Binance Hack: Around $2.8 Billion Drained From a Hot Wallet

Update on 30 October 2026 at 11:05 UTC: the trail leads to North Korea, withdrawals are due to resume within 48 hours. Blockchain analytics firm TRM Labs attributes the attack with high confidence to TraderTraitor, the North Korean hacking unit that the FBI also blamed for the Bybit hack. TRM counts $6.36 billion that left Binance wallets on ten blockchains, most of it within about 20 minutes from 20:05 UTC. Chainalysis CEO Jonathan Levin also sees TraderTraitor as the likely perpetrator, according to SecurityWeek: Chainalysis found proceeds from September's Bitget exploit mixed with funds taken from Binance. Binance itself names no perpetrator and speaks of multiple factors, with a compromised computer as the likely entry point. According to Binance, deposits are operating normally. Withdrawals remain paused until the withdrawal service and its related addresses have been through a security revamp; the exchange expects to resume them within 48 hours. At 11:03 UTC, the public status interface showed withdrawals closed on all 1,447 networks and deposits open on 1,049. Our analysis of North Korea and TraderTraitor sums up what is known about the attackers.

Service Update

Deposits remain unaffected and continue to operate as normal.

Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours, and will update with further details.

The incident stems from multiple factors. Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident. A comprehensive report with the root cause will follow.

We will continue to share updates through official Binance channels.

Binance (@binance) 30 October 2026

Update on 30 October 2026 at 02:42 UTC: Binance names the cause and a total loss of around $6.3 billion. According to an exchange announcement at 02:23 UTC, the initial investigation points to a compromised laptop belonging to a DevOps engineer. Through it, the attacker reportedly gained access to a service container and submitted unauthorised withdrawal transactions. Binance says it has found no evidence of a wallet private key leak. The exchange estimates the total impact at around $6.3 billion, more than four times the Bybit hack of 2025 and around 4.4 percent of the almost $145 billion DefiLlama counted in Binance's public wallets before the hack, excluding the exchange's own tokens such as BNB. At 01:18 UTC, the figure stood at $134 billion. Around $3 billion has been frozen on-chain. Binance will cover all losses from its SAFU emergency fund and company funds, has suspended deposits and withdrawals and has revoked the affected address authorisation. Once remediation is complete, the exchange plans to publish an updated proof of reserves and a technical post-mortem.

Update on 30 October 2026 at 01:45 UTC: Binance confirms the hack and says it will cover all losses. Yi He, from Binance's founding team, wrote on X at 00:04 UTC that user funds are safe and that Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while the exchange runs security checks, freezes funds and works with law enforcement. Binance says it will publish a full post-mortem once the investigation is complete. In the exchange's public status interface, withdrawals for Bitcoin and Ether were still shown as open at 01:38 UTC.

User funds are safe.

Binance will cover all hacking losses.

Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.

We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates.

Yi He (@heyibinance) 30 October 2026

According to blockchain investigator ZachXBT, more than $2.83 billion has now been frozen. The attacker put part of the loot to use beforehand: according to Marc Zeller of the Aave Chan Initiative, the attacker supplied 60 million USDT to Aave and borrowed 19,762 wrapped Ether against it, worth around $44.9 million, three minutes before Tether froze the address. At 01:38 UTC, the attacker's second address held 197,460 ETH, 2,000 more than in the evening. Binance 14 itself no longer carries any contract code, so the delegation to the attacker's contract has been removed.

Advertisement, for readers in the EU: If you no longer want to keep your coins on Binance after the hack, Bitpanda compares itself with Binance, Kraken, Coinbase and Crypto.com and shows a three-step guide to moving your crypto. Bitpanda is licensed in the EU under MiCA. Other MiCA-licensed alternatives in the EU are Coinbase (licensed via Luxembourg) and OKX (licensed via Malta).

Which EU-licensed exchanges are a Binance alternative, what they charge and how to move your crypto is covered in our guide Binance alternatives: 4 MiCA-licensed exchanges compared.

Binance Hack: What Happened on Thursday Evening

On Thursday evening, 29 October 2026, an unknown attacker emptied one of Binance's largest hot wallets in a single transaction at 20:24 UTC. The wallet “Binance 14” sent 167,464 ETH and 63 different tokens to a freshly created address, including 1.615 billion USDT. Together with two further outflows, the attacker's addresses now hold around $2.8 billion according to Etherscan data. That would be the largest theft in the history of cryptocurrencies, almost twice as much as in the Bybit hack of February 2025.

At 21:24 UTC, Binance said it was urgently investigating reports of a potential security issue. Co-founder Yi He added that user funds are safe. Founder Changpeng Zhao, better known as CZ, had already written on X at 21:15 UTC that it does look like a hack. According to their chief executives, Tether and Circle have frozen around $2.4 billion in stablecoins between them. BNB, the exchange's own token, fell 6.1 percent in the evening.

The case was first flagged by on-chain analyst Spreek. At 20:32 UTC, Spreek pointed out that the transaction came from an address whose starting funds had arrived through the mixer Tornado Cash. Exchanges never pay their transaction fees that way, which made it the first clear warning sign.

Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash

Spreek (@spreekaway) October 29, 2026

All times in this article are UTC. We will update the article as soon as Binance shares further details.

Updated on 29 October 2026 at 23:22 UTC: added the status of withdrawals at Binance. Corrected: at 20:39 UTC the attacker moved 195,460 ETH, not 195,470 ETH.

How Much Money Left Binance in the Hack

The main transaction at 20:24 UTC can be traced in full on Etherscan. It moved 167,464 ETH and 63 tokens from Binance 14 to the address 0x5227…2f8c, which Etherscan now labels “Binance Hot Wallet Exploiter 2”. Two minutes later, 28,005.6 ETH from the wallet Binance 16 followed. At 20:41 UTC came a second strike through the same route: 780 million USDC.

The largest items of the stolen funds, values according to Etherscan at 21:15 UTC.

At 20:39 UTC, the attacker moved almost all of the Ether, 195,460 ETH, on to another address in a single transaction. Nobody can freeze Ether, which makes this part the safest for the attacker.

Whale Alert reported large outflows from Binance wallets to new addresses on other blockchains in the same time window, including 612.7 million USDT on Tron and a combined 16,687 bitcoin in four transfers. Whether these belong to the attack or are Binance moving funds to safety is unclear. Walter Bloomberg reported outflows of $2.77 billion across five blockchains, while The Block cites Arkham data showing around $3.55 billion.

For context: DefiLlama counts around $144 billion in assets in Binance's publicly known wallets. The $2.8 billion amounts to just under 2 percent of that. The exchange's solvency can absorb it. Trust in its security takes a heavy hit, though, because the affected wallet is no side wallet but Binance 14, one of its most used hot wallets with more than 31 million transactions.

How the Binance Hack Unfolded: The Timeline

The trail on the blockchain shows an attack that had been prepared for at least a day. Every step can be viewed publicly on Etherscan.

How the Attacker Took Over the Binance Wallet via EIP-7702

The key to the Binance hack is called EIP-7702. The feature has been live on Ethereum since the Pectra upgrade on 7 May 2025. It allows a regular wallet to hand its control to a smart contract. That is useful because a wallet can then bundle many transfers into one transaction, and exchanges use it to distribute funds efficiently. The handover only takes effect, however, if it is signed with the wallet's private key. That is what the EIP-7702 standard specifies.

The attacker had exactly such a signature. At 20:20:59 UTC, the attacker's address submitted a transaction that tied Binance 14 to the attacker's own contract. Etherscan shows it as “EIP-7702: Binance 14, Delegate to 0x63e842B0…”. Four minutes later, the attacker called that contract, and Binance 14 transferred everything it held. The fee for moving $2.8 billion was $0.93.

Analyst Detective Pho describes that the transaction at 20:20 UTC contained 50 delegations at once, signed with the key of Binance 14, one for each of the next transaction numbers. The attacker thereby protected themselves against a quick revocation. According to developer Alex M., the contract only accepts calls from the address funded through Tornado Cash.

1/4 EIP-7702 can turn the wallet itself into the sweeper. A Binance-labeled wallet moved 167,464 ETH + 63 tokens, including 1.615B USDT, just 3m24s after a signed delegation was installed. This is bad.

odysseas.eth (@odysseas_eth) October 29, 2026

The decisive question remains open: where did the signature come from? Three routes are possible. The private key of the hot wallet could have been stolen. The exchange's signing system could have been manipulated so that it signed a foreign instruction as a genuine one, which is how the Bybit hack worked in 2025. Or someone with access to the systems was involved. Security service Defimon classifies the case as abuse of an EIP-7702 delegation with a compromised key. At first, none of the three scenarios was proven. At 02:23 UTC, Binance named a compromised DevOps engineer's laptop as the likely entry point, through which the attacker reached a service container; the exchange sees no private key leak. That points most strongly to the second scenario: the signature came from the exchange's own infrastructure.

Tether and Circle Freeze $2.4 Billion After the Binance Hack

Around 21:05 UTC, several news services reported the first freezes, and CZ publicly thanked both issuers shortly afterwards. Their chief executives have since published the figures themselves: Circle has frozen more than 800 million USDC in coordination with law enforcement, Tether more than 1.567 billion USDT. Frozen stablecoins can neither be moved nor swapped, so they are worthless to the attacker.

Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone.

Paolo Ardoino (@paoloardoino) October 29, 2026

Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.

Jeremy Allaire (@jerallaire) October 29, 2026

In total, around $2.4 billion is now frozen. Tether and Circle have not broken down whether all frozen amounts sit on Ethereum. The Ether cannot be frozen: the 195,470 ETH, worth a little over $440 million, remain in the attacker's hands. Further stablecoins among the stolen funds come from Ripple (RLUSD, $62.6 million), World Liberty Financial (USD1, $27.8 million) and Ethena (USDe, $9.7 million). No freezes by these issuers have been reported so far.

More on the Binance hack

• Binance hack and North Korea: what is known about TraderTraitor
• On-chain analysis: what the blockchain shows about the hack
• Crypto crash: $628 million liquidated in one hour
• USDT frozen: what Tether and Circle really blocked
• Binance withdrawals: which networks are paused
• How low Bitcoin could fall after the hack
• Ethereum: the hacker sits on 195,000 ETH
• Solana below $100: is $80 next?
• BNB crash: another FTT moment?
• The biggest crypto hacks in history
• How to short Bitcoin in the crash

What Binance and CZ Say About the Hack

Binance made its first official statement at 21:24 UTC, an hour after the outflow:

Our teams are aware of reports of a potential security issue and are actively investigating. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.

Binance (@binance) October 29, 2026

Co-founder Yi He published the same text seven minutes earlier and added “User Funds SAFU”, meaning user funds are safe. The exchange itself does not yet speak of a hack. On the blockchain, Binance 14 itself initiated a batch transfer to the Binance wallet “Hot Wallet 34” at around 21:09 UTC, which was still unconfirmed at 21:15 UTC.

CZ, no longer in charge of Binance since stepping down in November 2023, commented at 21:15 UTC:

User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.

CZ BNB (@cz_binance) October 29, 2026

CZ writes that user funds are safe, that it does look like a hack, and that as a shareholder CZ expects all user funds to be fully covered. At first, that was an expectation, not a commitment from the exchange. At 00:04 UTC, Binance committed through Yi He to cover all hacking losses. Binance set up its SAFU emergency fund in July 2018 for exactly such cases. When around 7,000 bitcoin were stolen from a hot wallet in May 2019, Binance covered the loss in full from this fund.

Not every observer was convinced straight away. Analyst StarPlatinum initially saw the movements as more likely an internal wallet migration. The Tornado Cash funding, Etherscan's “Exploiter” label and the freezes by Tether and Circle all argue against that reading.

Who Is Affected by the Binance Hack

Binance customers: By trading volume, Binance is the largest crypto exchange in the world. According to the exchange's public status interface, withdrawals were open at 23:21 UTC for Bitcoin and Ether, for USDT and USDC via Ethereum, and for USDT via Tron as well. Solana, XRP and the stablecoins USDT and USDC on Solana, Optimism, Avalanche and NEAR were paused, with Binance citing wallet maintenance. At 00:04 UTC, Binance announced that deposits and withdrawals are temporarily suspended; the switches in the interface were unchanged at 01:38 UTC. Our overview of Binance withdrawals after the hack shows the status for each network. Binance explicitly warns of scammers exploiting the situation.

BNB and the wider market: At 21:26 UTC, BNB traded at $710.79 according to CoinMarketCap, down 6.1 percent in 24 hours. Bitcoin fell 2.4 percent to $79,409, Ethereum 3.3 percent to $2,287. You can follow all prices live on the CryptoTicker crypto prices page. How the market reacted hour by hour, including $628 million in liquidations within one hour, is shown in our timeline of the crypto crash after the Binance hack.

Token projects: The stolen funds include sizeable holdings of Uniswap, Ethena, Pepe, Chainlink, Aave, Worldcoin and Ondo. If the attacker sells them via decentralised exchanges, it will weigh on these markets. If you hold these tokens, keep an eye on the attacker's address over the coming days.

Stablecoin issuers: Tether and Circle froze funds within an hour and thereby blocked a large part of the stolen funds. Ripple, World Liberty Financial and Ethena are affected with smaller amounts.

Platforms working with Binance: Many trading platforms hedge positions on Binance or hold liquidity there. The platform Variational stated shortly after the news broke that its users' funds on Omni sit in its own smart contracts and are safe. Similar statements from other partners are likely to follow.

The Binance Hack Compared: The Largest Theft in Crypto History

If the amount is confirmed, the Binance hack surpasses every previous case. The record was previously held by Bybit: in February 2025, attackers stole around $1.46 billion there, and the FBI attributed the attack to North Korea. At first, there was no such attribution for the Binance hack. On 30 October, TRM Labs and Chainalysis attributed it to TraderTraitor; Binance has not confirmed this.

The largest thefts from crypto exchanges and bridges. Binance according to Etherscan, the other cases according to the companies affected and investigators.

Binance has been hit before: the BNB Chain Bridge, a service around the Binance token, lost around $570 million in October 2022, and much of it was stopped at the time. The Bybit case, on the other hand, shows how little can be recovered when the loot consists of Ether, because no issuer can freeze it. In the Binance hack, the larger part sat in stablecoins, and that is exactly what blocked a large share of the stolen funds within an hour.

Binance Hack: Three Steps for Customers of the Exchange

Stay calm and avoid rash decisions. Three points will help you now:

• Official channels only: Information on reimbursements will only come through Binance's announcement page and the exchange's verified accounts. After every major hack, fake support messages and supposed compensation forms appear. Never enter your login details or your recovery phrase there.
• Check your balance yourself: Only log in through the official app or the Binance website by typing the address yourself, never via links in emails or messages. There you can see your balance and the status of your withdrawals.
• Consider self-custody: What you are not actively trading does not need to sit on an exchange. With a hardware wallet, you hold the keys yourself. Our hardware wallet comparison shows which devices are suitable.

You can read how the exchange performs on fees, licensing and security in our Binance review. This article is not investment advice.