# Hackers moved $2.5 billion out of a Binance hot wallet in one transaction after a $15 authorization

New analysis of the October 29 theft, which Binance puts at $6.3 billion, comes as the exchange confirms its chief financial officer is leaving and tells users in several European countries, including France, to withdraw before their accounts close on December 31.

- Published: 2026-11-08T05:54:51.727Z
- Canonical: https://polylog.news/crypto/2026-11-08/hackers-moved-2-5-billion-out-of-a-binance-hot-wallet-in-one
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Rekt News](https://www.rekt.news/), [ForkLog](https://forklog.com/en/hackers-pay-15-to-drain-2-5-billion-from-binance-wallet/), [PBX Science](https://pbxscience.com/hackers-used-a-15-ethereum-authorization-to-move-2-5-billion-out-of-a-binance-hot-wallet-in-one-transaction/), [NPR](https://www.npr.org/2026/11/03/nx-s1-6027799/binance-crypto-exchange-cyber-heist), [The Washington Post](https://www.washingtonpost.com/business/2026/11/02/binance-has-covered-95-crypto-assets-taken-record-63-billion-hack/), [Khaleej Times](https://www.khaleejtimes.com/business/how-binances-63-billion-hack-went-down-across-the-world), [Wikipedia](https://en.wikipedia.org/wiki/2026_Binance_hack), [Polylog editors](https://polylog.news), [CoinDesk](https://www.coindesk.com/business/2026/11/07/binance-users-in-some-european-countries-told-to-pull-crypto-before-fees-kick-in-with-accounts-closing-by-year-end)

The on-chain phase of the Binance theft was short. Blockchain security firm Blockaid found that the attackers [paid about $15 in Ethereum fees](https://forklog.com/en/hackers-pay-15-to-drain-2-5-billion-from-binance-wallet/) to set up a delegation that gave their own software control of a Binance hot wallet. That step moved no tokens. About three and a half minutes later, roughly $2.5 billion, about 40% of the total, [left the wallet in a single transaction](https://pbxscience.com/hackers-used-a-15-ethereum-authorization-to-move-2-5-billion-out-of-a-binance-hot-wallet-in-one-transaction/). [Rekt News](https://www.rekt.news/) has published its own account of the incident.

The $15 fee was the last step of a long operation. The attack began with social engineering. A Binance engineer [took what he believed was a job interview](https://www.npr.org/2026/11/03/nx-s1-6027799/binance-crypto-exchange-cyber-heist), and Binance has described a recruiter message and a coding assignment as the entry points. Analysts cited by PBX Science note that the delegation only worked because the attackers had already compromised Binance's signing infrastructure. The root cause is therefore a key and signing compromise achieved through an employee. The Federal Bureau of Investigation (FBI) attributes the theft to TraderTraitor, a group linked to North Korea, [according to Wikipedia's summary](https://en.wikipedia.org/wiki/2026_Binance_hack) of official statements. North Korea has denied involvement.

Binance says the total loss is $6.3 billion, which The Washington Post called a record. The exchange said on November 2 that it had [covered 95% of the stolen assets](https://www.washingtonpost.com/business/2026/11/02/binance-has-covered-95-crypto-assets-taken-record-63-billion-hack/) from its reserves and corporate treasury. Tether and Circle froze more than $2 billion of their own tokens taken in the theft. The blockchain analytics firm TRM said $2.4 billion was already ["beyond any issuer's reach"](https://www.khaleejtimes.com/business/how-binances-63-billion-hack-went-down-across-the-world), and the stolen funds are being converted into ether.

On November 7, Binance [confirmed that its chief financial officer (CFO), Kaiser Ng, is leaving](https://t.me/BWEnews/16609) and named Justin Yek as his successor, according to Bloomberg as relayed by BWE News. The sources do not connect the departure to the theft. The same day, [CoinDesk reported](https://www.coindesk.com/business/2026/11/07/binance-users-in-some-european-countries-told-to-pull-crypto-before-fees-kick-in-with-accounts-closing-by-year-end) that users in Spain, France and Poland had received notices to withdraw before fees begin, with accounts closing on December 31. Binance France told customers it will close all accounts after it [failed to obtain authorization](https://t.me/GokuCryptoNews/21244) under the European Union's Markets in Crypto-Assets Regulation (MiCA). Deposits there are already blocked.

## What this means

The theft shows that once attackers control an exchange's signing authority, the on-chain cost of draining a wallet is close to zero. Defenses therefore have to sit in the back office: key ceremonies, signing policy engines, time delays on delegations and checks on staff devices. Binance customers are exposed through counterparty risk, because covering $6.3 billion from reserves and the corporate treasury leaves less capital available to absorb the next incident. Centralized stablecoin issuers showed they are the most effective recovery tool, since they froze more than $2 billion. That is the same control that makes them useful to sanctions enforcers. The closest precedent is the February 2025 Bybit theft of about $1.5 billion, which the FBI also attributed to North Korean operators. Bybit replaced the funds, kept operating, and most of the laundered ether was never recovered. The desk's read is that the unfrozen portion will move through swaps and bridges over the coming weeks with few further recoveries, and that large exchanges will add delays and stricter policies on hot-wallet delegations within months. That read would be wrong if Binance's reserve disclosures show a shortfall in customer assets, which would turn a loss to the company's treasury into a solvency question.

## What to watch

- Binance's next proof-of-reserves report. It will show whether the treasury-funded replacement left customer assets fully backed.
- Further freezes by Tether and Circle on addresses tied to the theft. These show how much of the loss stablecoin issuers can still claw back.
- How many Binance users in France, Spain and Poland move to MiCA-licensed rivals before December 31. This shows whether the license perimeter actually redistributes market share in Europe.