Binance Hack: Around $2.8 Billion Drained From a Hot Wallet

Binance Hack: What Happened on Thursday Evening

On Thursday evening, 29 October 2026, an unknown attacker emptied one of Binance's largest hot wallets in a single transaction at 20:24 UTC. The wallet “Binance 14” sent 167,464 ETH and 63 different tokens to a freshly created address, including 1.615 billion USDT. Together with two further outflows, the attacker's addresses now hold around $2.8 billion according to Etherscan data. That would be the largest theft in the history of cryptocurrencies, almost twice as much as in the Bybit hack of February 2025.

At 21:24 UTC, Binance said it was urgently investigating reports of a potential security issue. Co-founder Yi He added that user funds are safe. Founder Changpeng Zhao, better known as CZ, had already written on X at 21:15 UTC that it does look like a hack. According to their chief executives, Tether and Circle have frozen around $2.4 billion in stablecoins between them. BNB, the exchange's own token, fell 6.1 percent in the evening.

The case was first flagged by on-chain analyst Spreek. At 20:32 UTC, Spreek pointed out that the transaction came from an address whose starting funds had arrived through the mixer Tornado Cash. Exchanges never pay their transaction fees that way, which made it the first clear warning sign.

Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash

Spreek (@spreekaway) October 29, 2026

All times in this article are UTC. We will update the article as soon as Binance shares further details.

How Much Money Left Binance in the Hack

The main transaction at 20:24 UTC can be traced in full on Etherscan. It moved 167,464 ETH and 63 tokens from Binance 14 to the address 0x5227…2f8c, which Etherscan now labels “Binance Hot Wallet Exploiter 2”. Two minutes later, 28,005.6 ETH from the wallet Binance 16 followed. At 20:41 UTC came a second strike through the same route: 780 million USDC.

The largest items of the stolen funds, values according to Etherscan at 21:15 UTC.

At 20:39 UTC, the attacker moved the 195,470 ETH on to another address in a single transaction. Nobody can freeze Ether, which makes this part the safest for the attacker.

Whale Alert reported large outflows from Binance wallets to new addresses on other blockchains in the same time window, including 612.7 million USDT on Tron and a combined 16,687 bitcoin in four transfers. Whether these belong to the attack or are Binance moving funds to safety is unclear. Walter Bloomberg reported outflows of $2.77 billion across five blockchains, while The Block cites Arkham data showing around $3.55 billion.

For context: DefiLlama counts around $144 billion in assets in Binance's publicly known wallets. The $2.8 billion amounts to just under 2 percent of that. The exchange's solvency can absorb it. Trust in its security takes a heavy hit, though, because the affected wallet is no side wallet but Binance 14, one of its most used hot wallets with more than 31 million transactions.

How the Binance Hack Unfolded: The Timeline

The trail on the blockchain shows an attack that had been prepared for at least a day. Every step can be viewed publicly on Etherscan.

How the Attacker Took Over the Binance Wallet via EIP-7702

The key to the Binance hack is called EIP-7702. The feature has been live on Ethereum since the Pectra upgrade on 7 May 2025. It allows a regular wallet to hand its control to a smart contract. That is useful because a wallet can then bundle many transfers into one transaction, and exchanges use it to distribute funds efficiently. The handover only takes effect, however, if it is signed with the wallet's private key. That is what the EIP-7702 standard specifies.

The attacker had exactly such a signature. At 20:20:59 UTC, the attacker's address submitted a transaction that tied Binance 14 to the attacker's own contract. Etherscan shows it as “EIP-7702: Binance 14, Delegate to 0x63e842B0…”. Four minutes later, the attacker called that contract, and Binance 14 transferred everything it held. The fee for moving $2.8 billion was $0.93.

Analyst Detective Pho describes that the transaction at 20:20 UTC contained 50 delegations at once, signed with the key of Binance 14, one for each of the next transaction numbers. The attacker thereby protected themselves against a quick revocation. According to developer Alex M., the contract only accepts calls from the address funded through Tornado Cash.

1/4 EIP-7702 can turn the wallet itself into the sweeper. A Binance-labeled wallet moved 167,464 ETH + 63 tokens, including 1.615B USDT, just 3m24s after a signed delegation was installed. This is bad.

odysseas.eth (@odysseas_eth) October 29, 2026

The decisive question remains open: where did the signature come from? Three routes are possible. The private key of the hot wallet could have been stolen. The exchange's signing system could have been manipulated so that it signed a foreign instruction as a genuine one, which is how the Bybit hack worked in 2025. Or someone with access to the systems was involved. Security service Defimon classifies the case as abuse of an EIP-7702 delegation with a compromised key. None of the three scenarios is proven, and Binance has not commented on this yet.

Tether and Circle Freeze $2.4 Billion After the Binance Hack

Around 21:05 UTC, several news services reported the first freezes, and CZ publicly thanked both issuers shortly afterwards. Their chief executives have since published the figures themselves: Circle has frozen more than 800 million USDC in coordination with law enforcement, Tether more than 1.567 billion USDT. Frozen stablecoins can neither be moved nor swapped, so they are worthless to the attacker.

Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone.

Paolo Ardoino (@paoloardoino) October 29, 2026

Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.

Jeremy Allaire (@jerallaire) October 29, 2026

In total, around $2.4 billion is now frozen. Tether and Circle have not broken down whether all frozen amounts sit on Ethereum. The Ether cannot be frozen: the 195,470 ETH, worth a little over $440 million, remain in the attacker's hands. Further stablecoins among the stolen funds come from Ripple (RLUSD, $62.6 million), World Liberty Financial (USD1, $27.8 million) and Ethena (USDe, $9.7 million). No freezes by these issuers have been reported so far.

What Binance and CZ Say About the Hack

Binance made its first official statement at 21:24 UTC, an hour after the outflow:

Our teams are aware of reports of a potential security issue and are actively investigating. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.

Binance (@binance) October 29, 2026

Co-founder Yi He published the same text seven minutes earlier and added “User Funds SAFU”, meaning user funds are safe. The exchange itself does not yet speak of a hack. On the blockchain, Binance 14 itself initiated a batch transfer to the Binance wallet “Hot Wallet 34” at around 21:09 UTC, which was still unconfirmed at 21:15 UTC.

CZ, no longer in charge of Binance since stepping down in November 2023, commented at 21:15 UTC:

User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.

CZ BNB (@cz_binance) October 29, 2026

CZ writes that user funds are safe, that it does look like a hack, and that as a shareholder CZ expects all user funds to be fully covered. That is an expectation, not yet a commitment from the exchange. Binance set up its SAFU emergency fund in July 2018 for exactly such cases. When around 7,000 bitcoin were stolen from a hot wallet in May 2019, Binance covered the loss in full from this fund.

Not every observer was convinced straight away. Analyst StarPlatinum initially saw the movements as more likely an internal wallet migration. The Tornado Cash funding, Etherscan's “Exploiter” label and the freezes by Tether and Circle all argue against that reading.

Who Is Affected by the Binance Hack

Binance customers: By trading volume, Binance is the largest crypto exchange in the world. The exchange has not said whether deposits and withdrawals are running normally. On X, users are asking about the status of their withdrawals, and there is no outage notice. Binance explicitly warns of scammers exploiting the situation.

BNB and the wider market: At 21:26 UTC, BNB traded at $710.79 according to CoinMarketCap, down 6.1 percent in 24 hours. Bitcoin fell 2.4 percent to $79,409, Ethereum 3.3 percent to $2,287. You can follow all prices live on the CryptoTicker crypto prices page.

Token projects: The stolen funds include sizeable holdings of Uniswap, Ethena, Pepe, Chainlink, Aave, Worldcoin and Ondo. If the attacker sells them via decentralised exchanges, it will weigh on these markets. If you hold these tokens, keep an eye on the attacker's address over the coming days.

Stablecoin issuers: Tether and Circle froze funds within an hour and thereby blocked a large part of the stolen funds. Ripple, World Liberty Financial and Ethena are affected with smaller amounts.

Platforms working with Binance: Many trading platforms hedge positions on Binance or hold liquidity there. The platform Variational stated shortly after the news broke that its users' funds on Omni sit in its own smart contracts and are safe. Similar statements from other partners are likely to follow.

The Binance Hack Compared: The Largest Theft in Crypto History

If the amount is confirmed, the Binance hack surpasses every previous case. The record was previously held by Bybit: in February 2025, attackers stole around $1.46 billion there, and the FBI attributed the attack to North Korea. There is no such attribution for the Binance hack yet.

The largest thefts from crypto exchanges and bridges. Binance according to Etherscan, the other cases according to the companies affected and investigators.

Binance has been hit before: the BNB Chain Bridge, a service around the Binance token, lost around $570 million in October 2022, and much of it was stopped at the time. The Bybit case, on the other hand, shows how little can be recovered when the loot consists of Ether, because no issuer can freeze it. In the Binance hack, the larger part sat in stablecoins, and that is exactly what blocked a large share of the stolen funds within an hour.

Binance Hack: Three Steps for Customers of the Exchange

Stay calm and avoid rash decisions. Three points will help you now:

• Official channels only: Information on reimbursements will only come through Binance's announcement page and the exchange's verified accounts. After every major hack, fake support messages and supposed compensation forms appear. Never enter your login details or your recovery phrase there.
• Check your balance yourself: Only log in through the official app or the Binance website by typing the address yourself, never via links in emails or messages. There you can see your balance and the status of your withdrawals.
• Consider self-custody: What you are not actively trading does not need to sit on an exchange. With a hardware wallet, you hold the keys yourself. Our hardware wallet comparison shows which devices are suitable.

You can read how the exchange performs on fees, licensing and security in our Binance review. This article is not investment advice.