By 
On the evening of 29 October 2026, billions of dollars in crypto left wallets labeled as Binance hot wallets in under an hour. On-chain trackers put the total between $2.5 billion and $5.8 billion. Binance paused withdrawals on several networks and says user funds are safe. Its founder Changpeng Zhao went further and wrote that it “does look like a hack on Binance”.
If the numbers hold, this is the largest crypto theft on record. The previous one was Bybit, which lost about $1.5 billion in February 2025 in an attack the FBI tied to North Korea.
Update, 1 November 2026: the FBI has named North Korea’s TraderTraitor group, Binance has linked the attack to a compromised DevOps laptop, and withdrawals have reopened. What is confirmed, and what is rumour, is in our follow-up: Who hacked Binance?
This is a developing story. Last checked at 23:00 UTC on 29 October 2026. Binance has not confirmed a hack, a loss figure or a cause. Every number below is attributed to whoever published it.
The short version
| What moved | ETH, BTC, USDT, USDC and 60+ other tokens from Binance-labeled hot wallets on Ethereum, Bitcoin and Tron |
|---|---|
| How much | At least $2 billion. Most trackers say $5.6 to $5.8 billion |
| Frozen so far | About $2.4 billion in USDT and USDC, plus smaller freezes by Ripple and World Liberty Financial |
| Binance says | “User funds are completely safe”. Still investigating |
| Withdrawals | Paused on some networks, open on others |
| Who did it | Unknown. Nobody has attributed the attack yet |
What happened, minute by minute
The timeline below is pieced together from Etherscan data reported by BeInCrypto and Decrypt, and from a breakdown by Odysseas Lamtzidi of the security firm Phylax, summarised by Koin Bülteni. All times are UTC.
| Time | What the chain shows |
|---|---|
| 28 and 29 Oct | A fresh wallet receives three deposits of about 0.1 ETH, all through the mixer Tornado Cash. This wallet later starts the transfers. |
| 20:20:59 | A signed EIP-7702 delegation is attached to a Binance-labeled hot wallet. In plain terms, the wallet now runs code chosen by someone else. |
| 20:24:23 | That code calls a sweep() function. One transaction moves 167,464 ETH and 63 tokens, including 1.615 billion USDT, from the wallet known as Binance 14 to a brand new address. |
| 24 seconds later | A second wallet, Binance 16, sends another 28,005 ETH to the same address. |
| Within 15 minutes | The receiving address forwards 195,460 ETH, about $450 million, to another fresh address. |
| 20:41:23 | The hijacked wallet uses its owner rights over a separate smart wallet to pull out 780 million USDC. |
| 21:04 | Tether freezes 975.1 million USDT and Circle freezes 823 million USDC sitting in the main receiving address. |
| Around 22:45 | Binance says on X that withdrawals “will resume as soon as the security issue is fully resolved”. |
How much was actually taken
Nobody agrees yet, and the reasons are boring but important. Some trackers count every coin that left. Others count what the attacker’s addresses hold now. Neither number subtracts what has been frozen.
- TechCrunch: at least $2 billion drained, with estimates above $5.7 billion that are not confirmed.
- Decrypt: at least $5.57 billion. That is $3.51 billion on Ethereum, $1.44 billion in Bitcoin (18,270 BTC) and $630 million on Tron.
- On-chain totals cited by PANews at 21:22 UTC: $5.643 billion, including $38 million on Arbitrum, Optimism and Base.
- BleepingComputer: Arkham groups 55 addresses under one entity holding about $5.78 billion. That figure is holdings, not confirmed theft.
Frozen stablecoins cannot move, so the real loss will be lower than any of these totals. How much lower depends on the next figure.
Who froze what
This part went faster than in any past exchange hack. USDT and USDC issuers can blacklist an address, and both did it within the first hour.
- Tether. CEO Paolo Ardoino says more than 1.567 billion USDT linked to the incident is frozen. Zhao called it a “life saver”.
- Circle. CEO Jeremy Allaire says Circle froze more than 800 million USDC “in coordination with law enforcement”. Whale Alert logged an address holding about 823 million USDC being frozen.
- Ripple. Binance co-founder Yi He thanked Ripple for freezing about $200 million in related assets. She did not say which token.
- World Liberty Financial. Yi He says it froze $27 million in USD1 and 48 million WLFI, about $2 million.
The attacker saw it coming. According to CoinDesk, the exploiter put stolen USDT up as collateral on the lending protocol Aave and borrowed 20,000 WETH, about $44 million, before the freeze could catch it. Bitcoin, ETH and Tron coins have no issuer that can freeze them.
How the attacker got in
The short answer: nobody knows yet. Here is what the chain shows.
EIP-7702 is an Ethereum feature that went live in 2025. It lets a normal wallet borrow the code of a smart contract. That is useful for things like paying gas in another token. It is also dangerous, because the delegation stays in place until it is replaced.
“7702 lets a normal wallet execute delegated code. The delegation persists; that code can authorize later transfers without another signature from the wallet.”
Odysseas Lamtzidi, Phylax Systems, on X
So one valid signature was enough. After that the attacker did not need the key again. Lamtzidi says the code had the Tornado-funded operator address hard-coded, and calls from other addresses were rejected. He also says either a stolen private key or a malicious authorization signed by the wallet owner would explain it. Which one it was is the question Binance has to answer.
Two details make routine wallet maintenance unlikely. An exchange has no reason to start a transfer from a wallet funded through a mixer. And the receiving address split the funds onward at once, the way stolen funds usually move.
What Binance and its founder said
Binance’s first statement was careful. It said it was “aware of reports of a potential security issue” and had “not confirmed any impact to user funds”. A few minutes later it replaced that line with “user funds are completely safe”, as reported by TechCrunch.
Spokesperson Ross O’Leary told TechCrunch that Binance “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure”. A later post blamed some failed withdrawals on “a technical error”.
“Does look like a hack on Binance.”
Changpeng Zhao, on X. He added that he no longer runs Binance.com but, as a shareholder, expects all user funds to be fully covered.
Binance.US says it runs separately and was not affected.
Binance has not said whether it will use SAFU, its emergency fund. Binance set it up in 2018 and pays 10% of trading fees into it. It was used in May 2019, when hackers took 7,000 BTC, then about $40 million, from Binance hot wallets. Users did not lose anything that time. This loss could be more than a hundred times larger.
Can you withdraw from Binance right now?
Partly. CryptoTicker read Binance’s own network status at 22:32 UTC:
| Status | Networks |
|---|---|
| Open | BTC on Bitcoin. ETH on Ethereum, Arbitrum, Base and BSC. USDT on Ethereum, Tron, BSC and Arbitrum. USDC on Ethereum, BSC, Arbitrum and Base. BNB. SOL and XRP on BSC |
| Paused | SOL on Solana. XRP on XRP Ledger. USDT and USDC on Solana, Optimism, Avalanche and NEAR. USDT on Polygon. ETH on Optimism |
This changes by the hour. Check the withdrawal page inside the Binance app, not a link someone sent you.
The market
Per Decrypt, Bitcoin fell below $79,000 and BNB dropped about 7%. Monero, a privacy coin, rose about 6%. CryptoTicker reports Solana slipped below $100.
If you play at crypto casinos
A lot of players deposit at a casino straight from Binance and cash out straight back to it. Tonight that route has gaps. A few practical points from the clinic:
- Do not cash out to a paused network. If Binance has paused USDT on Solana, a casino payout sent there may sit in limbo. Pick a network that is open, or a wallet you control.
- A casino is not Binance. A casino pays from its own wallets. “Binance is down” is not a reason for a casino to hold your withdrawal. If one tells you that, ask it to pay on another network.
- Stablecoins can be frozen. Tether and Circle just showed how fast they can freeze an address. That protects victims here, but it works the same way on any USDT or USDC you hold.
- Expect scams. Fake “Binance refund” messages and “compensation bonuses” will follow. Binance asks users not to trust unofficial links, messages or requests for account details. We say the same.
Payout speed is the main thing we test. In our BC.Game examination, a $2,100 USDT withdrawal reached our wallet in five minutes. The full payout test is in how we examine, and every timed cash-out is in the lab. If a casino stalls your withdrawal and blames tonight’s events, tell us. If a frozen balance has you chasing losses, read our responsible gambling page first.
What to watch next
- An official loss figure and a root cause from Binance.
- Whether SAFU covers the loss, and whether every user balance stays whole.
- How much of the frozen $2.4 billion goes back to Binance.
- Whether anyone, including the FBI, attributes the attack.
We will update this page when Binance publishes verified information.
FAQ
Q01Was Binance hacked?
Binance has not confirmed a hack. It calls it a potential security issue and says user funds are safe. Its founder Changpeng Zhao wrote on X that it “does look like a hack on Binance”, and on-chain data shows billions leaving Binance-labeled hot wallets on 29 October 2026.
Q02How much money was stolen from Binance?
Estimates range from at least $2 billion to about $5.8 billion. Decrypt counts $5.57 billion across Ethereum, Bitcoin and Tron. About $2.4 billion in USDT and USDC has been frozen, so the real loss will be lower. Binance has not published its own figure.
Q03Are Binance user funds safe?
Binance says user funds are completely safe, and Zhao says he expects them to be fully covered. Binance has not said whether it will use SAFU, its emergency fund, which covered a 7,000 BTC hot wallet loss in 2019.
Q04Are Binance withdrawals working?
Partly. At 22:32 UTC on 29 October, withdrawals were open for BTC, ETH and USDT on the main networks, and paused for SOL, XRP on XRP Ledger and several USDT and USDC networks such as Solana and Polygon. Check the status inside the Binance app.
Q05How did the hackers get into Binance wallets?
It is not known yet. On-chain analysis shows a signed EIP-7702 delegation was attached to a Binance hot wallet about three minutes before the funds were swept. How the attacker got that signature is the open question.
Q06Should I withdraw from a crypto casino to Binance now?
Only on a network Binance shows as open, or send it to a wallet you control instead. A casino pays from its own wallets, so the Binance incident is not a reason for a casino to delay your payout.
