Binance Used MPC. It Still Lost $6.3B. Here's Why.

Last updated: November 6, 2026. Reflects Binance's report of November 3, 2026.

On October 29, attackers moved about $6.34 billion out of Binance hot wallets, according to Binance's own figure. It is the largest theft in crypto history. We watched it unfold like everyone else.

If you hold on Binance, first the good news. Binance says it "will absorb the financial impact of the stolen funds, not our users." Withdrawals began reopening on November 1, starting with Bitcoin. Your balance is your balance.

The question this article answers came a few days later, buried in Binance's post-mortem: "Because the hot wallet used Multi-Party Computation (MPC)..."

So Binance used MPC. The same family of technology we build Vultisig on. And it still lost $6.34 billion.

That deserves a straight answer, not a sales pitch. Here it is.

Did Binance use MPC?

Yes, at least for the Ethereum hot wallet at the center of the attack. Binance's November 3 report says so directly. Many articles written in the first days say the setup was "undisclosed". That is now out of date.

What Binance has not said: whether the drained wallets on Bitcoin, XRP, Tron, Solana and the other chains used MPC too, which protocol it runs, the threshold, or who holds the shares. Binance has promised an independent review. It isn't public yet.

If no key was stolen, how did $6.34 billion leave?

The attacker didn't break the keys. They got Binance's own signing service to sign.

Binance describes a campaign that started in June. A tampered developer tool on one engineer's machine. A fake job interview for another. From there, the attacker collected a container-deployment token and, in Binance's words, "exploited unauthorized access to an internal wallet signing service" to start transactions "outside the normal withdrawal process."

On Ethereum, that service produced 50 signed authorizations under EIP-7702, one per upcoming nonce. Whichever one matched the wallet's live nonce handed control of the wallet to a contract the attacker ran. TRM Labs' report describes signatures "obtained in advance then executed in one burst." TRM attributes the theft to TraderTraitor, North Korea's top hacking unit. North Korea denies it.

Every one of those signatures was valid. The math did its job. Elliptic's analysis puts it plainly: it was "the infrastructure and people around the wallets that were compromised, not the cryptography."

A quick correction while we are here: EIP-7702 is not a multisig. It lets a normal Ethereum account point to smart-contract code. Some early coverage called it a "multi-signature protocol". The EIP-7702 spec says otherwise. We compared the two models in multisig vs. MPC, side-by-side.

What does MPC protect, and what doesn't it?

Think of a bank vault that needs three keyholders to open. Splitting the keys stops a thief who steals one key. It does nothing if all three keyholders take orders from the same intercom, and someone hijacks the intercom.

MPC protects the key. It does not decide whether a transaction should be signed.

With MPC, the private key never exists in one place. Each party holds a share, and a threshold of them sign together, a scheme called threshold signing (TSS). Steal one share and you have nothing. That part held at Binance.

But a valid signature is not the same as an authorized transaction. If every share sits inside one company, behind one automated service, then whoever can instruct that service can spend. The threshold might be three or five on paper. In practice it is one.

Binance's report adds a twist. MPC made the cleanup slower. Because "there was no single private key" that could revoke the malicious authorizations, the team had to build a revocation procedure on the spot. The attacker's control lasted from 20:20 UTC to 00:10 UTC, close to four hours.

This is not new. Bybit lost about $1.5 billion in February 2025 from a multisig wallet, after attackers changed what every signer saw in their browser. In the large custodial thefts of the past decade, the pattern is consistent: nobody broke the cryptography. They went after what the signers trusted. Our Q2 2026 hack report found the same pattern at protocol level, summed up by one auditor as "we declared a 3-of-6 multisig and stored 3 keys on one laptop."

Is exchange MPC the same as MPC in a self-custody wallet?

Same math. Very different question: who holds the shares, and who says yes? We asked it of AI agent wallets too, in who holds the signing share?

• Where the shares live. An exchange keeps them inside one company's infrastructure. In a self-custody MPC wallet, they sit on devices you own.
• Who starts a signature. On an exchange, an automated service, at scale, around the clock. With self-custody: you, one transaction at a time.
• Who approves. Internal policy, plus whatever the signing service is told. In a Vultisig Secure Vault, you approve on each device, with the transaction in front of you.
• Blast radius. One foothold at Binance signed across 10 chains in a single evening. A self-custody compromise stops at one vault.

Here is how a Vultisig Secure Vault works, from the code, not the brochure.

Your devices create the vault's key together, through distributed key generation. The full key never exists, on any device, at any moment. With three devices, any two must sign together.

When you send, every co-signing device decodes the transaction itself and shows you the destination, the amount and the chain. It then rebuilds what will be signed from that same data. If the device that started the transaction asks it to sign anything different, it refuses.

That matters, because the most expensive attacks of the past two years worked by changing what signers saw. In a Secure Vault, a compromised starting device can't swap the payload behind your back. To steal from one, an attacker has to compromise a threshold of your devices and get you to approve on each one.

What about Fast Vault?

Fast Vault is the one-device setup. Under a minute, no seed phrase. It is a 2-of-2 vault between your device and VultiServer, our co-signing server.

VultiServer can never sign alone. It stores its share encrypted with your vault password and needs that password for every signature. Your device starts every transaction, and your device is where you review it.

A Secure Vault takes the same idea further: every co-signer is a device you hold, and each one shows you the transaction on its own screen. You can run both side by side, a Fast Vault for everyday spending and a Secure Vault for what you are keeping.

Could this happen to my self-custody wallet?

Not this attack. You face different ones, and we won't pretend otherwise.

Self-custody removes the company in the middle. Nobody can sign for you, and nobody refunds you either. Binance could cover $6.34 billion. Your vault is yours, in both directions.

The real risks for a self-custody user in 2026:

• Phishing and malicious approvals. MPC does not stop you from approving a bad transaction. Read the address on every device.
• Lost backups. Each device share needs its own backup. Lose too many and the vault is gone.
• Device malware. Keep the devices in your vault separate, and keep them clean.
• Physical coercion. Wrench attacks are on a record pace this year. No signing scheme fixes that.

Trading balances can live on an exchange. Long-term holdings are where control matters most.

How to move funds off an exchange safely

1. Set up your wallet first, and back it up before any money arrives.
2. Send a small test amount. Confirm it lands.
3. Check the full address, not just the first and last characters. Address poisoning is real.
4. Match the network on both sides.
5. Ignore anyone who DMs you about "recovery", "compensation" or "migration". Treat every one of those messages as a scam. We will never send one.
6. Then move the rest.

Why this matters more now

For years the pitch for MPC was "institutions use it." We made it ourselves, in September. Last week an institution used it and lost $6.34 billion anyway. That is not a reason to distrust MPC. It is a reason to ask the better question about any wallet, exchange or custodian you use: who holds the shares, and who approves each signature?

On an exchange, the answer is a company, and you are trusting its laptops, its staff and its signing service. With self-custody done right, the answer is you, across devices you control, each one showing you what it is about to sign.

That is the vault we build at Vultisig, and the one we use for our own treasury. No seed phrase, anywhere. Shares on your devices. Every co-signer reads the transaction for itself. The apps are open source, and the DKLS23 library we use was audited by Trail of Bits in 2024.

Get Vultisig's apps and set up a Secure Vault across the devices you already own.

What we still don't know

• Whether Binance's non-Ethereum hot wallets used MPC, and with what threshold.
• Whether any MPC party ran its own policy checks, or all trusted the same signing service.
• What the independent review will find. We'll update this article when it lands.

FAQ

Was Binance hacked because MPC was broken?

No source says the cryptography broke. Binance's report says an attacker gained unauthorized access to an internal wallet signing service and used it to sign transactions outside the normal withdrawal process.

Does MPC prevent exchange hacks?

No. MPC protects the private key from being stolen. It does not decide whether a request should be signed. That job belongs to policy, approval and the people holding the shares.

Did Binance users lose money?

Binance says it will absorb the losses, not its users. About $2.85 billion was frozen or intercepted, per Binance's November 3 report.

Is EIP-7702 a multisig?

No. EIP-7702 lets a regular Ethereum account set smart-contract code. Attackers abused pre-signed EIP-7702 authorizations to take control of a Binance hot wallet.

Is an MPC wallet safer than an exchange?

It is a different risk. You remove the company that can sign for you and the single key to steal. You take on device security, phishing and backups yourself.

Who was behind the Binance hack?

TRM Labs attributes it to TraderTraitor, North Korea's top hacking unit, and the FBI reportedly did the same on October 31. North Korea denies involvement.

Is a Vultisig Fast Vault the same as Binance's setup?

No. A Fast Vault is 2-of-2 between your device and VultiServer. VultiServer can never sign alone, needs your vault password for every signature, and your device starts and shows every transaction. For an independent screen on every co-signer, use a Secure Vault across devices you hold.