One word explains how so much money kept moving after the first theft on 29 October 2026: sweeper. The Binance 14 wallet did not just lose funds once; it was turned into a wallet that automatically forwarded incoming funds to the attacker. This article explains that mechanism in plain words, and how Binance 14 differed from Binance 16.

What a sweeper wallet does

A sweeper is a wallet set up so that anything arriving in it is immediately sent on somewhere else. Think of a letterbox that empties itself into another address the moment a letter lands. For an attacker, that is valuable, because it means they do not need to return again and again: every new deposit into the compromised wallet is swept away on its own.

Delegation: handing control to code

The tool used here was EIP-7702 delegation on Ethereum. In simple terms, delegation lets a normal wallet temporarily hand its authority to a piece of code, so the code can act for the wallet. Once Binance 14 was delegated to the attacker's code, that code decided where funds went. Binance revoked the affected address's authorisation afterwards, which is the equivalent of cancelling that delegated permission, but by then large amounts had already moved.

Binance 14 versus Binance 16

Binance 14 was the main wallet in this story. It had appeared in Binance's 1 October proof of reserves as backing for customer assets, and around 204,500 ETH was taken from it, dropping ETH backing from 100 percent to about 94 percent until assets are replaced. Binance 16 was also hit: Etherscan data shows 28,005.6 ETH moving from Binance 16 at 20:24 UTC, alongside 167,464 ETH from Binance 14. The two wallets show the same pattern at different scales, which is why investigators treat them as part of one operation rather than two separate incidents.

Why the theft kept growing

A normal theft ends when the thief empties the wallet. A sweeper theft keeps growing as long as funds keep arriving and the delegation stays in place. That is also why the headline total, about $6.3 billion, is an estimate rather than a single counted transfer: it is the sum of many movements traced across wallets and assets, and tracing is still under way. About $3 billion of it has since been frozen, but a frozen coin is stopped, not yet returned.

What changed after the discovery

Binance suspended deposits and withdrawals, revoked the authorisation, and said losses would be covered from company funds and the SAFU fund of about $1 billion in bitcoin, with user funds safe. Co-CEO Yi He said withdrawal resumption was expected to begin within about 48 hours. The next proof-of-reserves snapshot, due 1 November 2026, should show whether the missing ETH backing has been restored.

Frequently asked questions

FAQ: Is a sweeper wallet a special kind of wallet? No, it is a normal wallet whose authority has been delegated to code that forwards funds. Did Binance 16 lose as much as Binance 14? No, the reported 20:24 UTC movements were 28,005.6 ETH from Binance 16 against 167,464 ETH from Binance 14. Can delegation be undone? Yes, by revoking the authorisation, which Binance says it has done for the affected address.