Binance Hit by Suspected Record Hack: What We Know So Far

Binance, the world's largest crypto exchange, is investigating what may be the biggest theft in crypto history. On the evening of October 29, billions of dollars in crypto left Binance hot wallets in a matter of minutes, and the exchange paused withdrawals on several networks while it investigates.

This is a developing story. Numbers are moving, Binance has not confirmed a final figure or a cause, and early reports disagree. Here is what is known so far, what is not, and what it means if you hold crypto.

What happened

On-chain trackers show the drain started around 20:24 UTC, when one of Binance's largest Ethereum hot wallets sent about 167,000 ETH and dozens of tokens, including more than $1.6 billion in USDT, to a brand new address in a single transaction (Decrypt). More transfers followed over the next hour across several blockchains, including Bitcoin and Tron.

Early tallies of the total range widely, depending on who is counting and how:

• About $5.7 billion held by the attacker's wallets, per Arkham data cited by CoinDesk
• Up to $5.8 billion per Coinbase's Conor Grogan, via The Block
• About $3.3 billion in suspicious outflows per security firm Blockaid, also via The Block

This widely shared breakdown from Watcher.Guru shows the scale of the early estimates:

BREAKING: World's largest crypto exchange Binance hacked with over $5.6 billion stolen

Watcher.Guru (@WatcherGuru) October 29, 2026

If the higher numbers hold, this would be more than three times the roughly $1.5 billion taken from Bybit in February 2025, which was the previous record and was attributed to North Korea's Lazarus Group.

How it may have happened

The clearest clue so far is on-chain. A few minutes before the drain, an address funded through the Tornado Cash mixer set up an EIP-7702 delegation on the Binance hot wallet (Decrypt). EIP-7702 is an Ethereum feature, added in 2025, that lets a regular wallet temporarily hand control of its actions to a smart contract. It is useful for things like batching transactions, but a delegation like this one can let whoever controls that contract move the wallet's funds.

What nobody knows yet is how the attacker got that authorization in the first place. A stolen key, a compromised signing system, a supply chain attack or an insider would all look similar on-chain. No one has publicly attributed the attack to any group.

What Binance and others have said

• Binance said it is "aware of reports of a potential security issue" and is "actively investigating," and that user funds are safe (TechCrunch). A spokesperson said withdrawals were temporarily suspended on multiple networks as a precaution.
• Changpeng Zhao, Binance's founder and largest shareholder, posted that it "does look like a hack" and said he expects all user funds to be fully covered.
• Binance's emergency fund (SAFU) holds roughly $1 billion, which is far smaller than the reported losses. Binance has not said how it would cover a gap (CoinDesk).

Stablecoin issuers moved fast

Within the first hour, the companies behind the biggest stablecoins froze the stolen tokens they could reach:

• Tether froze more than $1.5 billion in USDT, per CEO Paolo Ardoino.
• Circle froze about $823 million in USDC.
• Ripple froze roughly $200 million in its RLUSD stablecoin (Yahoo Finance).

Reported totals vary, but roughly $2 billion of the stolen funds appear to be frozen. That is a big deal. It means a large share of this theft may be recoverable, and it shows how much power centralized stablecoin issuers now have during a crisis.

The attacker went looking for exits

The assets that could not be frozen started moving. Trackers watched the attacker swap tokens on Uniswap and use stolen USDT as collateral on Aave to borrow ETH before it could be frozen (Yahoo Finance). In response, Aave froze its main Ethereum lending markets and Kamino paused its Solana and Bitcoin markets as a precaution. As of early October 30, a large ETH balance was still sitting in attacker-controlled wallets.

Market reaction

Prices dropped but did not crash. Bitcoin slid from just above $80,000 to the high $70,000s, Ether fell a few percent, and BNB took the biggest hit, down roughly 6 to 8%. About $600 million in leveraged positions were liquidated in an hour, mostly longs (CryptoTicker).

Is this connected to other platforms?

Other platforms had a rough day too, but there is no evidence so far that they are connected:

• Polymarket, the prediction market, paused trading earlier on October 29 after an exploit took about $2.65 million. It said a third-party provider was compromised, and it has since resumed trading and plans to reimburse users (The Block).
• Bitget lost about $388 million from its hot and warm wallets in late September, an attack its CEO blamed on North Korea. Bitget covered the losses from its protection fund (BleepingComputer).
• Aave and Kamino paused markets as a precaution because the attacker was using DeFi to cash out. They were not hacked.

What to do if you use Binance or any exchange

• Do not panic sell into the drop. Exchanges have covered past hacks, and much of this theft is already frozen.
• Use only official channels. Binance itself warned users not to trust unofficial links. Scammers will pose as Binance support, "recovery services" and refund portals. Nobody legitimate will ask for your seed phrase or ask you to send crypto to get crypto back.
• Check before you withdraw. Some networks are paused. Look up the current status in the Binance app instead of retrying over and over.
• Rethink how much you keep on any exchange. Exchanges are convenient for trading, but crypto you plan to hold is safer in a wallet you control. The old rule still applies: not your keys, not your coins.

For what it is worth, delegating ADA to a Cardano stake pool like our ULTRA pool never moves your coins off your own wallet, so an exchange hack cannot touch them.

The bigger picture

Two things stand out. First, the attacker reportedly used a newer Ethereum feature, EIP-7702, to take control of a hot wallet. New features bring new attack surface, and even the biggest companies in crypto are still learning where it is. Second, AI developer tools and third-party vendors keep showing up in breach reports, from Warp earlier this week to Polymarket's compromised provider today. Every vendor, tool and integration you add is something an attacker can try.

If your business wants a fresh look at what your systems, tools and vendors can reach, our cybersecurity and compliance team can help.

We will update this post as Binance and investigators share more.

Figures are as reported by the linked sources as of early October 30, 2026 UTC and may change. This post is for information only and is not financial advice.