Suspected Binance Hack Drains Over $5 Billion From Hot Wallets as Tether and Circle Freeze Funds

A suspected Binance hack drained more than $5 billion from the exchange's hot wallets in under an hour on Thursday, October 29, in what on-chain analysts are calling the largest theft in crypto history. Decrypt's on-chain tally puts the outflows at at least $5.57 billion across Ethereum, Bitcoin and Tron. Kairos Research counts about $5.0 billion. If Binance confirms a hack, it would be more than three times the roughly $1.5 billion taken from Bybit in February 2025.

Binance has not called it a hack. Its latest statement, at 5:29 PM ET, said "user funds are completely safe." Co-founder Changpeng Zhao, who no longer runs the exchange, was blunter: "It does look like a hack on Binance," he posted, adding that as a shareholder he expects "all user funds will be fully covered."

Figures below are as of about 6 PM ET and are still moving.

How the Binance Hot Wallets Were Drained

All times are Eastern (UTC−4), drawn from on-chain data compiled by Kairos Research, Decrypt and Unchained.

• 4:20 PM: An outside wallet installed an EIP-7702 delegation on the Ethereum hot wallet Etherscan labels "Binance 14" (0x28c6…1d60), pointing it at a contract the same outsider had deployed earlier that day. Unchained reports that the outsider was funded in part through Tornado Cash's 0.1 ETH pool.
• 4:20 PM: In the same minutes, 18,270 BTC (about $1.44 billion) left a Bitcoin hot wallet and was split into round 1,000 BTC pieces; 17,270 BTC of it now sits in 17 new wallets. AnchorWatch CEO Rob Hamilton noted that the address, bc1qm34l…77s3h, is one Binance itself lists as a hot wallet in its "Ensuring transparency" post. Its balance history on mempool.space, pictured above, shows the drop.
• 4:22 PM: 612.7 million USDT moved out on Tron.
• 4:24 PM: Three minutes and 24 seconds after the delegation, a single Ethereum transaction swept 167,464 ETH plus 63 tokens, including 1.615 billion USDT, to a brand-new address, according to Odysseas Lamtzidi of Phylax Systems. In the same minute a second hot wallet, "Binance 16," sent 28,006 ETH to the same address, signed with its own key.
• 4:41 to 4:59 PM: Calls through Binance 14 pulled 823 million USDC, including 780 million from a smart wallet it controls and 43 million from "Hot Wallet 34."
• 5:01 and 5:04 PM: Tether blacklisted the main receiving address, then Circle froze the 823 million USDC sitting in it.
• 5:44 PM: The attacker swept Binance 14 again, moving about 200 million more USDT, straight into the already frozen address. Unchained reports the wallet was still delegated at 5:48 PM.

Watcher.Guru's asset tally of $5.6 billion breaks the haul down as $1.57 billion in USDT, $1.45 billion in BTC, $875 million in ETH, $823 million in USDC, $234 million in TRX, $88.5 million in RLUSD, $75 million in WBETH, $50 million in XAUT, and $447.5 million in other tokens. Blockaid also tracked smaller outflows on Arbitrum and Avalanche.

What Has Been Frozen, and What Can Still Move

Stablecoin issuers moved fast. Tether froze 975.1 million USDT in the main receiving wallet, and Circle froze 823 million USDC there at 5:04 PM ET, about $1.8 billion combined. Circle CEO Jeremy Allaire said the freeze was done "in coordination with law enforcement." Tether CEO Paolo Ardoino later said Tether had frozen more than 1.567 billion USDT across addresses tied to the incident, and Kairos counts about $2.1 billion frozen in total, including 313 million USDT on Tron.

The attacker got part of the stablecoins out first. Before Tether's blacklist landed, 700 million USDT went to two downstream wallets, and much of it was swapped into ETH, which no issuer can freeze. On-chain records also show the attacker approving Aave, and an Arkham entity page tracking 19 linked addresses showed about $60 million in Aave's USDT deposit token.

As of Kairos's 5:12 PM snapshot:

• About $718 million in ETH and about $500 million in USDT were still free to move.
• 17,270 BTC (about $1.37 billion) sat untouched in the 17 new Bitcoin wallets.
• Nothing had been sent to Tornado Cash.

Why This Doesn't Look Like an EIP-7702 Bug

EIP-7702, part of Ethereum's Pectra upgrade, lets an ordinary wallet run a smart contract's code. Phishing kits already abuse it by tricking people into signing a delegation. As Lamtzidi put it, "the delegation persists; that code can authorize later transfers without another signature from the wallet," which is why Binance 14 could be swept a second time more than an hour later.

But a delegation has to be signed with the wallet's own private key. And the rest of the outflows point the same way. Binance 16's ETH transfer was signed by its own key. Bitcoin and Tron don't support EIP-7702 at all, yet 18,270 BTC and 612.7 million USDT left Binance wallets on those chains within the same few minutes.

The pattern fits an attacker with control of Binance's signing keys or signing systems across three blockchains, with the 7702 delegation simply the tool used to empty one Ethereum wallet in a single transaction. How the attacker got that access is unknown, and Binance has not said.

There is no attribution yet. North Korea was blamed for Bybit and is suspected in Bitget's $387 million hot-wallet drain in September, where stablecoin issuers also froze funds but most of the rest was swapped into ETH. Nobody has linked Thursday's outflows to any group.

Binance and CZ Respond

Binance's first post on X, at 5:16 PM ET, said it was aware of a "potential security issue and is actively investigating" and had "not confirmed any impact to user funds." Thirteen minutes later it said user funds were "completely safe." As of publication, Binance has not announced a withdrawal pause, the step Bitget took after its own hot-wallet breach, or said whether it will draw on its SAFU emergency fund.

Zhao thanked Tether and Circle for "the quick freeze" in his post. Binance has covered a hack before: in 2019 it repaid users from SAFU after attackers took 7,000 BTC, then worth about $40 million. This incident is more than 100 times that size in dollar terms.

Market Reaction

BNB fell about 7% to roughly $699, and Bitcoin slipped below $79,000, down about 2.6% on the day, according to Decrypt. Monero rose about 6%.

For scale: crypto hacks had caused about $2.35 billion in losses across all of 2026 before Thursday. These outflows are more than twice that.

What Binance Users Should Do Now

Binance says user balances are not affected. Customers' balances live on Binance's internal ledger rather than in specific wallets, so a hot-wallet loss falls on the exchange first, and Binance's reserves and SAFU fund are what stand behind CZ's expectation that users will be made whole. Until Binance confirms what happened, rely only on its official channels. Large incidents like this reliably bring fake "refund" and "wallet verification" links, and no legitimate fix requires you to sign a transaction or share a seed phrase.