacker sold UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD tokens for 70,480 ETH, 24/7 Wall St. reported. Nansen counts 442,000 ETH across the attacker's wallets. TRM says the attacker also sold about 325 million USDT to market makers for roughly 122,300 ETH, and a second wallet borrowed about 19,760 ETH against USDT on Aave ↗ 0.17%, after which Aave froze the affected markets.247wallst.com+1

How the Ethereum drain worked

On Ethereum, the attacker used EIP-7702, a feature from the May 2025 Pectra upgrade that lets an ordinary wallet run smart-contract code. That was enough to empty about $2.5 billion from a wallet labeled "Binance 14" in under four minutes on Thursday, October 29, CoinDesk reported. The attacker sent one transaction with 50 authorizations, all signed by the Binance wallet, each set for a different transaction counter, or nonce. The wallet was busy with withdrawals, so this gave one of them room to match. A single sweep then moved 167,464 ETH and about 1.6 billion USDT. The malicious delegation stayed active for nearly four hours, so new customer deposits kept being swept out too.coindesk.com

Protos noted that the delegation was mostly a convenience, since other Binance wallets and other networks were drained with ordinary signed transfers. TRM concluded that Binance's hot wallet signing infrastructure had been compromised. Co-CEO Richard Teng said early findings pointed to a compromised DevOps engineer's laptop, though "this was not a single 'one-click' action".protos.com+2

Freezes and attribution

Tether froze nearly $1.57 billion and Circle ↘ 9.31% froze more than $800 million in USDC USD Coin, Reuters Thomson Reuters Corporation ↗ 1.63% reported. Arbitrum's ↘ 0.15% Security Council used its emergency powers to move 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker's reach. Binance says about $3 billion has been frozen in total. It has set aside around $6.34 billion of company funds to cover losses and expects withdrawals to resume within 48 hours.reuters.com+1

TRM, Chainalysis and Elliptic have all linked the attack to North Korea. Binance has not named a culprit. Ether fell after the hack. 24/7 Wall St. estimated that the attacker's stash equals about 3.6% of a day's ETH trading volume, which means a gradual sale could be absorbed but a sudden dump could weigh on prices.247wallst.com+1