Weekly Research Brief: Binance Hacked; Hyperliquid on Wall Street; Prediction Markets’ Brazil ‘Miss’

What it is

Galaxy Research's 30 October 2026 brief (Alex Thorn and Thad Pinakiewicz) analyses the Binance theft of about $6.3b across 10 blockchains. TRM Labs and Chainalysis attribute it to TraderTraitor, the Lazarus-linked North Korean unit. The brief is commentary built on Binance's preliminary statements and on-chain observation, not an incident report. Binance had not re-enabled withdrawals at the time of writing.

How it works

On Ethereum, the attacker used EIP-7702 to turn a Binance hot wallet into a sweeper contract that took orders only from the attacker. It was backed by 50 pre-signed authorizations, one for each upcoming nonce, so whichever nonce came next would be valid. The code was rehearsed on three test wallets hours earlier.

Nine more chains were emptied within minutes of each other, each with different key types and signing schemes. Galaxy reads this as an attacker with detailed knowledge of Binance's withdrawal systems.

Binance's preliminary finding is that a compromised DevOps engineer's laptop gave access to a service container, with "no evidence of any wallet private key leak." Galaxy's thesis, carried over from its earlier Bitget analysis: attackers do not break the key math, they target whatever instructs the signing.

flowchart LR
    A[DevOps laptop compromised] --> B[Service container access]
    B --> C[Withdrawal systems]
    C --> D[Ethereum: EIP-7702 sweeper, 50 nonce authorizations]
    C --> E[9 other chains, mixed key types]

Preconditions / Affected

The Ethereum path depended on hot-wallet accounts that could be delegated through EIP-7702 and on authorizations signed in advance. The multi-chain breadth points to access at the orchestration layer, not to any single chain's key scheme. The page does not say how the pre-signed authorizations were produced.

What to do

The page gives no remediation steps. It lists open questions to watch:

• When withdrawals reopen.
• Where the roughly $2.4b in ETH and BTC still held by the attacker goes next (THORChain, Tornado Cash and others are named).
• How an outsider learned Binance's systems this well.

Caveats

• Freezes: Tether about $1.77b USDT, Circle about $825m USDC, Ripple about $40m RLUSD, World Liberty about $28m USD1. Galaxy gives the total as roughly $2.5-3b.
• Circle froze about 40 minutes after the Ethereum sweep, "in coordination with law enforcement." During April's $285m Drift exploit, about $232m of stolen USDC moved through Circle's cross-chain protocol over about six hours without a freeze.
• Binance says it will cover all losses. Its SAFU fund (about $1b in BTC) is too small, so payment would come from company funds. Galaxy puts the net loss at about 4% of the roughly $144b in assets Binance held, and says it cannot verify Binance's finances.
• Attribution and the laptop root cause are preliminary.
• The brief's "Other News" lists, with no detail: a Polymarket trading halt after a third-party compromise drained wallets, a Coinbase client data breach at the vendor Amplitude, and a Google preview of an MPC custody system for institutions.