Hackers Drain 74.6 Million ARB From Four Arbitrum Hot Wallets in Binance Breach

Four Arbitrum Wallets Hit in 12 Minutes

Four hot wallets run by Binance on Layer 2 network Arbitrum (ARB) sent 74.6 million ARB and 8,426 ETH to the attacker within 12 minutes of the initial drain, on-chain data shows. Those transfers are one branch of the largest theft recorded in crypto: on October 29, 2026, attackers emptied Binance hot wallets across Ethereum, Arbitrum, Avalanche, Optimism, the Bitcoin network and Tron of at least $6.3 billion, according to the public on-chain tally in Blockaid's technical post-mortem. The core target was Binance 14 (0x28C6c06298d514Db089934071355E5743bf21d60), one of the exchange's largest and most active Ethereum hot wallets. Minutes before the drain, the attacker, holding a copy of the wallet's leaked private key, signed an EIP-7702 authorization that delegated Binance 14 to a malicious sweep contract. EIP-7702 is an Ethereum standard that lets a plain externally owned account run contract code once a signed authorization is included in a block; the delegation binds to the account's nonce and stays in force until the same key signs a replacement. The authorization arrived as a Type-4 transaction (0xad9926...) carrying 50 pre-signed authorizations over consecutive nonces 18,914,775 through 18,914,824, a blind signing batch laid across an address still processing live user withdrawals. Forty-nine missed their nonce; one landed while Binance's own withdrawal transactions kept streaming out. At 20:24:23 UTC, 3 minutes 24 seconds after the delegation took effect, the attacker triggered the sweep (0x53bd38...). A single transaction moved 167,464 ETH, 1.615 billion USDT and roughly 60 other tokens to a previously unused consolidation address (0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c), leaving Binance 14 with one symbolic ETH. At prevailing prices, that package was worth about $2.5 billion.

One Contract, Four Chains, Two Sweeps

The preparation ran for at least a day. The attacker's operator address (0x7C8601d4645b93cea45F71e118A729332e6B5CA0) drew test funds from Tornado Cash in three withdrawals starting October 28, then rehearsed the full delegate-and-sweep sequence on three of its own wallets with transfers of $2 to $6. At 15:59 it deployed the unverified sweep contract (0x63e842B054Bd624a465454D533C33F573e9c6fAe, deployment transaction 0x97408e...), which named the operator as its sole authorized caller and carried a sweep function that drains every listed token plus native ETH, alongside a forwarding function. Blockaid's monitoring flagged the theft within two minutes of the sweep, ahead of any public or social disclosure, and its automated engine confirmed the leaked-key delegation in 11. The spread then crossed four chains: 24 seconds after the first drain, Binance 16 (0xDFd529...) paid out 28,005.6 ETH, 55.7 million USDT, 25.9 million RLUSD and 84.5 WBTC (0x51f263...); Binance 55 on Optimism moved 44.2 million OP; the four Arbitrum (ARB) wallets moved their 74.6 million ARB and 8,426 ETH; and four Avalanche wallets moved 1.81 million AVAX and 8.41 million USDT. None of those wallets carried contract code: each transfer was a plain transaction signed by the wallet's own key, blended into Binance's daily withdrawal flow. The delegation on Binance 14 stayed mounted. At 20:41:23 the attacker used it to pull 780 million USDC, then 43 million more, from the Circle-managed smart account Binance Hot Wallet 34 (0xdc102d...), and a second sweep at 21:44 (0x55ba4d...) took 200 million USDT in fresh deposits plus 13 other tokens. Tether and Circle froze about $1.8 billion at the consolidation address, with Tether CEO Paolo Ardoino putting his company's USDT freeze above $1.5 billion, and roughly $2.4 billion frozen within two hours. Native ETH, AVAX, OP and ARB stayed beyond issuer control, and the total ran more than three times the roughly $1.5 billion Bybit lost in February 2025.

Where Issuer Freezes Stop

The Arbitrum (ARB) slice shows where centralized freezes end. Tether and Circle could claw back their own tokens, but ARB, ETH, OP and AVAX have no issuing switch to pull, which is why the stolen 74.6 million ARB sat in attacker hands until protocol governance acted: COINOTAG's earlier coverage recorded that Arbitrum's Security Council froze 74.6 million ARB tied to the exploit and later moved the tokens to a holding address. That covers one tranche, and the delegation mechanics do not heal on key rotation, because the on-chain authorization binds to the address itself and clears only when the leaked key signs a fresh authorization resetting the delegate to the zero address. Blockaid's report notes the malicious delegation was still live at 22:00 UTC, so any deposit landing on Binance 14 remained sweepable without a new signature. The stolen tranche is also close in size to the 93.14 million ARB unlock set for November 15.