Binance Hack On-Chain Analysis: 50 Signatures, 197,460 ETH and $2.83 Billion Frozen

What really happened in the Binance hack? Our analysis of the blockchain data shows: on October 29, 2026 an attacker took control of the hot wallet "Binance 14" with 50 simultaneously submitted signatures and drained about $2.7 billion within seconds. Binance confirmed the hack overnight and says it will cover all losses. According to our measurements and investigators, more than $2.83 billion is frozen, and the attacker is left mainly with 197,460 ETH. Here is what we verified ourselves, what the key voices on X say and where this is heading.

The minute-by-minute account is in our timeline with live ticker, the news itself in our Binance hack report.

Hack or internal transfer? The first debate of the night

In the first hour it was not clear there had been an attack at all. Analyst Simba considered a planned migration between Binance wallets possible: the destination was freshly created and had not moved the funds at first.

BREAKING: $2.7 BILLION JUST MOVED OUT OF BINANCE IN 24 SECONDS. Everyone is screaming HACK. But the onchain evidence tells a VERY different story.

Simba (@Simba_crpt) October 29, 2026

The theory did not last. The address behind the attack was funded with 0.1 ETH from the mixer Tornado Cash, the wallet was bound to an outside contract, and shortly after the attacker began spreading tokens across dozens of addresses. At 00:04 UTC Binance co-founder Yi He confirmed the hack:

User funds are safe. Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.

Yi He (@heyibinance) October 30, 2026

How the attack worked: 50 signatures, one hit

Security firm Blockaid found the decisive technical trick, and we verified it directly on-chain. The attack transaction is of the new type 4, which since the Pectra upgrade lets a wallet hand its control to a smart contract via EIP-7702. It contains exactly 50 such authorizations, all for the Binance 14 wallet, all pointing to the same attacker contract, for nonces 18,914,775 to 18,914,824 (transaction on Etherscan).

The attacker didn't know Binance 14's live nonce. So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx. Only 1 of 50 was a hit.

Blockaid (@blockaid_) October 29, 2026

The background: such an authorization is only valid for the nonce the wallet has at the moment of inclusion. Because the hot wallet kept sending withdrawals, the attacker did not know the nonce and fired 50 authorizations at once. One landed. More important is what 50 authorizations require: each must be signed with the wallet's key. The attacker could therefore produce signatures for Binance 14. How he gained that access is for Binance's announced post-mortem to explain. The delegation has since been removed: according to our query at 01:20 UTC the wallet's code is empty again.

Where is the money? Our tally at 01:30 UTC

About $2.7 billion left the two Binance wallets on Ethereum, plus smaller amounts on other chains. Most of it is blocked, but not all:

Item	Amount	Source
Frozen	more than $2.83B, including 1,767.6M USDT, 823M USDC, 40.5M RLUSD, 27.8M USD1, 29,934 WBETH	ZachXBT
of which verified by us	1,175.5M USDT and 823.0M USDC frozen on 0x5227…2f8c	own contract query
Ether held by attacker	197,460 ETH, about $436M, on 0x8532…43D4, incl. 2,000 ETH added at 01:14 UTC	Ethereum node
Borrowed via Aave	19,762 wETH, about $45M, against 60M USDT	Marc Zeller
Smaller tokens distributed	at least $122M in more than 15 tokens such as LINK, AAVE, WBTC, ONDO, WLD	own measurement via Blockscout
Other blockchains	about $19.5M on Arbitrum and $24M on Avalanche	Blockaid, preliminary

Update: This brings the total frozen for the Binance exploit so far to over $2.83B

ZachXBT (@zachxbt) October 30, 2026

The Aave trick: why frozen USDT still yielded Ether

The attacker knew Tether could freeze. Within three minutes he supplied 60 million USDT to the lending protocol Aave and borrowed 19,762 wETH, about $45 million. Shortly after, Tether froze the address, and 46 minutes later Aave froze the affected markets. The frozen USDT now sit as collateral on Aave, the borrowed Ether are with the attacker. He will never repay them.

Aave protocol will be fine. The hacker supplied 60M USDT and borrowed 19,762 wETH (~44.9M$) in 3 minutes, before Tether froze their address and before the Aave Guardian froze the Aave V3 Core reserves (46 min later).

Marc Zeller (@mzeller) October 29, 2026

Aave can absorb it, Marc Zeller of the Aave Chan Initiative explains: the position is overcollateralized and will be liquidated automatically once Ether rises about 4% to roughly $2,365. The debt equals 0.9% of the protocol's wETH reserves. A rising Ether price would, of all things, liquidate the attacker's loan.

More on the Binance hack

• Binance hack: how the hot wallet was drained
• Live ticker and timeline: the crypto crash after the hack
• USDT frozen: what Tether and Circle really blocked
• Binance withdrawals: which networks are paused
• Is this the end? Three scenarios for Bitcoin
• Ethereum: the hacker sits on 195,000 ETH
• Solana below $100: is $80 next?
• BNB crash: another FTT moment?
• The biggest crypto hacks in history
• How to short Bitcoin in the crash
• Why is crypto down today?

What the key voices on X are saying

• Yi He, Binance: user funds safe, Binance covers all losses, deposits and withdrawals temporarily suspended, full post-mortem to follow.
• ZachXBT, investigator: more than $2.83 billion frozen.
• Blockaid, security firm: 50 EIP-7702 authorizations in one transaction, one hit. Verified by us on-chain.
• Marc Zeller, Aave Chan Initiative: the attacker borrowed 19,762 wETH before the freeze, manageable for Aave.
• Simba, analyst: initially considered an internal transfer possible, overtaken by Binance's confirmation.
• Bala, commentator: wrote the attacker "walked away" with the Aave trick. True for $45 million, not for the billions.

Our conclusion: where the Binance hack is heading

• For customers: Binance has pledged to cover all losses, and the frozen share makes that credible. The key question is when deposits and withdrawals resume. Until then: patience, and no links from messages promising refunds. Which exchanges hold a licence is shown in our comparison of regulated exchanges. We track the status in Binance withdrawals after the hack.
• For the loot: of about $2.7 billion, more than $2.8 billion across all chains is blocked. The attacker is left mainly with the 197,460 ETH, the Ether from Aave and distributed smaller tokens, roughly $600 million in total. He will have to launder it over days and weeks, and every move is public.
• For Ethereum: the 197,460 ETH remain an overhang. At the same time a 4% price rise would liquidate the attacker's Aave position. What it means for the price is in Ethereum crash: the Binance hacker sits on 195,000 ETH.
• For the industry: the attack shows a new pattern. Whoever can produce signatures for a wallet needs, thanks to EIP-7702, a single transaction to sweep everything. Exchanges will have to tighten their signing systems and the approval of such delegations.

We keep monitoring the addresses and will update this analysis as funds move or Binance publishes its post-mortem. This article is not investment advice.