How did hackers drain Binance without the key?

On October 29, 2026, attackers moved about $6.34 billion out of Binance’s hot wallets in under four hours, by Binance’s own count. Binance says it found no evidence that a private key leaked. Every one of those withdrawals carried a genuine signature. So how do you drain an exchange without stealing its key?

▶ Try it yourself in Signed, Not Meant: add a check at a toy exchange’s signer, change how far the attacker got, and watch its requests get signed, capped or bounced.

A signature proves a key said yes

An exchange keeps most of its coins in cold storage, offline. A smaller hot wallet stays online so withdrawals can go out fast, and its key is kept inside a signing service that approves requests all day. A digital signature is mathematical proof that whoever controls the key approved a transaction. It can’t say whether a person meant it. Give the signer a well-formed request and it signs, whoever asked.

What Binance says happened

In its November 3 findings, Binance says the attackers worked their way in over months: a tampered Homebrew download on one engineer’s computer in June, a fake job interview for another in September and, on October 20, an internal AI tool used to take over other engineers’ computers. From there they took a container-deployment token and deployed a container that reached the internal wallet-signing service. Binance says transactions were started through that service outside the normal withdrawal process, so they got genuine signatures. On Ethereum, the roughly 50 signed requests were EIP-7702 delegations that handed hot-wallet accounts to an attacker-controlled contract. The drain ran from about 20:05 to 23:56 UTC across about 10 chains (TRM Labs). The FBI attributes it to North Korea’s TraderTraitor group; North Korea denies it.

Frozen isn’t recovered, and covered isn’t either

About $2.85 billion was frozen or intercepted, mostly stablecoins whose issuers can block an address. Freezing stops coins moving; it doesn’t send them back, and Circle, for one, says it cannot reverse a completed transfer. Binance says it is covering customers’ losses from its own funds and had replenished about 98% of the impacted assets. That is Binance paying, not the stolen coins coming home.

Guard what can ask

A key is only as safe as whatever can ask it to sign. In the tool, a check at the signer asks one more question before it signs: does a real customer withdrawal match this request? The attacker’s requests have none, so they bounce. Amount limits only slow a drain, and an attacker who can also write withdrawal records gets past the match, which is why big withdrawals can need a person to approve them through a separate channel. Keeping less money hot shrinks the worst case, at the cost of slower withdrawals.

The tool is a simplified exchange signer with illustrative rates, not a replay of the attack and not a claim about which checks Binance’s signer ran. The film uses 3.5 seconds of Binance co-CEO Richard Teng’s own October 30 update (@_RichardTeng on X), credited on screen; everything else is drawn in code.

Sources: Binance, 29 October 2026 Security Incident: Initial Findings and Response Update (Nov 3, 2026); StepSecurity, The Binance hack and developer machine security; Elliptic via Bitbo, 44% of $6.43B Binance hack loot now frozen; SOCRadar, Binance hack: $6.3B hot wallet theft; TRM Labs, North Korea steals USD 6.36 billion from Binance.