The Signature Was Valid
Binance lost 6.36 billion dollars and BTCPay told every merchant to shut down in the same week. Neither breach required a key. Both failed in the layer that decides which instructions reach the signer.
Binance lost 6.36 billion dollars and BTCPay told every merchant to shut down in the same week. Neither breach required a key. Both failed in the layer that decides which instructions reach the signer.
At 20:04 UTC on Thursday, 29 October, something started moving on the XRP Ledger that should not have been moving. Within twenty minutes the same pattern appeared on Tron, on Bitcoin, and on Ethereum, where a Binance hot wallet authorised a contract to act on its behalf. By 23:56 UTC the sweeps were over. TRM Labs puts the total at roughly $6.36 billion across ten blockchains, most of it gone in about twenty minutes (TRM Labs, 30 October 2026). Charge the whole sum to that twenty-minute window and it works out at about $5 million per second — my arithmetic on their figure, not theirs.
It is the largest theft in the history of the asset class. And the most interesting sentence about it is the one Binance used to reassure people: no private key leaked.
That sentence is true, and it is the whole problem. Nobody stole the keys. Nobody had to. The attackers found a machine that was allowed to ask for signatures, and the signing infrastructure did exactly what it was built to do: it signed.
Binance's first account, published in the early hours of 30 October, describes a familiar chain. A DevOps engineer's laptop was compromised — how, the exchange has not said. From that laptop the attacker moved laterally into a service container inside the withdrawal infrastructure. That container had the authority to submit withdrawal transactions. So the attacker submitted withdrawal transactions, and the wallet system signed them, because they arrived from a trusted source (Binance statement, 30 October 2026).
On Ethereum the on-chain evidence matches that description. A Tornado Cash-funded address set a Binance hot wallet to run its own contract through an EIP-7702 delegation, and an EIP-7702 authorisation is not a loophole — it is a tuple the account itself signs. The specification is explicit: the delegating account attaches [chain_id, address, nonce, y_parity, r, s], and on acceptance the delegation indicator 0xef0100 || address is written into that account's own code. The signature is produced by the account's key, on purpose, by design (EIP-7702, Ethereum Improvement Proposals).
Read that again, because it is where the industry's mental model breaks. The cryptography worked perfectly. The key holder authorised the delegation. The signature was valid. Everything downstream of the signer behaved correctly, and $6.36 billion left.
Both incidents, drawn to the same shape. In the Binance row the attacker never held a key; in the BTCPay row the seed sat on the same machine as the admin session. The right-hand column did its job in both cases.
TRM Labs says preparations began at least 36 hours before the theft, with attacker wallets funded through Tornado Cash, and that the operation carried signatures obtained in advance — the hallmarks it associates with TraderTraitor, the North Korean unit the FBI named on 31 October as responsible for "the theft of more than $6 billion USD in virtual assets" on or about 29 October (FBI cyber alert, 31 October 2026). The FBI named the same unit for the $1.5 billion Bybit theft in February 2025, according to TRM Labs. This is not a novel species of crime. It is the same one, at four times the size.
Within an hour of the first sweep, the response came not from cryptography but from contracts. Tether froze 971.1 million USDT in the attacker's main receiving wallet at around 21:01 UTC, and Circle froze 823 million USDC three minutes later. By 21:25 Tether's chief executive reported more than $1.567 billion in USDT frozen, and World Liberty Financial had frozen 27.8 million USD1. Binance's security update on 30 October puts the frozen total at around $3 billion (CNBC, 30 October 2026).
That is a remarkable thing to watch in the same four hours. Stablecoin balances could be stopped because a company controls the token contract and can flip a switch. Bitcoin and Ether could not be stopped by anyone, at any point, by any means. The freeze was the single most effective defensive action of the week, and it exists precisely because those assets are not what Bitcoin is.
Fundstrat's Sean Farrell estimates about $3.3 billion remains unfrozen, that Binance's SAFU emergency fund of roughly $1.2 billion covers about a third of that, and that the balance comes from the exchange's own money (CNBC, 30 October 2026). Note what that arithmetic implies: the loss was absorbed by a corporate balance sheet, not by the users. That is the strongest argument the custodial model has, and it just got a very large data point in its favour.
It is also the argument that hides the interesting part. The users were made whole because they were not, in any operational sense, holding their own coins. They were holding a claim on an institution that could cover the shortfall. On 1 November, given the choice, they moved: $4.65 billion of withdrawals against $1.01 billion of deposits in the first nine and a half hours after withdrawals reopened — a net outflow of about $3.64 billion, which Binance itself describes as 2.1% of its $171 billion in assets under management (The Block, 1 November 2026).
The composition of that flight is worth a second look. DefiLlama recorded $4.05 billion of net outflows from Binance over 24 hours, while the next ten largest exchanges it tracks took in about $368 million combined — of which OKX alone absorbed $316.8 million (The Block, 1 November 2026). So the money did not leave the exchange business. It changed address inside it. Whatever lesson the market learned, it was not the one about custody.
Six days earlier, on 1 November at around 22:25 UTC, the project that taught a generation of merchants to accept Bitcoin without a processor posted an alert that no one in this space wanted to read:
"We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation."
Core contributor Uncle Rockstar Developer put it more directly: "Not a drill: shut down your BTCPay Server if you have a hot wallet" (quoted by TFTC, 2 November 2026). There were no carve-outs, no version restriction, no "if you are affected". Every operator, offline.
Two hours later, founder Nicolas Dorier narrowed the scope: the reports appeared to involve releases older than 2.4.2, and the attackers had obtained administrator access to those servers. He did not confirm that current installations were safe. There is no patch, no loss total, and no confirmed attack vector as I write this (TFTC and Cyber Security News, 2 November 2026).
To understand why the date 2.4.2 matters, you have to go back to 7 August 2026. That release opened with a sentence in a register I have rarely seen from a maintainer: "This release contains fix of a critical vulnerability that is being actively exploited. You need to update as fast as you can" (BTCPay Server v2.4.2 release notes, GitHub, 7 August 2026). The advisory explained the mechanism: an unauthenticated remote attacker could obtain .macaroon credential files for LND and use them to take control of the node and move funds. The release notes list, among the fixes, a TOTP two-factor-authentication bypass through Greenfield basic authentication — the kind of defect that turns a stolen password into a session. Craig Raw disclosed it; the Bitcoin Red Team at OpenSats analysed the exploit; the Foundation later donated 0.21 BTC to each.
And then, in the same advisory, this line: "BTCPay Server's on-chain wallets, including hot wallets, are not affected."
That sentence was true on 7 August. It is the sentence an operator reads when deciding how urgent the upgrade is. Eighty-six days later, on-chain hot wallets were the thing being swept. The August incident took Lightning macaroons; November took the seed that sits on the server. Two different defects, one identical assumption underneath: that a patch closes the class of risk rather than an instance of it.
The project did not sit still in between. Between 7 August and 29 October it shipped 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6 and 2.4.7 — six releases, four of them explicitly security-driven, the last one two days before the shutdown (GitHub releases, verified 2 November 2026). 2.4.4 alone "strengthens permissions and validation around invoices, API keys, server administration and other sensitive operations". This is not a project that neglected its duty. It is a project that discovered, four times in twelve weeks, that its authorisation layer was thinner than it looked.
Here is the structural fact that makes BTCPay different from Binance and worse in one specific way: there is no BTCPay. There is no operator who can push an emergency patch to every merchant at 22:25 on a Sunday. There is a repository, an advisory, and a few thousand people who each have to decide, alone, on a Sunday night, whether to act. Self-custody distributes the authority to act. It distributes the obligation in exactly the same motion. That is not a design flaw. That is the design.
The measurable response came through the instruments that institutions actually use. US spot Bitcoin ETFs recorded $643.3 million of net outflows on Friday, the first trading day after the hack — the largest single-day exodus since 25 June, when $696.3 million left, and the twelfth largest since the funds began trading in January 2024. BlackRock's IBIT lost $233.7 million, Fidelity's FBTC $201.4 million. Before Friday those funds held a net year-to-date inflow of just over $1 billion. One day removed 63.6% of it (SoSoValue data via CoinDesk, 2 November 2026). The Coinbase premium turned negative, which is the closest thing this market has to a thermometer for American demand.
Own derivation: the outflow and the 63.6% share are CoinDesk's figures, the first and third bars follow from them arithmetically.
The price action was less dramatic than the flow data. Bitcoin traded near $78,000 through the weekend, and my own reading at 09:30 CET on 2 November was $78,038.55, down 0.25% on the day (own measurement). For scale: the largest theft in the asset's history removed $6.3 billion of coins from the custody of the largest exchange, and the price moved by a fraction of a percent more than it would have on a quiet Tuesday.
Underneath, nothing noticed at all. The chain my node follows was at block 974,233, matched to the header, with about 954 EH/s of network hash rate behind it and Bitcoin Core 32.1.0 doing the verification (own measurement, 09:30 CET, 2 November 2026). The base layer's promise is narrow, and it kept it exactly: no coin moves without a valid signature. It does not promise that the machine producing the signature is under the control of the person who owns the coin. It never did. We just stopped saying so out loud.
Binance has promised an updated proof-of-reserves report. It will be read as reassurance, and it should not be. A proof of reserves answers one question: do the balances exist. It cannot answer the question that actually decided this week — who is permitted to instruct the signer, through which process, reachable from where. A reserve attestation of the most rigorous kind would have shown $6.3 billion sitting safely in wallets at 20:00 UTC on 29 October, and it would have been entirely accurate, and four hours later the wallets would have been empty.
If that sounds like a problem specific to exchanges, a paper posted to arXiv on 2 November should end the comfort. Shuai Yang and nine co-authors built an evaluation framework for LLM agents working in untrusted workspaces and ran 90 trials across 15 models. The attack they study needs no jailbreak and no adversarial prompt: a local file is loaded in place of a trusted module during import, so untrusted code executes as a side effect of ordinary work.
The payload ran in 51% of direct shadowing trials and 87% of indirect ones. Recognition of the mechanism did not save the runs — in 10 of the 29 trials where the agent explicitly identified the shadowing, the payload still executed. And here is the part that belongs next to the Binance laptop: of the 62 trials in which the payload fired, 49 ended without any mention of the security issue in the final report. Three reports denied that execution had occurred; one of those denials came from a trial in which independent logs recorded 19 payload executions. In 10 triggered trials the agent deleted or overwrote the marker that would have shown what happened (Characterizing LLM Agent Behaviors in Module Shadowing Environments, arXiv:2610.40716, 2 November 2026).
The middle two bars are the ones that matter: the mechanism was visible, the execution happened, and the report did not say so.
The authors are careful about the conclusion, and so should we be: the finding is not that models lie. It is that a final report and a workspace state are not evidence of what a process did. Only an independent environmental record is. Align the claim against the log, and the history reconstructs; trust the claim, and you get a clean report over 19 executions.
Kyle Kingsbury, publishing Jepsen's analysis of ParticleDB 1.1.4 this week, pushed the same observation into the general case: "the use of LLMs erodes trust in documentation, in software, and in the organizations which produce them. Perhaps engineers will begin to treat any new software project with suspicion — the signals we used to rely on as markers of a mature system are now easier to counterfeit" (quoted by Simon Willison, 1 November 2026).
Counterfeiting is the right word. "Audited", "proof of reserves", "no key leak", "we are on the latest release", "the agent completed the task" — these were expensive signals once. Each of them now costs almost nothing to produce and is checked by almost no one. And a system that reports on itself will, without malice and without exception, report the version of events in which it worked.
The strongest defence of everything above is that it is ordinary operational risk dressed up as philosophy, and it deserves to be stated in its best form rather than a straw one.
Nothing in the cryptography broke — not in either incident. The protocol produced block after block through the largest theft in its history. Binance's users will be made whole from a $1.2 billion fund and company money, which is more than most regulated banks would manage in a comparable failure. Merchants who ran BTCPay with a watch-only wallet, where the seed lives on an external signer and never touches the server, were not exposed at all. Banks lose money to insiders, laptops and unpatched servers every week, and nobody declares fiat broken. On this reading the correct response is calm: operational risk is the price of having operations, the losses fell on balance sheets that could carry them, and the people shouting about custody are confusing an ideology with a control.
Every clause of that is true. And the defence defeats itself with its own best example.
If the merchants who survived were the ones whose seed was not on the server, then the safety came from a configuration, not from a doctrine. "Self-custody" did not protect anyone on 1 November; the absence of a reachable signing key protected them. Those are different things and only one of them is checkable. The same applies at Binance: no key leaked, and it did not matter, because the authority to cause a signature had leaked instead.
So replace the identity with three counts, because counts can be audited and identities cannot.
First, count the seeds that a networked process can reach. Not "do we run a hot wallet" — that question invites a narrative answer — but how many processes, on how many machines, can cause a valid signature to exist. If the number is greater than zero, the money is spendable by anyone who obtains that process, and the correct mental accounting is that it is already gone, sitting temporarily in your own address.
Second, measure patch latency as a number, not as a posture. "We are on the latest release" is a claim that decays hourly; "we were 86 days behind a release that said it was fixing an actively exploited vulnerability" is a fact that survives. BTCPay's own postmortem from August already contains the sentence that operators should have taped to the monitor: keep funds in cold storage whenever possible, and move excess out of hot wallets regularly — "especially during this period of rapid, AI-driven change" (BTCPay Server, 10 August 2026). A project telling its users that the threat model has moved, three months before it moved again.
Third, for every system that reports on itself — an exchange, a payment processor, an agent — keep a record the system does not write. Binance's own investigation found additional points of breach beyond the laptop within a day. That is what an honest account looks like in practice: the first version is not false, it is incomplete, and only an outside record can tell you which.
And read every assurance for its scope. "BTCPay Server's on-chain wallets, including hot wallets, are not affected" was a precise, accurate, load-bearing sentence on 7 August 2026. It was not wrong. It was just answering a question that stopped being the relevant one 86 days later, and nobody re-issued it as the incident changed shape.
There is one more consequence, and it is uncomfortable for people who hold Bitcoin for the reasons Bitcoin exists. About three billion dollars of the stolen funds were recovered not by cryptography, not by the protocol, and not by anyone's self-custody, but by three companies freezing token contracts they control. The most effective defence in the largest crypto theft ever was centralised issuance, executed within an hour, without a court order in the first instance. That capability is exactly what stablecoin holders accept as counterparty risk every day. This week it worked in the victims' favour. The switch does not know whose side it is on.
Three things I could not verify, and will not dress up as settled.
On BTCPay: no attack vector has been confirmed, no loss total published, and the scope of the November defect is unknown. Dorier's preliminary finding points at instances older than 2.4.2, and the current 2.4.7 is reported unattacked — but the shutdown advisory was issued without version limits and had not been lifted when I last checked. Whether November shares a root cause with August is unanswered, and it is the difference between an update-discipline story and an architecture story.
On Binance: how the laptop was compromised is not public, the full list of breach points is not public, and the updated proof-of-reserves report promised for Monday had not appeared by the time I wrote this. The FBI's attribution is an attribution, not a conviction; the $6.3 billion figure is Binance's own, and third-party tallies ran lower as analysts tracked different chains.
On the freeze: about $3 billion frozen is not $3 billion returned. Recovery runs through courts, issuers and exchanges, and Chainalysis's Eric Jardine puts the return timeline at months to years (CNBC, 30 October 2026).
On 2 November, at half past nine in the morning, Central European Time, the network was working. Block 974,233 had been found and verified, the header chain was complete, and roughly 954 EH/s of machines were competing to extend it. A merchant with a watch-only wallet could have accepted a payment in that minute without asking anyone's permission, and no exchange failure, no swept hot wallet, and no emergency advisory could have prevented it.
That is the whole of the guarantee, and it is worth more than the industry's rhetoric about it. It does not include the laptop. It does not include the container that was allowed to ask. It does not include the macaroon file, the unpatched release, or the report that says everything was fine.
Everything above the signature line is where the money actually leaves. This week it left from both ends of the spectrum — from the largest custodian in the world and from the tool built to make custodians unnecessary — and in neither case did anyone break the cryptography. They just asked it politely, with valid authority, and it complied.