A transaction that looked routine at first hit Ethereum at 4:20:59 a.m. Beijing time on Oct. 30. It submitted 50 EIP-7702 authorizations to a Binance hot wallet labeled "Binance 14." Just 3 minutes and 24 seconds later, 167,464 ETH, 1.615 billion USDT, and 63 other tokens including UNI, LINK, AAVE and PEPE were swept out in a single transaction, according to the TechFlowPost report.
The article said outflows on Ethereum alone exceeded $3.3 billion. Cross-chain estimates were placed between $5.5 billion and $6.2 billion. On that basis, the incident was described as the largest exchange theft in crypto history. For comparison, the previous industry record cited in the report was the $1.5 billion theft from a Bybit cold wallet in February 2025.
Markets moved almost immediately. Bitcoin fell below $78,500, Ether dropped under $2,250, and BNB was down as much as 9% during the session. Across crypto derivatives, liquidations reached $629 million in one hour, with $607 million of that coming from long positions.
Binance then paused withdrawals on multiple networks and suspended Binance Alpha trading. The exchange repeatedly said user funds were fully safe. Binance founder Changpeng Zhao, or CZ, wrote on X that it "does look hacked," and cited DefiLlama founder 0xngmi’s estimate that the actual net loss "may be a little over $1 billion, but will be fully covered."
Asset freezes spread across the industry
The response did not stop at Binance. The report said Tether froze more than 1.567 billion USDT about 40 minutes after the incident. Circle froze more than $800 million in USDC. Ripple froze about $200 million in RLUSD. World Liberty Financial froze $27 million in USD1. Paxos froze about 1,906 PAXG.
Binance’s latest public update, as cited in the article, put verified frozen funds at $3 billion, adding that the figure could still rise.
Preparation appears to have started 48 hours earlier
TechFlowPost cited an on-chain review video published hours later by Cobo co-founder Shenyu. Tracing the activity backward, he said the attackers’ preparation had started at least two days before the theft.
Beginning on the afternoon of Oct. 28, the attackers withdrew small amounts of funds from Tornado Cash in three batches to pay for contract deployment and rehearsal costs. From the evening of Oct. 29 into the early hours of Oct. 30, they used test wallets to run through the full attack flow twice. The final rehearsal ended about three and a half hours before the live attack at 4:20 a.m.
EIP-7702 sat at the center of the attack path
The report pointed to EIP-7702, introduced in Ethereum’s Pectra upgrade last year, as the feature that made the attack possible. Under the older Ethereum account model, externally owned accounts, or EOAs, and smart contract accounts were separate systems. EIP-7702 allows a regular wallet to delegate control temporarily to smart contract code through a special authorization. Unless that authorization is revoked, the code can act on behalf of the wallet and execute operations such as batch transfers.
Shenyu summarized the attack contract this way: "The attacker’s program recognizes only one owner and does only one thing: move funds."
In the reconstruction presented in the article, the 4:20:59 a.m. transaction was the step that caused the Binance 14 wallet to sign that fatal authorization set. Once active, the attackers no longer needed to use Binance’s private key for every transfer. They could call the contract directly and empty 64 tokens from the wallet.
At 4:41 a.m., the report said, the attackers used the legitimate identity of the Binance 14 hot wallet to instruct a USDC contract wallet controlled by that address, moving out 823 million USDC in one shot. By 6:40 a.m., they had returned to Binance 14 four times to keep sweeping assets, including small incoming transfers sent to the address after the initial drain. On-chain analyst Ai Yi, as cited in the article, also tracked the sale of 7.77 trillion PEPE from the hot wallet into ETH.
On-chain review focused on the signing step
The central question raised in the report was why a top-tier exchange hot wallet would use its own private key to sign 50 malicious EIP-7702 authorizations with consecutive sequence numbers.
Shenyu’s technical conclusion in the video was direct: "From the chain data, the issue appears to be in the signing step. I haven’t seen a contract vulnerability."
The article added another detail. At 6:55 a.m., Binance’s own security team also used the private key for Binance 14 to sign transactions that moved the wallet’s remaining dust assets back to a Binance security wallet. More than two hours after the incident, Shenyu was still warning on X that the EIP-7702 delegated authorization had not yet been revoked. At that point, a deposit of about 2,961 ETH was still pending because of a low gas fee, and he said it could be swept by the attacker’s program as soon as it landed.
Based on those traces, the article argued that the attackers most likely did not steal a plaintext private key file directly. Instead, it said the more likely breach point was somewhere in Binance’s internal automated signing system, permission checks, or operations command pipeline, where the signing machine was induced to approve a Type-4 transaction that should never have been signed.
"Everyday is Zeroday"
Hours after the Binance incident, Elon Musk posted "Everyday is Zeroday" on X. The article framed that comment as a sign that AI is pushing the crypto sector into an era where offense and defense are no longer balanced.
Blockaid co-founder and CEO Ido Ben-Natan gave a more specific assessment. He said the attack looked "very similar" to the $1.46 billion Bybit theft in February 2025, and that the on-chain preparation matched known patterns associated with North Korean hackers.
That concern was not presented as isolated. Immunefi CEO Mitchell Amador has repeatedly warned this year that AI has shifted the balance toward attackers, and that defenders may need three to four years to catch up.
The article said zero-day vulnerabilities were once rare tools, usually discovered manually over months by a small number of elite hackers. In 2026, it argued, large AI models can scan open-source protocols and smart contract code around the clock, produce zero-days at scale, and combine that with deepfake techniques and automated intrusion scripts to target exchange operations staff and internal signing pipelines with highly precise social engineering and supply-chain attacks.
As of the article’s publication, 2026 was not yet over, but more than 230 crypto protocols had already been attacked. Citing ValueTheMarkets, the report said North Korea-linked hacking groups stole $643 million in crypto assets in the first half of 2026 alone, accounting for 66% of the global total stolen in the same period. From Bybit to Binance, the article said, the scale of attacks had multiplied several times in eight months.
DLNews was also cited as saying that several major exchanges and security firms were competing for access to Anthropic’s latest Claude Mythos model in an effort to harden defenses with more advanced AI tools. Cyvers CEO Deddy Lavid said crypto is "the first market to truly feel the impact of AI."
The article ended on a blunt point: attackers need to find only one weakness, while defenders have to cover every one of them. For centralized platforms, that equation gets much harder when state-backed hacking groups are paired with AI tools.
