Key Takeaways
- Binance suspended withdrawals Oct. 29 as analysts tracked up to $5.8 billion in suspicious transfers.
- Tether and Circle reported freezing more than $2.3 billion in tokens linked to the Binance incident.
- Binance has yet to confirm the final losses or when withdrawals will resume following the Oct. 29 incident.
The trouble began with a few lines of code and a wallet holding an extraordinary amount of money. On Thursday, Oct. 29, 2026, cryptocurrency began pouring out of Binance-linked addresses, with one Ethereum transaction reportedly sweeping away roughly 167,464 ETH, 1.615 billion USDT and dozens of other tokens. Within 40 minutes, one receiving address had collected an estimated $3.52 billion.
Then the story took another turn. Analysts identified additional movements involving Bitcoin, Tron and other networks, pushing some estimates beyond $5.5 billion. Stablecoin companies raced to freeze the proceeds, Binance stopped withdrawals, and founder Changpeng Zhao acknowledged that the activity looked like a hack. The exchange itself has yet to confirm a completed theft or its financial toll.
Binance’s Wallet Mystery Grows Into a Multibillion-Dollar Emergency
The first major Ethereum movements began around 4:24 p.m. Eastern time, when assets from a wallet identified as Binance 14 landed in a newly created address. The transfer included more than 60 different tokens, and subsequent transactions brought additional funds from other Binance-linked wallets. Observers and blockchain researchers quickly raised the alarm. By early evening, estimates were climbing as investigators followed assets through different addresses and networks.
The figures were anything but tidy. Some onchain tallies placed the suspected outflows at $5.57 billion across Ethereum, Bitcoin and Tron. Glassnode estimated roughly $5.3 billion, while broader assessments approached $5.8 billion. Those numbers are preliminary, and some analysts have cautioned that larger estimates may include transfers unrelated to the suspected attack. Binance has not published an independently verified loss figure.
Still, the Ethereum transactions alone were enough to put the industry on notice. For comparison, the February 2025 Bybit hack involved approximately $1.5 billion. Even the narrower Ethereum estimates would exceed that amount.
How a Wallet’s Own Signature May Have Opened the Door
The leading technical explanation centers on EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025. The feature allows an ordinary cryptocurrency wallet to authorize a smart contract to execute instructions on its behalf. It’s useful technology, but that authority becomes dangerous when it ends up in the wrong hands.
Investigators examining Binance 14 identified a delegation transaction submitted at approximately 4:20 p.m. Eastern time. According to Blockaid’s analysis, the transaction contained 50 authorizations designed to account for different possible transaction counters, known as nonces. One matched.
About three minutes later, the wallet’s assets were swept into an external address. Researchers also identified a contract deployed earlier that day and an associated address funded through the ETH mixer Tornado Cash, a cryptocurrency privacy protocol.
The important distinction is that EIP-7702 requires valid authorization. Analysts are examining whether the attacker obtained a private key, tricked an authorized signer into approving malicious instructions or compromised another part of Binance’s signing infrastructure. None of those explanations has been established.
Nor does the Ethereum mechanism explain the reported movements on Bitcoin and Tron. That leaves investigators with a considerably bigger puzzle than a single compromised smart contract.
Ido Ben-Natan, Co-Founder and CEO of Blockaid told Bitcoin.com News that it saw this coming. The firm’s H1 report predicted that a seven-figure exploit would occur in the second half of 2026. “The attacker effectively reprogrammed a major Binance Ethereum hot wallet so that a single operator could drain it, including any new money deposited into it, and they used that access again more than an hour later,” Blockaid’s CEO explained.
Ben-Natan added:
“The attack was planned well in advance, with the attacker funding the operation through Tornado Cash and rehearsing the same takeover on test wallets hours before, all of it visible on-chain. Tether and Circle moved quickly to freeze roughly $2.4 billion, and we are continuing to trace the rest.”
Stablecoin Issuers Drop the Hammer on Billions in Tokens
While investigators worked through the transaction history, stablecoin issuers began cutting off access to assets linked to the suspected exploit. Tether CEO Paolo Ardoino reported freezing more than 1.567 billion USDT. Circle CEO Jeremy Allaire also confirmed that his company had frozen more than 800 million USDC in coordination with law enforcement.
Binance co-CEO Yi He subsequently credited Ripple with freezing approximately $200 million, while World Liberty Financial co-founder Zach Witkoff reported a separate freeze involving about $27 million in USD1. Taken together, those reported actions represent approximately $2.6 billion, although the figures have not been independently reconciled and should not be treated as a confirmed recovery total.
There’s another catch. Freezing a token isn’t the same as returning it to its rightful owner. Centralized stablecoin issuers can block transfers from designated addresses. Native assets such as bitcoin (BTC) and ether don’t have an equivalent issuer-controlled freeze mechanism. Meanwhile, analysts observed the suspected operator moving ether between wallets, swapping tokens through decentralized trading infrastructure and borrowing against cryptocurrency collateral.
Aave temporarily froze its Ethereum V3 lending markets as a precaution, while maintaining that its smart contracts were unaffected. The result was a race between investigators trying to identify the proceeds and whoever controlled the receiving wallets attempting to move them. Alongside this, the Arbitrum Security Council has executed an onchain transaction to freeze approximately $30.5 million in assets linked to the suspected Binance exploit.
Binance Halts Withdrawals as Zhao Promises Customers Will Be Covered
Binance’s official response remained cautious even as its founder adopted considerably stronger language. The exchange acknowledged a potential security issue and said its teams were investigating. Later Thursday, it suspended withdrawals while conducting security checks, promising to restore access once the issue was resolved. Binance also maintained that customer funds were completely safe.
Zhao, who stepped down as CEO in 2023, offered a more pointed assessment. “It does look like a hack on Binance,” he wrote on X, while emphasizing that he no longer manages the exchange. As a shareholder, he said he expected all customer funds to be covered. In a subsequent post, Zhao suggested the loss might be higher than initially reported and indicated Binance would cover it.
That promise puts the exchange’s financial resources squarely in the spotlight.
“User funds are safe,” Binance’s co-founder and chief customer service officer Yi He wrote at 8 p.m. Eastern time. “Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates,” the co-founder added.
Crypto Markets Take a Hit as Investigators Face Unanswered Questions
The suspected incident arrived during an already difficult trading session.
Bitcoin fell toward $76,000 before recovering somewhat, while ethereum declined approximately 4.6% and BNB lost nearly 7.7%. Coinglass data shows roughly $1.4 billion in leveraged positions were liquidated within 24 hours, predominantly bullish bets. Not every dollar of those losses can be attributed to Binance. Bitcoin was already under pressure before the suspicious transactions began.
The industry nevertheless found itself in a bind. The largest cryptocurrency exchange by reported platform assets was investigating a potential multibillion-dollar breach, customers temporarily couldn’t withdraw, and security researchers were still piecing together what happened. Questions about the attacker’s identity also remained unanswered. Some researchers raised the possibility of North Korean involvement, but no official attribution had been established.
For now, investigators must determine which transfers were unauthorized, how the necessary wallet permissions were obtained and whether the assets still circulating through external addresses can be recovered. Binance must answer another question: When withdrawals resume, will customers discover that the exchange’s assurances were on the money?
The answer matters far beyond Binance. A company can promise to cover a loss, and token issuers can freeze billions, but neither measure explains how so much cryptocurrency apparently escaped in the first place.
