At 4:20:59 AM Beijing Time on October 30, a seemingly ordinary Ethereum transaction was successfully confirmed on-chain. This transaction submitted 50 EIP-7702 authorizations to Binance's "Binance 14" hot wallet, which is marked as a high-risk address. Three minutes and 24 seconds later, all assets in this wallet—167,464 ETH, 1.615 billion USDT, and 63 other tokens including UNI, LINK, AAVE, and PEPE—were swept away in a single transaction.

This marks the largest exchange heist in cryptocurrency history. On-chain data shows that outflows from Ethereum alone exceeded $3.3 billion, while cross-chain estimates range between $5.5 billion and $6.2 billion. For comparison, the $1.5 billion cold wallet breach at Bybit in February 2025 was previously the industry’s record-breaking incident.

Panic quickly spread to secondary markets.

Bitcoin rapidly dropped below $78,500, Ethereum fell below $2,250, and BNB plunged by up to 9% intraday. Within one hour, the global futures market saw $629 million in liquidations—$607 million of which were long positions.

Binance subsequently urgently suspended withdrawals across multiple networks and halted Binance Alpha trading. Repeated statements emphasized that user funds remained fully secure. Binance founder CZ (Changpeng Zhao) openly stated on X: “It does look like we’ve been hacked,” while citing an estimate from DefiLlama co-founder 0xngmi that the actual net loss “may be slightly above $1 billion but will be fully covered.”

This was not merely a battle for Binance—the entire crypto ecosystem mobilized in response.

Tether froze over 1.567 billion USDT approximately 40 minutes after the incident; Circle froze over $800 million in USDC; Ripple froze around $200 million in RLUSD; World Liberty Financial froze $27 million in USD1; Paxos froze approximately 1,906 PAXG tokens.

Binance’s latest official update confirms frozen amounts have reached $3 billion, with the figure expected to rise further.

48-Hour Infiltration and a Death Warrant Authorization

This was not a spontaneous attack.

Shortly after the incident, Cobo co-founder and crypto OG Shenyu released a blockchain forensic video. Tracing on-chain footprints backward reveals that the attacker had begun preparations at least two days prior to the event.

Starting in the afternoon of October 28, the attacker made three separate withdrawals from the mixing protocol Tornado Cash, extracting small amounts to cover gas fees for deploying and testing malicious contracts. From late evening on October 29 through early morning on October 30, the attacker used test wallets to fully simulate the entire attack sequence twice. The final test concluded just three and a half hours before the main operation commenced at 4:20:59 AM.

The decisive weapon was Ethereum’s newly introduced feature in last year’s Pectra upgrade: EIP-7702.

In traditional Ethereum architecture, ordinary externally owned accounts (EOAs)—wallets controlled by private keys—and smart contract accounts operated under distinct, isolated systems. EIP-7702 shattered this boundary, enabling standard wallets to temporarily delegate control of their accounts to a specific smart contract via a special authorization signature. As long as the delegation remains unrevoked, the contract can execute any action on behalf of the wallet owner—including batch transfers.

In his analysis, Shenyu broke down the logic of the attack contract: “The attacker’s program recognizes only one master and performs only one task: transferring funds.”

The transaction timestamped at 4:20:59 AM was the moment “Binance 14” signed this digital death warrant. Once activated, the hacker no longer needed to access Binance’s private keys directly—by simply invoking the contract, they could empty the wallet of all 64 token types.

At 4:41 AM, an even more alarming event unfolded. Using the legitimate identity of the “Binance 14” hot wallet, the attacker issued commands to dispatch a USDC contract wallet that was subordinate to it, instantly transferring 823 million USDC. By 6:40 AM, the attacker had made four round trips to the “Binance 14” hot wallet, sweeping every remaining asset—including small incoming deposits. Chain analyst Ai Yi monitored that the hacker even sold off the entire 7.77 trillion PEPE tokens held in the wallet, converting them into ETH on-chain.

Why would the world’s most secure exchange’s hot wallet sign 50 consecutive EIP-7702 malicious authorizations using its own private key?

“From the chain perspective, the issue lies in the signing process—not in a contract vulnerability,” Shenyu diagnosed in his video.

Even more suspiciously, at 6:55 AM, Binance’s security team itself used the same private key from “Binance 14” to sign a transaction moving residual tokens back to Binance’s internal secure wallet. Over two hours after the breach, Shenyu continued warning on X: “The key was still in Binance’s hands, yet the fatal EIP-7702 delegation authorization remained unrevealed. At that time, a deposit of approximately 2,961 ETH was stuck due to low gas fees—once it arrived, it faced immediate risk of being swept again by the hacker’s script.”

This strongly suggests the attacker did not directly steal plaintext private key files. Instead, they likely exploited a flaw in Binance’s internal automated signing system, permission verification mechanism, or operational command pipeline—manipulating the signing infrastructure into approving a Type-4 transaction it should never have authorized.

Every Day Is Zero-Day

Hours after the Binance incident, Musk posted on X: “Everyday is Zeroday,” implying AI has pushed the crypto industry into an era where offensive and defensive capabilities are permanently unbalanced.

Blockaid co-founder and CEO Ido Ben-Natan offered a more precise assessment: “This attack closely resembles the $1.46 billion Bybit breach in February 2025, with on-chain preparation tactics matching known characteristics of North Korean hacker operations.”

This is no mere speculation.

Immunefi CEO Mitchell Amador has repeatedly warned publicly this year that AI has decisively tilted the balance of power toward attackers, with defenders needing at least three to four years to catch up.

In past security battles, zero-day vulnerabilities—unidentified, unpatched critical flaws—were rare, high-value weapons mined manually by elite hackers over months. But in 2026, with AI large models unleashing unprecedented computational power, the balance has completely collapsed. AI can now continuously scan global open-source protocols and smart contract code 24/7, mass-produce zero-days, and combine deepfake technology with automated penetration scripts to launch precision attacks—down to the millisecond—targeting exchange operations staff and internal signing pipelines.

It’s not even the end of 2026, yet over 230 crypto protocols have already been attacked across the network.

According to ValueTheMarkets, North Korea-linked hacking groups stole $643 million in crypto assets during the first half of 2026—accounting for 66% of the total stolen value globally in that period. From Bybit to Binance, attack scale has multiplied several times within eight months.

Even industry giants with the most robust security budgets face existential risks when confronted with the combination of “AI-driven blind spot discovery + nation-state targeted exploitation.” A single code upgrade or a single signing validation oversight could lead to total collapse.

The industry has already entered an arms race. According to DLNews, multiple top-tier exchanges and security firms are vying for early access to Anthropic’s latest Claude Mythos model, attempting to leverage cutting-edge AI to reinforce defenses. Cyvers CEO Deddy Lavid stated: “The crypto industry is the first market to truly feel the impact of AI.”

But reality is harsh: attackers need only find one vulnerability, while defenders must protect against all. When nation-state hacker groups combine with AI tools, this mathematical equation becomes unforgiving for all centralized platforms.

Author: DeepFlow TechFlow