On Thursday evening, crypto assets worth billions of dollars flowed out of hot wallets belonging to the exchange Binance to previously unknown addresses. Whether this is a Binance hack has not been confirmed by the exchange itself. Binance speaks of a “potential security issue” that it is investigating. Founder Changpeng Zhao, on the other hand, already says it “does look like a hack on Binance.” What is confirmed is that the stablecoin issuers Tether and Circle have together frozen tokens worth more than $2.3 billion linked to the incident.
As of October 29, 2026, 11:15 p.m. CET. The situation is still developing and the figures may change significantly.
Update November 1, 2026: FBI names North Korea, Binance has replaced 90 percent
As of November 1, 2026, 1:00 a.m. CET. The picture has become much clearer since our first report. The original text below is kept unchanged as of October 29.
- Hack confirmed, losses of about $6.3 billion: Binance has confirmed a security incident and says it has set aside about $6.34 billion of company funds to cover the losses (Reuters via NBC News). TRM Labs puts the outflows at about $6.36 billion across ten blockchains, most of it within about 20 minutes. That makes it the largest crypto theft on record, roughly four times the Bybit hack of February 2025.
- 90 percent of holdings backed again: According to Binance’s October 31 update, 90 percent of the stolen holdings have been replaced (CNBC). BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are said to be 100 percent backed. The remaining 10 percent consists of less liquid tokens that Binance is buying on the market and over the counter. The money comes from the SAFU emergency fund, part of the futures insurance fund and the corporate treasury. Note: this does not mean 90 percent of the loot has been recovered from the attacker.
- Withdrawals are resuming in phases (as of November 1, 2026, 9:30 a.m. CET): Binance started the first phase of withdrawals on Sunday morning (Binance, Recovery Update #4). Bitcoin was the first network back online. According to Reuters, Binance’s status page reported the start shortly after 7:00 a.m. CET, and the exchange confirmed the reopening on X at 7:20 a.m. CET (Binance on X). At around 8:50 a.m. CET, ETH, USDT and USDC on the Ethereum network and BNB, USDT and USDC on BNB Smart Chain followed (Binance on X). Phase one covers 15 networks in total, including Tron, Solana, XRP Ledger and Dogecoin. Binance is opening each network individually only after security checks are complete, with more networks and tokens to follow later (Reuters via Investing.com, AFP). Limitations: Binance expects delays and longer processing times. Whether a coin is already available on a given network is shown on Binance’s withdrawal page and network status page. Withdrawals will now be sent from new wallet addresses that Binance has added to its proof-of-reserves list. Binance says it has now replaced about 95 percent of the affected holdings. Not yet confirmed: At the time of writing, Binance had not said whether the remaining phase-one networks are already open or when all withdrawals will be back to normal.
- Proof of reserves: Binance took a new reserves snapshot at 00:00 UTC on October 31. It expects the zero-knowledge proof that lets users verify their own balances by November 3 (Business Today).
- Who is behind it: On October 31 the FBI said North Korea was responsible for the theft. It attributes the attack to the group it calls “TraderTraitor”, which it also blamed for the Bybit hack (FBI alert). TRM Labs and Chainalysis had independently named TraderTraitor before that. According to the FBI, the attackers are converting the stolen assets mainly into ether. Binance has not published an attribution of its own.
- Freezes: According to TRM Labs, Tether, Circle, Ripple and World Liberty Financial have frozen about $2.67 billion in stablecoins. Including freezes by the Arbitrum Security Council, the total is about $2.7 billion. TRM says the attacker still holds about $2.4 billion in assets that have no issuer and cannot be frozen, mainly ETH and BTC.
- Root cause still open: Binance initially pointed to a compromised DevOps engineer’s laptop that gave the attacker access to a service container. Co-CEO Richard Teng later described a more complex attack, including malware designed to erase its traces. A full root-cause report has not been published. TRM Labs believes the attacker was able to make the hot wallet signing system sign transactions of its choosing. That is TRM’s assessment, not a confirmation from Binance.
For users, the advice stays the same: be wary of messages about supposed “refunds” or the reopening of withdrawals, and rely only on Binance’s official channels.
Below, we separate what is documented from what so far is only an estimate by on-chain trackers.
Key Takeaways
- On October 29, 2026, large sums left hot wallets labeled as Binance for newly created addresses. Estimates of the total range from roughly $2.5 billion to about $5.7 billion, depending on the tracker.
- Binance officially confirms only that it is investigating. The current version of its statement says user funds are “completely safe.”
- According to its CEO, Tether has frozen more than 1.567 billion USDT. Circle has frozen more than 800 million USDC, according to CEO Jeremy Allaire.
- On Etherscan, the wallet “Binance 14” is delegated via EIP-7702 to an external, unverified contract. That supports the hack theory.
- For users, the advice for now is simple: don’t click links from direct messages, and rely only on official Binance channels.
What we know about the Binance hack so far
According to Etherscan data analyzed by BeInCrypto, a single transaction left the wallet “Binance 14” at around 8:24 p.m. UTC. It contained 167,464 ETH plus dozens of other tokens, including USDT worth billions. Seconds later, 28,005 ETH followed from the wallet “Binance 16” to the same destination. That address did not exist before October 29 and forwarded part of the funds to further fresh addresses shortly afterwards. BeInCrypto reports that the process was triggered by a wallet funded exclusively through the Tornado Cash mixer with small amounts of ETH.
At around 8:55 p.m. UTC, the security firm PeckShield reported “unexpected large outflows” from Binance hot wallets on X. A little later, the news service Tree News described it as a suspected key compromise. Exchanges move funds between their online hot wallets every day. What is unusual here is the scale, the mixer-funded trigger wallet and the immediate onward distribution.
The role of EIP-7702
One technical detail can be checked directly. The Etherscan page for “Binance 14” shows that the account is now delegated via EIP-7702 to the contract 0x63e842B0…73e9c6fAe. EIP-7702 has been live since the Pectra upgrade. It lets a regular Ethereum account temporarily run a smart contract’s code, and the required authorization has to be signed with the account’s key.
Security firm Blockaid describes the contract as an unverified “sweeper.” Its function pulls every ERC-20 token and all ETH out of the account, and only one hardcoded operator can trigger it. According to Blockaid, the attacker did not know the wallet’s current nonce, so they sent 50 authorizations with consecutive nonces in a single transaction, and one of them landed. If that analysis holds, the attacker was able to produce signatures on behalf of the wallet, either with the key itself or through the exchange’s signing infrastructure. How they did so remains unknown.
How Binance and Changpeng Zhao responded
Binance published a short statement on X at 9:15 p.m. UTC and revised it several times within about 15 minutes. An interim version said that “at this stage, we have not confirmed any impact to user funds.” The current version says instead: “User funds are completely safe.” Updates are to follow through official channels, and users are told not to trust unofficial links, messages or requests for account information. Co-founder Yi He shared the same statement.
Changpeng Zhao, who no longer runs Binance, was more direct. He wrote that user funds are safe and that it looks like a hack. As a shareholder, he said, he expects all user funds to be fully covered. That is not a binding commitment from the exchange.
For context: Binance has operated its SAFU emergency fund since 2018. The fund stepped in back in 2019, when attackers stole around 7,000 bitcoin from a hot wallet. The exchange has not yet said whether or how it would cover a loss of the size now being discussed.
Tether and Circle freeze more than $2.3 billion
The stablecoin issuers reacted fastest. Tether CEO Paolo Ardoino said at 9:25 p.m. UTC that Tether had frozen more than 1.567 billion USDT related to a “potential Binance exchange hack.” Circle CEO Jeremy Allaire wrote that Circle, in coordination with law enforcement, had frozen more than 800 million USDC. Together, that is more than $2.3 billion.
Earlier figures were lower. Zhao initially cited about $971 million at Tether and about $823 million at Circle, and the Tether figure rose afterwards. A widely shared German-language X post speaks of “at least $2.316 billion” in freezes, which is in the same range as the issuers’ own figures.
The freezes show once again how centralized the large stablecoins are. Issuers can block tokens at individual addresses, which helps here but also sets USDT and USDC apart from ETH or BTC. The attacker can no longer move the frozen stablecoins. That does not apply to ETH, bitcoin and other tokens.
How much actually left the wallets?
The figures differ widely, and none of them has been confirmed by Binance:
- Tree News cited about $2.53 billion in more than 60 tokens.
- Other on-chain analyses put the total at about $2.77 billion across five blockchains.
- Blockaid says it is investigating suspicious outflows of about $3.3 billion on Ethereum, Arbitrum and Avalanche.
- According to Arkham data reported by CoinDesk, the receiving address holds more than $5.7 billion in various crypto assets.
- The viral X post cites $5.643 billion. It breaks this down as $3.528 billion on Ethereum, $1.449 billion on Bitcoin, $628 million on Tron and $38 million on Arbitrum, Optimism and Base combined.
There are concrete reasons for the gaps. Trackers cover different chains and value tokens at different times, and some count forwarded amounts twice. Frozen stablecoins are sometimes included in the totals and sometimes not. Prices have also fallen since the incident, so every dollar figure is a snapshot. We will not treat any of these figures as confirmed until Binance publishes its own accounting.
If a loss in the billions is confirmed, it would rank among the largest thefts in the history of the crypto industry. For comparison, attackers took about $387.5 million in the Bitget hack in September.
Market reaction
According to media reports, BNB fell by as much as 9 percent at one point, bitcoin dropped below $80,000 and ether slipped below $2,300. Coinglass data shows about $600 million in positions liquidated within one hour. These figures are highly volatile.
What users should do now
- No panic clicks: Incidents like this are followed by a wave of phishing messages promising “refunds” or “security checks.” Binance explicitly warns about this. Rely only on the exchange’s official channels for information.
- Never share credentials: Legitimate exchanges never ask for passwords, 2FA codes or seed phrases via direct message or email.
- Rethink custody: The incident is another reminder of the counterparty risk of centralized exchanges. Anyone holding larger amounts long term should look into self-custody. Our hardware wallet comparison and our explainer on centralized and decentralized exchanges are a good place to start.
What is still unclear
The key questions remain unanswered. It is not known how the attacker obtained signatures for the hot wallets, or which wallets and chains are affected in total. It is also unclear how large the net loss is after the freezes and whether Binance will cover it in full from its own funds. Nor is it known whether deposits and withdrawals are running normally. There is no reliable information yet about who is behind the attack, so attributions already circulating on X should be treated with caution.
Our take: a billion-dollar outflow from Binance hot wallets is visible on-chain, and the stablecoin issuers have officially confirmed their freezes. The exact size of the loss and its cause have not been confirmed. We will update this article as soon as Binance publishes reliable information.
