What happened at Binance on 29 October?
Binance, the world's largest cryptocurrency exchange, confirmed a security incident late on 29 October 2026. On-chain records showed funds leaving wallets the company uses to settle customer withdrawals. The first Ethereum transfer landed at 20:24 UTC, according to Etherscan records reviewed by Decrypt.
That transaction moved 167,464 ether and 63 token transfers, including 1.615 billion USDT, to a brand-new address. Three minutes earlier, an address funded through Tornado Cash had submitted a delegation for a Binance hot wallet under EIP-7702. The delegation let that wallet run code supplied by someone else.
The drain crossed three blockchains. Decrypt's tally counted $3.51 billion on Ethereum, $1.44 billion in 18,270 bitcoin and $630 million on Tron. The Block reported suspicious outflows of up to $5.8 billion. Arkham Intelligence linked almost $6 billion across 55 addresses, according to CNBC.
Binance's first statement was cautious. The company said it was "aware of reports of a potential security issue and are actively investigating". A spokesperson told TechCrunch that withdrawals on several networks had been paused as a precaution. Within hours, Binance had suspended both deposits and withdrawals.
The exchange also suspended Binance Alpha trading, CNBC reported, and revoked authorisation for the affected address. It said it had engaged law enforcement and blockchain intelligence partners to trace the money. A spokesperson told TechCrunch that user funds were "completely safe".
The wallets involved were hot wallets, the internet-connected accounts exchanges use to process customer withdrawals. Binance has not said how much of its customer balance sits in such wallets, and its update did not publish total holdings.
Social media moved faster than official statements. Changpeng Zhao, Binance's founder and largest shareholder, said on X that the company had likely been hacked, TechCrunch reported. He said he expected users to be fully covered but did not explain the basis for that claim.
- •20:21 UTC: a Tornado Cash-funded address submits an EIP-7702 delegation for a Binance hot wallet.
- •20:24 UTC: 167,464 ether and 63 token transfers leave for a newly created address.
- •21:04 UTC: Circle freezes 823 million USDC in the main receiving wallet.
- •02:23 UTC on 30 October: Binance publishes an official incident update estimating a $6.3 billion impact.
How much was stolen, and how much has been frozen?
Binance's own figure is about $6.3 billion. In an official notice published at 02:23 UTC on 30 October, the exchange said the "estimated total impact sits at around $6.3B". It also said roughly $3 billion had been frozen on-chain with help from blockchain partners.
The number has moved quickly. Binance had earlier put verified frozen funds at $2.54 billion, CNBC reported, before revising the figure upward. The gains reflect coordination with stablecoin issuers, which can blacklist addresses and stop specific tokens from moving.
Tether chief executive Paolo Ardoino said his company froze more than 1.5 billion USDT, according to CNBC. Circle chief executive Jeremy Allaire said Circle froze more than $800 million in USDC. Decrypt counted 823 million USDC frozen at 21:04 UTC. Ripple froze about $200 million in RLUSD, according to Binance co-CEO Yi He.
Not every asset can be stopped. Ether and bitcoin have no issuer, so once stolen coins are swapped out of a stablecoin they are beyond recall. Decrypt reported about 253,000 ether, worth roughly $570 million, sitting in two wallets by 22:07 UTC. The attacker swapped stablecoins for ether on Uniswap and borrowed ether against USDT on Aave.
Even at the lower end of the estimates, the loss dwarfs earlier exchange failures. Bybit lost about $1.5 billion in February 2025, a theft the FBI attributed to North Korea. Bitget lost more than $350 million in a more recent incident, CNBC reported. Binance's own 2019 hack cost 7,000 bitcoin, then worth about $40 million.
The gap between Binance's estimate and its frozen total is roughly $3.3 billion. That money is the part still moving, still traceable or still sitting in wallets nobody has blacklisted.
Frozen is not the same as recovered. The Block reported that Tether and Circle had frozen $1.79 billion in USDT and USDC by the end of Thursday. Those balances sit in addresses the issuers control. Returning them depends on investigations, court orders or a process that has not been described publicly.
How did the attacker get in?
Binance's preliminary finding points at an employee laptop rather than a stolen key. The exchange said the incident "may involve a compromised DevOps engineer's laptop". From that foothold, the attacker reached a service container and was able to "submit unauthorized withdrawal transactions".
Binance said it had found "no evidence of any wallet private key leak". Security firm Blockaid reached a similar conclusion from on-chain data. "We don't think a key was leaked," Blockaid chief executive Ben-Natan told Cointelegraph, describing what he called a compromise of signing infrastructure.
Blockaid's analysis traced the drain to a delegated wallet. The attacker bundled 50 EIP-7702 authorisations into a single transaction aimed at a wallet labelled Binance 14, Cointelegraph reported. One authorisation matched the account's required nonce and was accepted. That delegation pointed the wallet at an unverified sweeper contract, which let a designated operator move tokens and ether.
How the attacker obtained a signature the system would accept is still unknown. Binance has promised a technical post-mortem once its investigation is complete. Ben-Natan told Cointelegraph the operation could have involved several compromised devices and movement through the exchange's internal network.
Arkham Intelligence's chief executive, Miguel Morel, told Cointelegraph that early data was not enough to decide between stolen keys and compromised infrastructure. "From what we can tell, it appears the hack is still ongoing," he said before Binance published its update.
The Binance 14 name is a label that blockchain data providers attach to wallets when activity patterns suggest an owner. Such labels help analysts follow funds, but they are not proof of ownership on their own.
The pattern echoes Bybit. Ben-Natan described the two cases as "very, very similar". Bybit's published forensic update said attackers had compromised a Safe developer's credentials. It said they reached the wallet provider's infrastructure and deceived signers into approving a malicious transaction.
The common thread is that nobody needed to steal a private key. The attack worked by abusing the systems that authorise transfers on the wallet's behalf.
Why does EIP-7702 matter for exchange security?
EIP-7702 arrived with Ethereum's Pectra upgrade, which went live on 7 May 2025. The proposal lets an ordinary externally owned account attach code to itself by signing a list of authorisation tuples. After that, the account behaves like a smart contract wallet.
The feature was designed for convenience. It supports batching several operations into one transaction and letting one account pay fees for another. It can also give sub-keys narrow permissions instead of full control. Exchanges and custody providers use such features to automate payouts and manage hot wallets.
That convenience has a cost. Once a delegation is installed, it stays in place until it is replaced. Odysseas Lamtzidi of Phylax Systems wrote on X that the delegation persists. In a post quoted by Decrypt, he said it could "authorize later transfers without another signature from the wallet".
Each authorisation in a set-code transaction carries a chain identifier, a contract address and a nonce. A wallet's current nonce is a single-use counter, so an authorisation built for a different nonce should be rejected. Blockaid's account suggests one entry in the batch matched, which was enough.
The resulting delegation is visible on-chain, but it does not look like a transfer. It is a small change to the account's code that grants sweeping rights to another contract. Monitoring tools that watch for large outflows can miss it until the money starts moving.
For attackers, that means one valid signature can be worth more than a key. It also means defenders have to watch for small, quiet transactions that install code rather than large, obvious transfers.
For customers, the practical lesson is less technical. Custody on an exchange depends on the security of internal signing systems, not just on the strength of a private key. That was true before EIP-7702, but the delegation feature gives a successful intruder a durable foothold.
What does it mean for Binance users?
The most immediate effect is access. Binance has suspended deposits and withdrawals while it completes security checks. Its 02:23 UTC update gave no timetable for restoring them. No later official notice had been published by the time this article was written.
Binance says it will cover customer losses. The exchange said it will "cover all losses from the SAFU fund and the company's funds". SAFU is Binance's Secure Asset Fund for Users. It added: "User funds are safe." It also promised an updated proof-of-reserves report once remediation is finished.
Reserve disclosures complicate that message. CoinDesk reported that Binance's own reserve data lists the drained wallets as backing customer balances. On CoinDesk's reading, that leaves Binance's ether backing about 6% short until the exchange replaces what was taken.
Proof-of-reserves reports have known limits. They are point-in-time snapshots published by the exchange itself, and they show balances rather than proving exclusive control of every key. A shortfall can therefore sit inside a report that still looks healthy on its headline numbers.
The exchange has not said how a customer claim would be handled if balances did not match holdings. Its statement sets out an intention to cover losses, not a procedure, a deadline or an external audit of the shortfall.
Users outside Binance were affected too. Stablecoin issuers froze funds as they moved, which is why so much of the money stopped. Circle, Tether and Ripple each acted within hours, and Binance credited those freezes in its own update.
That speed is unusual and instructive. Issuers can act on a single address in minutes, while exchanges, courts and regulators typically move far more slowly. The result is a form of private enforcement that depends on where the stolen coins happen to be sitting.
Until withdrawals resume, customers cannot test balances by moving coins off the exchange. That makes two numbers matter most to account holders: the timing of the restart and the state of the next reserves report.
How are crypto markets reacting?
Prices fell across the market. Bitcoin dropped more than 4% to $77,994.96 on Friday, CNBC reported. Cointelegraph, citing CoinGecko, put bitcoin at about $77,131, down 4.8%, and ether at $2,217, down 5.7%.
Binance's own token took a harder hit. BNB traded near $693, down about 8.2%, while decentralised finance tokens fell further. Aave's AAVE dropped 11.3% to $118.54 and Uniswap's UNI fell 10.4% to $6.48, according to Cointelegraph.
Sentiment followed price. The Bitcoin Fear and Greed Index fell to 30, its lowest reading since 14 August, which places it in "fear" territory. Circle's shares fell about 5% in after-hours trading on Thursday, CNBC reported.
DeFi protocols responded defensively. Aave froze new deposits and borrowing across its community-operated V3 and V4 markets. It said its contracts were unaffected and that users could still withdraw and repay. Kamino paused borrowing in its SOL and BTC market as a precaution.
The same day brought a separate security incident. Polymarket halted trading after a third-party provider was compromised and later resumed, with The Block reporting a $2.65 million exploit. The two events are not connected in any reporting reviewed for this article.
Decentralised venues played both roles. Uniswap and Aave were used to convert or borrow against stolen coins, then Aave restricted activity to limit contagion. That double exposure is a reminder that permissionless protocols cannot easily screen who is using them.
The market reaction matters because exchanges sit at the centre of crypto liquidity. When the largest venue stops withdrawals, traders reprice the risk of leaving coins on any centralised platform.
Was North Korea behind the Binance hack?
No one has been named or charged. Binance says it is working with law enforcement to establish who was responsible. Blockaid said the on-chain preparation resembled North Korean operations, but its chief executive stressed that attribution remained unconfirmed.
The comparison has precedent. The FBI published a public service announcement on 26 February 2025. It said North Korea was responsible for the theft of about $1.5 billion in virtual assets from Bybit. The bureau refers to that activity as TraderTraitor.
Analysts look to North Korea because the Bybit case combined stolen credentials with a deceived signing process, much as Binance describes here. Resemblance is not proof, and Binance has not endorsed the comparison.
The alert focused on where the money goes. It said TraderTraitor actors were converting stolen assets to bitcoin and spreading them across thousands of addresses on several blockchains. It asked exchanges, bridges, analytics firms and other service providers to block transactions linked to the addresses it listed.
That history shapes how investigators work. Tracing groups look for the same laundering habits, the same mixers and the same swap routes, then hand findings to police. None of that has happened publicly in this case yet.
The answers will show whether this stays a costly but contained incident. They will also show whether it changes how exchanges secure the systems that sign transactions.
For now, the facts point in one direction. The largest theft in the industry's history did not require breaking cryptography. It appears to have needed a compromised laptop, one valid signature and a wallet feature built for convenience.
Several questions will shape what happens next.
- •When Binance publishes its technical post-mortem and its updated proof of reserves.
- •When deposits and withdrawals resume, and whether the exchange imposes limits at first.
- •Whether the roughly $3 billion already frozen is returned to Binance or held during investigations.
- •How much of the remaining balance the attacker converts into assets that no issuer can freeze.
- •Whether law enforcement names an attribution, and whether other exchanges change signing controls.