Binance Hack: What We Know About the Hot Wallet Drain

On Thursday 29 October, Binance paused withdrawals on several networks after billions of dollars in crypto left its hot wallets within minutes. If early estimates hold, it is the largest crypto theft on record, well above the roughly $1.5 billion taken from Bybit in 2025.

This is a developing story. Figures are on-chain estimates unless Binance confirms them. We will update this page as Binance shares more.

What happened

At about 20:21 UTC, one of Binance's main Ethereum hot wallets (labelled "Binance 14" on Etherscan) was pointed at an attacker-controlled smart contract using EIP-7702, an Ethereum feature that lets a normal wallet run contract code. About four minutes later, that contract swept the wallet. Roughly 167,000 ETH, 1.6 billion USDT and dozens of other tokens moved to a new address. Analysts say the contract's deployer was partly funded through Tornado Cash.

An EIP-7702 delegation only works with a valid signature from the wallet's key. That means the attacker either had the key or got Binance's signing systems to sign. Security service Defimon calls it "abuse of an EIP-7702 delegation with a compromised key." Binance has not confirmed how the attack happened.

How much was taken

Estimates range from about $2 billion to more than $5.7 billion:

• Blockaid is investigating about $3.3 billion in suspicious outflows on Ethereum, Arbitrum and Avalanche.
• Arkham data shows more than $5.7 billion in the attacker's wallet. Some researchers think that figure is too high.

Binance has not confirmed a number. Before the incident it held about $144 billion in assets, according to DefiLlama.

What Binance has said

Binance says it is investigating and that "user funds are completely safe." It says withdrawals will resume "as soon as the security issue is fully resolved." It has not yet used the word "hack."

Founder Changpeng Zhao, who no longer runs the company, said it "does look like a hack." He said the loss "might be a bit higher" than early estimates and that Binance "will cover" it. Binance has not said whether it will draw on its Secure Asset Fund for Users (SAFU).

The freeze

Stablecoin issuers moved within the hour:

• Tether froze more than 1.567 billion USDT.
• Circle froze more than $800 million in USDC "in coordination with law enforcement."

Together that is about $2.4 billion that can no longer move. On-chain data also shows Aave froze lending markets after the attacker started borrowing against stolen USDT.

Market reaction

On Thursday evening, Bitcoin fell about 3% to around $79,000, Ether fell about 4%, and BNB fell about 6.7% to around $705.

What this means if you hold crypto

At Gaming SZN, every payment and token launch is signed in your own wallet. Our servers never hold keys that move your funds.

Sources

• The Block: Binance investigating hack as suspicious outflows reach up to $5.8 billion
• CoinDesk: Potential multi-billion Binance hack hitting crypto markets
• TechCrunch: Binance pauses withdrawals as hackers suspected of stealing billions
• Gizmodo: Binance investigating possibly massive hack
• On-chain data via Etherscan and Arkham.