Binance: No Evidence of a Key Leak in a $6.3bn Hack. Control What Keys Sign

Binance estimates that about $6.3 billion was taken from it on 29 October 2026, and it said it had found "no evidence of any wallet private key leak". Blockchain analytics firm TRM Labs found that Binance wallets on Ethereum, Bitcoin, Tron, the XRP Ledger, Solana and four other networks, using different key types and signing schemes, "produced valid signatures for the attacker within about half an hour." Its assessment is that the most likely explanation is that the attacker could make Binance's signing system sign transactions of its choosing.

That is the lesson for every bank, exchange, custodian and government agency that holds digital value. A valid signature proves that a key signed. It does not prove that anyone with authority meant it to. The defence is to fix what each key may authorise, to check that authority somewhere the attacker cannot reach, to revoke a key the moment it is misused, and to keep a record that shows any edit. KXCO builds that layer in post-quantum cryptography, so it holds past the dates NIST has set for retiring today's signatures.

What happened at Binance

The theft began at 20:05 UTC on Thursday 29 October. TRM reports that an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes. The chains were Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.

TRM's timeline shows how fast it went:

• Between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP to a single attacker address.

• At 20:20 UTC, the operator submitted one Ethereum transaction carrying 50 EIP-7702 delegations. A Binance hot wallet had signed each one, and each pointed the wallet to a sweeper contract that took instructions only from the operator.

• Three minutes and 24 seconds later, the hot wallet sent its entire balance to the attacker: 167,464 ETH and 63 tokens, including 1.615 billion USDT.

• The same wallet was the executor of a separate Binance smart account, which let the attacker pull 823 million USDC.

By TRM's count, Ethereum accounts for about USD 3.79 billion of the total, Bitcoin for 18,270 BTC worth about USD 1.47 billion, and Tron for about USD 628 million. TRM says preparation began at least 36 hours before the theft.

Binance gave its own account at 02:23 UTC on 30 October. Its initial investigation suggests the incident may involve a compromised DevOps engineer's laptop. Through that laptop, it said, an attacker reached a service container and submitted withdrawal transactions that nobody had authorised. Binance put the estimated total impact at around $6.3 billion and said about $3 billion had been frozen on-chain. It also said it "will cover all losses from the SAFU fund and the company's funds". Co-CEO Richard Teng added that "the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action."

Tether and Circle froze funds within about 40 minutes of the main Ethereum sweep, by TRM's timeline. Tether chief executive Paolo Ardoino said his firm "froze more than 1.567B USDT related to a potential Binance exchange hack." Circle, $CRCL (NYSE), chief executive Jeremy Allaire said Circle had "frozen more than 800M USDC associated with the incident." TRM counts about USD 2.7 billion frozen across Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council. It also finds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion, "beyond any issuer's reach."

TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, "with high confidence." A Chainalysis spokesperson told CNN the firm had "high confidence" North Korea was behind it. Binance has not attributed the attack, and as of 30 October, The Crypto Times reported, no government had confirmed the link.

Markets marked it down. In a report published at 00:32 UTC on 30 October, CNBC had bitcoin down 2.8% at $78,489.73 and BNB, Binance's own token, down 3.5%. As of 05:43 UTC, Reuters had bitcoin at a six-week low of $76,368.

A pattern TRM links to Bybit

This is the second time in 20 months that the largest theft in the industry's history has been attributed to North Korea's TraderTraitor: by the FBI for Bybit, and for Binance by TRM Labs, with high confidence, and by Chainalysis, which assesses it as likely. On 26 February 2025 the FBI stated that North Korea "was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit," and named the activity TraderTraitor.

TRM links the two thefts. Bybit's Ethereum cold wallet was a multisig, and Safe says the signing device used in the attack was Ledger, through its native integration. The Safe{Wallet} team's forensic review, in a statement the Safe Ecosystem Foundation published, concluded that the attack "was achieved through a compromised Safe{Wallet} developer machine resulting in the proposal of a disguised malicious transaction." Bybit chief executive Ben Zhou said the signers saw an interface that "showed the correct address." They signed what the screen showed them, and the transaction did something else.

At Bybit, the signers' own keys signed a disguised transaction. At Binance, on TRM's assessment, the exchange's signing system signed what the attacker chose. In both, the way in was a machine on the path to the signers: a Safe{Wallet} developer machine at Bybit and, on Binance's initial investigation, a DevOps engineer's laptop. TRM notes that the Binance attack matches earlier North Korea-linked heists, including Bybit, in "staging that began well before the theft, and signatures obtained in advance then executed in one burst." Chainalysis puts the Binance theft at about $5.912 billion at the time it was taken, nearly four times the amount stolen from Bybit.

A valid signature is not an authorised action

In TRM's assessment, "the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains." Its recommendations follow from that. Signing policies should refuse EIP-7702 delegations that are not expected. A request for many of them at once should be treated as a sign of compromise. Signing systems and approval paths should be kept separate for each chain and each tier of wallet.

The transactions that moved the money carried valid signatures from Binance's own wallets. The chains checked those signatures and accepted them. A signature check confirms that the right key signed. It cannot tell whether anyone with authority approved the payment, whether the amount was within limits, or whether the institution had ever paid that recipient before.

Those questions have to be answered before a key signs, by something that does not run on the machine the attacker has taken. They also have to be answered in a form a supervisor, an auditor or a court can check later. That is a signed record of authority, and it is what KXCO's post-quantum packages produce.

Five controls: one for each of four steps, and one for the trace

On Binance's initial investigation and TRM's assessment, the attack ran through a laptop, a service container, signatures prepared in advance and a stream of withdrawals, and Binance is still tracing the full path. KXCO's packages provide a control for each of those four steps and for the trace, and all of them install from npm today.

1. Keys that software cannot copy. Binance reports no evidence that a private key leaked. That has to be the baseline for every institution, and kxco-pq-hsm provides it. On a hardware token that offers ML-DSA, keys are generated on the token. The private object is marked unextractable and sensitive, so the private key never enters host memory. From version 1.9.0, with its mlKemMechanism option set, it does the same for ML-KEM keys. A compromised laptop cannot carry such a key away. TRM's assessment of Binance, and Bybit's disguised transaction, show why the baseline is not the whole answer: a key that cannot leak can still be asked to sign.

2. Authority fixed when the identity is issued. On Binance's initial investigation, the attacker reached a service container and submitted withdrawals from it. In KXCO's model, a service, an AI agent or a device that moves value gets its own identity from kxco-pq-agent. A KYC-verified institution sponsors it and signs its scope into the credential at issuance. For payments on Armature, the scope can set a maximum per transaction, a rolling daily cap and a list of allowed recipients. Any capability left out of the scope is denied.

The agent cannot widen its own authority: new permissions mean the sponsor revokes and re-issues. The scope is enforced at both ends, by the relay before an operation reaches the chain and by the client in front, and the check fails closed. In the package's own words, "Compromising the agent does not enlarge what the agent may do." Expiry is mandatory, so a short-lived task never leaves a long-lived key behind.

3. Every action signed and checked before it is written. Armature is KXCO's settlement network and public record. Each relay intent there carries the agent's own ML-DSA signature over the operation and its payload, a fresh nonce, a timestamp and the hash of the sponsor's credential. The KXCO relay validates both the agent's signature and the sponsor's before it accepts any intent, so the institution's approval is bound to every action the agent takes. Separately, through kxco-pq-chain, every Armature validator verifies the institution's ML-DSA-87 or ML-DSA-65 signature on the writes it makes, such as issuing or revoking a credential and anchoring a record, in consensus as a protocol rule, so the block records that the institution authorised the write. The record shows which operation each signature covered, under which credential, and when.

4. Revocation that takes effect when the signature is checked. Binance's announcement says it "revoked the affected address authorisation." The value of a revocation is how fast every system that relies on the key learns of it. kxco-pq-network gives three levels of proof. Its anchored+live level asks KXCO's key registry, at the moment of verification, whether the signing key is active, revoked, rotated or expired. If the registry cannot answer, the check returns invalid and fails closed, because a network fault is exactly what an attacker would arrange. The institution sets its own revocation window: answers are cached for 60 seconds by default, and a setting of zero looks the key up on every verification. With kxco-pq-sdk, an institution can revoke a single user's credential without re-keying the institution, and the revocation can be logged and anchored on chain.

5. A record that shows any edit. Binance says its security team is "tracing the full attack path through the compromised computer." With kxco-pq-sdk's AuditedHsm, every key generation, signature, decapsulation and deletion is written to a tamper-evident log kept by kxco-pq-audit. Any edit, gap or reordering fails verification and names the first entry that fails. A checkpoint on Armature proves that at least a given number of entries existed at a given block height. The question "who signed what, when, under which key" then has an answer an investigator can check by replaying the log.

Across KXCO's products, Herald issues signed attestations for domains and documents and identity credentials for people and AI agents. Sovereign is the software for holding and moving value: licensed institutions hold the assets, and KXCO supplies the software. Armature is the record: Sovereign settles on it, and KXCO anchors Herald's credentials on it. Round Table, at the centre, can read Herald's attestations and Portcullis's findings as sourced claims.

The interactive version of this map, step by step with the source behind each fact, is at kxco.ai/post-quantum/binance-hack.

Why build the controls in post-quantum cryptography

Every control above is a signature, and a signature has to hold for as long as the record matters. A withdrawal authorised today may be examined by a supervisor or a court in ten years. NIST published the final version of IR 8547, Transition to Post-Quantum Cryptography Standards, in October 2026. It states that "NIST will deprecate all quantum-vulnerable cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035." It also records the dates in Executive Order 14412 and OMB Memorandum M-26-15. The US government's most sensitive systems must adopt post-quantum cryptography for key establishment by 31 December 2030 and for digital signatures by 31 December 2031.

NIST is plain about why signatures cannot wait. Signatures are not exposed to "harvest now, decrypt later" attacks, it says, but "transitioning to post-quantum signatures is also urgent due to the longer duration and greater complexity of the transition process and the need for a greater number of parties to coordinate." A control layer touches every system that can move value, every person and service that can ask for a signature, and every verifier that relies on one. That is the kind of transition IR 8547 describes.

An institution that builds its control layer on today's elliptic-curve signatures will have to move off those signatures once NIST standards and guidelines disallow them after 2035. Every record signed in the meantime will rest on an algorithm NIST has scheduled for retirement. KXCO's packages sign with ML-DSA from FIPS 204 and establish keys with ML-KEM from FIPS 203 now. kxco-pq-sdk, kxco-pq-agent and kxco-pq-hsm default to ML-DSA-87, and kxco-pq-tls and kxco-pq-vault default to ML-KEM-1024: the Category 5 sets that CNSA 2.0 names.

The cryptography is tested, and the results are published:

• 3,522 NIST test cases, zero failures. The self-testing entry point in kxco-post-quantum 1.13.0, released on 29 October 2026, passed all 3,522 test cases that NIST's Demo test server graded on 28 October. They covered ML-KEM, ML-DSA, SHA-2, SHA-3, SHAKE, HMAC and the random bit generator.

• 1,793 NIST ACVP vectors passed, none failed. The other 310 in the set are pairings the library refuses as weaker than the parameter set, as KXCO's post-quantum page sets out.

• 225 interoperability checks. They run against liboqs, Bouncy Castle and the Python reference implementations, in both directions, with zero failures.

• A supply chain anyone can check. Every release of 29 October carries an SLSA provenance attestation, and the published tarballs rebuild byte for byte from their own tags.

Developers are taking the library up. By npm's own count, kxco-post-quantum was downloaded 4,159 times in the 30 days to 28 October 2026, and its monthly downloads have risen every month since June: 506 in June, 922 in July, 2,333 in August, 3,056 in September and 3,342 in October to the 28th. Its OpenSSF Scorecard, the automated check of a software project's security practices, rates the kxco-post-quantum repository 9.8 out of 10. Fifteen of its checks score the full 10, among them code review, signed releases, pinned dependencies, fuzzing and static analysis.

Bybit was attacked through software its signers relied on, and Binance through a machine with access to its signing service. The packages that carry an institution's signing authority should be ones it can verify for itself, from source to install.

What it means for government

The same question applies to every agency that pays benefits, settles accounts or issues credentials. IR 8547 records that Executive Order 14412 and OMB Memorandum M-26-15 direct federal agencies to execute a risk-prioritised migration that mitigates as much quantum risk as feasible by the end of 2030. High value assets and high impact systems, those with at least one FIPS 199 security objective rated high, must adopt post-quantum cryptography for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. Agencies must give the same priority to systems that protect data expected to remain mission-sensitive in 2030.

An agency building these controls today can build them once, in the NIST post-quantum standards, FIPS 203 and FIPS 204, that IR 8547 sets as the destination. ML-DSA-87 is the default in KXCO's identity, agent and HSM packages, and ML-KEM-1024 in its channel and file-encryption packages. The core library offers the Category 3 sets, ML-DSA-65 and ML-KEM-768, behind the same API. The cryptography is tested against NIST's own vectors, and records written to Armature through kxco-pq-chain are verified in consensus.

Five questions for a board after Binance

Every board that oversees digital assets, payments or credentials can put five questions to its security team this week:

• Who can ask our keys to sign? List every machine and service that can request a signature, and say whether one compromised laptop could reach any of them.

• What limits does each of them carry, and where are those limits enforced? A limit enforced on the machine the attacker controls is not a limit.

• How long does a revocation take? Measure the time from revoking a key to the moment every system that relies on it refuses its signatures.

• Can we prove who authorised each withdrawal? The proof has to come from a signed record that shows any edit made inside the institution.

• Will those records still meet NIST's standards after 2035? That is the year IR 8547 disallows quantum-vulnerable cryptography under NIST standards and guidelines.

What an institution can do this week

The core library and the offline checks run with no account and no API key, while live revocation and the relay are KXCO's hosted services. The packages install from npm, and one install of kxco-pq 3.0.1 brings 11 more KXCO packages, the core library among them. The core library signs and verifies with the network unplugged and sends nothing back to KXCO.

What KXCO sells is the part that has to be operated: the answer about the present. That covers four services:

• The key registry. KXCO hosts the registry that says whether a key is still trusted, and answers it live at the moment of verification.

• The relay. It checks an agent's signed scope and pays the network fees on Armature.

• Anchoring. KXCO writes the record to Armature.

• Support. It comes with a service level agreement.

It is priced in US dollars per seat per year, with no tokens, no nodes and no wallets for the customer to run.

The order of work follows the attack:

• Inventory first. Run npx kxco-pq-scan on a project to list the quantum-vulnerable cryptography in its JavaScript dependencies, with NIST IR 8547's dates.

• Give every service its own identity. Issue each service that can move value its own identity, with caps, allowed recipients and an end date in its signed credential.

• Check authority away from the signer. Do it somewhere a compromised laptop cannot reach, and fail closed.

• Make revocation live. Revoke a key once and have every verifier that uses the live check refuse it within a window you set, down to every verification.

• Keep the log. Keep a signed log of every key operation, with checkpoints anchored on Armature, so any edit shows.

Institutions and government agencies that want to see these controls run against their own estate can write to [email protected]. The products are at kxco.ai, and the packages are at npmjs.com/package/kxco-post-quantum.

The scope checks run in KXCO's relay and client for operations on Armature, and Bitcoin, Ethereum and the other public chains still check only that the right key signed.

What to watch

Binance has promised "a detailed technical post-mortem once the investigation is complete and the facts are fully verified." It said at 04:36 UTC on 30 October that it expects to resume withdrawals within 48 hours. Watch the post-mortem for how the service container was able to submit withdrawals. Watch, too, for a government attribution: the FBI named TraderTraitor for Bybit five days after that theft.

Shayne Heffernan, Ph.D., is the founder of the KnightsBridge Group (shayneheffernan.com).