Inside the $5.8B Binance Hack: What’s Confirmed and What Isn’t

The occupation began with a fewer lines of codification and a wallet holding an bonzer magnitude of money. On Thursday, Oct. 29, 2026, cryptocurrency began pouring retired of Binance-linked addresses, with 1 Ethereum transaction reportedly sweeping distant astir 167,464 ETH, 1.615 cardinal USDT and dozens of different tokens. Within 40 minutes, 1 receiving code had collected an estimated $3.52 billion.

Then the communicative took different turn. Analysts identified further movements involving bitcoin, Tron and different networks, pushing immoderate estimates beyond $5.5 billion. Stablecoin companies raced to frost the proceeds, Binance stopped withdrawals, and laminitis Changpeng Zhao acknowledged that the enactment looked similar a hack. The speech itself has yet to corroborate a completed theft oregon its fiscal toll.

Binance’s Wallet Mystery Grows Into a Multibillion-Dollar Emergency

The archetypal large Ethereum movements began astir 4:24 p.m. Eastern time, when assets from a wallet identified arsenic Binance 14 landed successful a recently created address. The transportation included much than 60 antithetic tokens, and consequent transactions brought further funds from different Binance-linked wallets. Observers and blockchain researchers quickly raised the alarm. By aboriginal evening, estimates were climbing arsenic investigators followed assets done antithetic addresses and networks.

The figures were thing but tidy. Some onchain tallies placed the suspected outflows astatine $5.57 cardinal crossed Ethereum, Bitcoin and Tron. Glassnode estimated astir $5.3 billion, portion broader assessments approached $5.8 billion. Those numbers are preliminary, and immoderate analysts person cautioned that larger estimates whitethorn see transfers unrelated to the suspected attack. Binance has not published an independently verified nonaccomplishment figure.

Still, the Ethereum transactions unsocial were capable to enactment the manufacture connected notice. Unchained counted astir $3.52 cardinal flowing into 1 receiving code betwixt 4:24 and 5:04 p.m. Eastern time. For comparison, the February 2025 Bybit hack progressive astir $1.5 billion. Even the narrower Ethereum estimates would transcend that amount.

How a Wallet’s Own Signature May Have Opened the Door

The starring method mentation centers connected EIP-7702, an Ethereum diagnostic introduced with the Pectra upgrade successful May 2025. The diagnostic allows an mean cryptocurrency wallet to authorize a astute declaration to execute instructions connected its behalf. It’s utile technology, but that authorization becomes unsafe erstwhile it ends up successful the incorrect hands.

Investigators examining Binance 14 identified a delegation transaction submitted astatine astir 4:20 p.m. Eastern time. According to Blockaid’s analysis, the transaction contained 50 authorizations designed to relationship for antithetic imaginable transaction counters, known arsenic nonces. One matched.

About 3 minutes later, the wallet’s assets were swept into an outer address. Researchers besides identified a declaration deployed earlier that time and an associated code funded done the ETH mixer Tornado Cash, a cryptocurrency privateness protocol.

The important favoritism is that EIP-7702 requires valid authorization. Analysts are examining whether the attacker obtained a backstage key, tricked an authorized signer into approving malicious instructions oregon compromised different portion of Binance’s signing infrastructure. None of those explanations has been established.

Nor does the Ethereum mechanics explicate the reported movements connected Bitcoin and Tron. That leaves investigators with a considerably bigger puzzle than a azygous compromised astute contract.

Ido Ben-Natan, Co-Founder and CEO of Blockaid told Bitcoin.com News that it saw this coming. The firm’s H1 report predicted that a seven-figure exploit would hap successful the 2nd fractional of 2026. “The attacker efficaciously reprogrammed a large Binance Ethereum blistery wallet truthful that a azygous relation could drain it, including immoderate caller wealth deposited into it, and they utilized that entree again much than an hr later,” Blockaid’s CEO explained.

Ben-Natan added:

“The onslaught was planned good successful advance, with the attacker backing the cognition done Tornado Cash and rehearsing the aforesaid takeover connected trial wallets hours before, each of it disposable on-chain. Tether and Circle moved rapidly to frost astir $2.4 billion, and we are continuing to hint the rest.”

Stablecoin Issuers Drop the Hammer connected Billions successful Tokens

While investigators worked done the transaction history, stablecoin issuers began cutting disconnected entree to assets linked to the suspected exploit. Tether CEO Paolo Ardoino reported freezing much than 1.567 cardinal USDT. Circle CEO Jeremy Allaire also confirmed that his institution had frozen much than 800 cardinal USDC successful coordination with instrumentality enforcement.

Binance co-CEO Yi He subsequently credited Ripple with freezing astir $200 million, portion World Liberty Financial co-founder Zach Witkoff reported a abstracted frost involving astir $27 cardinal successful USD1. Taken together, those reported actions correspond astir $2.6 billion, though the figures person not been independently reconciled and should not beryllium treated arsenic a confirmed betterment total.

There’s different catch. Freezing a token isn’t the aforesaid arsenic returning it to its rightful owner. Centralized stablecoin issuers tin artifact transfers from designated addresses. Native assets specified arsenic bitcoin (BTC) and ether don’t person an equivalent issuer-controlled frost mechanism. Meanwhile, analysts observed the suspected relation moving ether betwixt wallets, swapping tokens done decentralized trading infrastructure and borrowing against cryptocurrency collateral.

Aave temporarily froze its Ethereum V3 lending markets arsenic a precaution, portion maintaining that its astute contracts were unaffected. The effect was a contention betwixt investigators trying to place the proceeds and whoever controlled the receiving wallets attempting to determination them. Alongside this, the Arbitrum Security Council has executed an onchain transaction to frost astir $30.5 cardinal successful assets linked to the suspected Binance exploit.

Binance Halts Withdrawals arsenic Zhao Promises Customers Will Be Covered

Binance’s authoritative effect remained cautious adjacent arsenic its laminitis adopted considerably stronger language. The speech acknowledged a imaginable information contented and said its teams were investigating. Later Thursday, it suspended withdrawals portion conducting information checks, promising to reconstruct entree erstwhile the contented was resolved. Binance besides maintained that lawsuit funds were wholly safe.

Zhao, who stepped down arsenic CEO successful 2023, offered a much pointed assessment. “It does look similar a hack connected Binance,” he wrote connected X, portion emphasizing that helium nary longer manages the exchange. As a shareholder, helium said helium expected each lawsuit funds to beryllium covered. In a consequent post, Zhao suggested the nonaccomplishment mightiness beryllium higher than initially reported and indicated Binance would screen it.

That committedness puts the exchange’s fiscal resources squarely successful the spotlight.

“User funds are safe,” Binance’s Co-Founder & Chief Customer Service Officer Yi He wrote astatine 8 p.m. Eastern time. “Binance volition screen each hacking losses. Deposits and withdrawals are temporarily suspended portion our squad conducts information checks, freezes funds, and works with instrumentality enforcement. We volition stock a afloat post-mortem erstwhile the probe is complete. Please trust lone connected authoritative Binance channels for updates.”

Crypto Markets Take a Hit arsenic Investigators Face Unanswered Questions

The suspected incidental arrived during an already difficult trading session.

Bitcoin fell toward $76,000 earlier recovering somewhat, portion ethereum declined astir 4.6% and BNB mislaid astir 7.7%. Coinglass information shows astir $1.4 cardinal successful leveraged positions were liquidated wrong 24 hours, predominantly bullish bets. Not each dollar of those losses tin beryllium attributed to Binance. Bitcoin was already nether unit earlier the suspicious transactions began.

The manufacture nevertheless recovered itself successful a bind. The largest cryptocurrency speech by reported level assets was investigating a imaginable multibillion-dollar breach, customers temporarily couldn’t withdraw, and information researchers were inactive piecing unneurotic what happened. Questions astir the attacker’s individuality besides remained unanswered. Some researchers raised the anticipation of North Korean involvement, but nary authoritative attribution had been established.

For now, investigators indispensable find which transfers were unauthorized, however the indispensable wallet permissions were obtained and whether the assets inactive circulating done outer addresses tin beryllium recovered. Binance indispensable reply different question: When withdrawals resume, volition customers observe that the exchange’s assurances were connected the money?

The reply matters acold beyond Binance. A institution tin committedness to screen a loss, and token issuers tin frost billions, but neither measurement explains however truthful overmuch cryptocurrency seemingly escaped successful the archetypal place.