There's no vault here
for hackers to empty.
Attackers took about $6.3 billion from Binance's hot wallets, most of it in twenty minutes. An exchange keeps everyone's crypto together, which is what makes it worth attacking. Ace Wallet keeps your coins at your own addresses, under keys that never leave your Mac, and nothing moves until you approve it.
How $6.3 billion left Binance's hot wallets
The times are TRM Labs', from the blockchains themselves (UTC, October 29). Binance hasn't published its root cause yet.
- 20:05 · XRP Ledger. Five Binance wallets send 233.46 million XRP to one attacker address.
- 20:20 · Bitcoin and Ethereum. 18,270 BTC leave a Binance hot wallet. On Ethereum, one transaction lands carrying 50 EIP-7702 authorizations signed in advance, one for each upcoming transaction number of a Binance hot wallet.
- 20:22 · Tron. 612.7 million USDT and 46.4 million TRX leave a Binance hot wallet.
- 20:23 · Ethereum. The matching authorization hands the hot wallet to a “sweeper” contract only the attacker can command. One transaction empties it: about $2.5 billion in ETH, USDT and more than 60 other tokens.
- 20:41 · And after. Deposits keep arriving at the taken-over wallet, and the sweeper keeps collecting them, for hours.
- 23:05 · A second wave. Binance wallets on Avalanche and Polygon are hit.
Binance says it found no sign its private keys leaked: investigators believe the attackers got the exchange's own signing system to sign for them. When one company signs for millions of people, whoever takes over that signing controls everyone's money at once.
TRM Labs and Chainalysis attribute the theft to North Korea's TraderTraitor group. Stablecoin issuers and others froze roughly $2.7 to $3 billion of it, and Binance says it will cover customers' losses. Its early findings point to a compromised engineer's laptop that could reach a service allowed to request withdrawals.
Your money never sits with us, and nobody else can sign for you
We don't hold your crypto
There's no company hot wallet with customer money in it, and nothing of yours on our servers. Your coins stay on their own blockchains, at addresses only your keys control, so a breach of our company can't reach them.
Only your own Mac can sign
Your recovery words are made on your computer and kept there, encrypted. The key is opened inside the app's locked core for one signature, after you approve with Touch ID on a review the wallet draws itself. Our servers, the AI assistant and websites can't sign anything.
The handover trick is blocked
The only EIP-7702 handover the wallet signs is to its own helper for paying network fees in USDT or USDC, inside a send you approve. It signs none for anyone else. If another app ever hands your address away, the wallet says so, offers to end it, and stops showing that address for deposits.
The protection you get without changing a setting
- Keys. Made and kept on your computer. The screens you see never touch them.
- The vault. Encrypted with scrypt and AES-256-GCM, in a file only your account on this Mac can open.
- Every send. Your Touch ID or password, on a review that shows exactly what moves and where.
- Locking. It locks itself when your screen locks or your Mac sleeps, and wipes the keys from memory.
- Address scams. History never shows a whole address you could copy, lookalike addresses are blocked, and you send to saved contacts, so a planted fake can't slip into a payment.
- Swaps. Every route is decoded and checked before you see it: you're the one who receives, a minimum is enforced on the blockchain, and the rate is compared with market prices, including one your own computer fetches, so a break-in at our servers couldn't make a bad rate look fair.
- The AI assistant. Prepares the sends and swaps you ask for, within limits set in code. It can't sign, never sees an address, and can't change your contacts or limits.
- Error messages. Text from servers and blockchains never reaches the screen as written, so a scam can't dress up as an error.
- Your backup. The wallet checks you can really restore it before any money comes in, and asks again every 90 days.
- Screen capture. Other apps can't record the screens that show your recovery words.
- The app. Signed with our Apple Developer ID and notarized by Apple, its code compiled and its debugging doors shut, so no one can attach to it and read your keys.
- Our code. A new version of any package we use waits three days before we take it, and no package runs an install script.
An exchange account and Ace Wallet
| On an exchange | In Ace Wallet | |
|---|---|---|
| Who holds the keys | The exchange | You |
| Where your coins sit | In the exchange's shared wallets | At your own addresses |
| Who approves a transfer | The exchange's systems | You, with Touch ID |
| When the company has a security problem | Withdrawals can stop while it's sorted out (Binance paused them) | Nothing of yours is with us, so nothing is paused |
| Who can freeze your funds | The exchange | Not us |
Token issuers such as Tether and Circle can freeze their own tokens at any address, whoever holds it. That's how part of the stolen money was stopped.
Self-custody puts you in charge. Here's what that asks of you
Guard your words
They're the master key. Keep them on paper, offline. Never type them into a website or send them to anyone. We will never ask for them.
Keep your Mac clean
Install only the official app and keep macOS up to date. No software wallet can protect you from malware that controls your whole computer.
Read the review
Before you approve, the wallet shows the amount, the fee and who receives it. Take two seconds to check it's what you meant.
What people ask after a hack like this
Is my crypto on your servers?
Could your company move or freeze my funds?
What if your servers were hacked?
Were wallets like this affected by the Binance hack?
What if your company disappeared?
Can the AI assistant touch my money?
Hold your own keys.
Send, swap and receive across Bitcoin, Ethereum, Solana and dozens of other networks, with every key on your Mac and every transaction approved by you.
The hack's facts as reported by October 31, 2026. Binance's investigation is ongoing and figures may change. This page isn't affiliated with Binance.