Binance’s hot-wallet breach: what we know

Binance, the exchange that describes itself as the world’s largest cryptocurrency exchange, spent Thursday night in crisis mode after on-chain data cited by BleepingComputer showed billions of dollars in assets leaving its hot wallets. Binance said it suspended deposits and withdrawals, and CNBC reported that crypto firms including Tether and Circle had frozen about $2.54 billion combined and that Bitcoin fell below $78,000 as traders tried to work out whether customer funds were intact.

The incident is still developing. Binance has acknowledged a security incident, said it estimates the total impact at around $6.3 billion, and pledged to cover losses, but it has not published a final audited loss figure or a full technical post-mortem, and its account of how the attacker got control is preliminary. Several on-chain estimates are circulating, and they measure different things: assets that left a wallet, assets held in addresses linked to the attacker, and assets that were frozen before they could move. Treat any single headline number as provisional.

This explainer separates what is confirmed from what is still reported or estimated. Reported facts are attributed to their sources; judgments about what those facts mean are analysis. It also explains the technical detail that has drawn the most attention: the EIP-7702 authorizations that on-chain analysts say turned a Binance hot wallet into a contract controlled by the attacker.

What happened

The first major transfer came at around 20:24 UTC on Thursday, October 29, according to blockchain analysis shared on X by crypto journalist StarPlatinum and reported by BleepingComputer. StarPlatinum’s analysis says Binance 14, one of the exchange’s busiest Ethereum hot wallets, transferred about $2.53 billion across 64 tokens; a second Binance wallet followed with about $174.4 million 24 seconds later; and a later update said a third moved another 780 million USDC to the same Ethereum address, bringing the reported total to about $3.48 billion.

That was not the end of the movement. Arkham Intelligence’s tracker labeled 55 addresses as “binance-hacker-1029” and showed combined holdings of about $5.78 billion, including roughly $1.77 billion in USDT, $1.44 billion in Bitcoin, $876 million in Ethereum, and $823 million in USDC. That figure is the value of assets held across the tracked wallets, not a confirmed statement that all of it was stolen from Binance.

Binance’s initial public response was cautious. A spokesperson told TechCrunch and BleepingComputer that the exchange was “aware of reports of a potential security issue” and was “actively investigating,” while insisting that user funds were “completely safe.” Binance said it suspended deposits and withdrawals on multiple networks as a precaution. By early Friday, Binance co-founder Yi He had put it more directly: “User funds are safe. Binance will cover all hacking losses.”

The timing matters. According to Polymarket’s statement and on-chain timelines, the Binance drain came hours after a separate attack on Polymarket’s international exchange. Polymarket said a compromised third-party provider was involved, and Bitquery’s on-chain estimate put user losses at about $2.7 million. There is no public evidence that the two incidents are connected. They do, however, arrive in the same week and reinforce the same uncomfortable point: the attack surface of a crypto platform extends well beyond its smart contracts.

What Binance says

Binance’s public position has two layers. The customer-facing one is unchanged: Binance says user funds are safe, the exchange will cover all losses, and deposits and withdrawals are suspended while it runs security checks and works with law enforcement. The forensic one is newer. In a written Security Incident Update on October 30, Binance said its initial investigation suggests a compromised DevOps engineer’s laptop allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. It said it found no evidence of a wallet private key leak. It estimated the total impact at around $6.3 billion and said about $3 billion had been frozen on-chain so far. It said it will cover all losses from its SAFU fund and company funds, and will publish an updated Proof of Reserves after remediation. It also said it had revoked the affected address authorization and engaged law enforcement and blockchain intelligence partners. Binance said a detailed technical post-mortem is still to come.

Those statements answer the customer-facing question, but they do not answer the forensic ones. “User funds are safe” means Binance’s balance sheet is standing behind customer balances; it does not mean no customer-backed assets moved. CoinDesk reported that Binance 14 appears in Binance’s October proof-of-reserves, which would mean the drained crypto was part of the assets backing customer balances. That makes the exchange’s pledge to cover losses material, not cosmetic.

Binance says it will cover the gap from its SAFU fund and company capital. That is a corporate commitment, not a government guarantee. Users should watch the post-mortem for how the exchange accounts for the gap, whether it uses its own reserves or emergency funding, and whether withdrawals reopen for all networks at once. Until then, the difference between “customer funds are safe” and “customers can withdraw right now” is the practical question.

The EIP-7702 authorization angle

The most important technical clue comes from on-chain analysts, not from Binance. Ethereum’s EIP-7702 specification lets an ordinary externally owned account delegate its code to a smart contract. The wallet signs an authorization, and that authorization is valid only for a specific nonce, a counter that tracks the account’s transactions.

Blockaid reported that the attacker did not know Binance 14’s live nonce. Its reconstruction says the attacker included 50 EIP-7702 authorizations in a single type-4 transaction, each carrying a valid delegation for the hot wallet, and only one matched the nonce that was current when the transaction was included. According to Blockaid, that one authorization pointed the wallet at a contract controlled by the attacker, which then moved the assets.

808bits reached a similar conclusion: 50 EIP-7702 delegations were issued for Binance 14 about three minutes before the drain, and each one handed the wallet’s code to a contract deployed for the attack. Etherscan’s authorization list for the wallet shows the batch. The exact path from the attacker’s access to the signing system to those authorizations is still being investigated, but the evidence points to an authorization and signing-system failure, not a flaw in Ethereum’s core protocol. EIP-7702 made that failure unusually powerful.

That distinction matters for every exchange, not just Binance. EIP-7702 is designed to make wallets more programmable. It also means a single valid signature can give a contract broad control over a wallet. If an exchange’s hot wallet signs delegations in an automated system, the nonce, the signing authority, and the contract being delegated to all become high-value security boundaries. The old model of “protect the private key” is necessary but no longer sufficient; the signing pipeline itself is a target.

The stablecoin freezes

Tether and Circle moved within hours, according to statements from their CEOs. Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT associated with the incident. Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC. CNBC reported that several firms, including Tether and Circle, had frozen a combined $2.54 billion; Ripple helped prevent another $200 million, according to Yi He. Binance’s later Security Incident Update said about $3 billion had been frozen on-chain so far. The different totals reflect cut-off times and which firms are counted.

The freezes are the main reason the final loss may be smaller than the headline outflow. They are also a reminder that stablecoin issuers are now de facto incident responders. A centralized stablecoin can be frozen at the issuer level; Bitcoin and Ether cannot. Arkham’s tracker shows the attacker’s holdings are therefore a mix of recoverable and unrecoverable assets, and the split will change as investigators and issuers trace the flows.

Freezing funds is not the same as returning them. It prevents movement while ownership is established, but it can take legal process, and it can leave legitimate users caught in the middle if their addresses are mistakenly linked. The next phase of this incident will be as much about claims and coordination as about blockchain analysis.

Fact check: the Aave claim

Posts on X claimed the attacker deposited stolen USDT into Aave, borrowed ETH against it, and walked away, leaving Aave with frozen collateral and a loan that might never be repaid. Aave’s account confirms the borrow, but not the conclusion.

According to Aave’s incident response, a wallet in the exploiter’s cluster supplied 60 million USDT to Aave V3 Ethereum Core between 20:58 and 21:01 UTC and borrowed 19,762 WETH, worth about $44.6 million at the time. That was about 40 minutes before Aave’s first market freeze at 21:42 UTC, not seconds before it. No exploiter wallet has interacted with Aave since 21:01.

Aave’s data shows the position held $59.9 million of USDT collateral against $43.8 million of debt, so it was overcollateralized. Aave says the position remains subject to normal liquidation and does not put suppliers at risk. Aave says it froze new supply and borrow positions across its markets as a precaution, but users could still repay and withdraw, and liquidations kept running.

The thread is right about one narrow point: Tether can freeze USDT, and it cannot freeze ETH that has already been borrowed. It is wrong to jump from that to “Aave is stuck with bad debt” or “the hacker gets a free loan.” Aave’s account says the collateral is still in the position, and the debt still accrues under the protocol’s liquidation rules. Whether Aave recovers the full value depends on collateral prices and liquidation execution, not on the attacker simply walking away. The viral version compresses a real DeFi risk into a conclusion the protocol’s own data does not support.

Market reaction

CNBC reported that the market reaction was immediate and broad. Bitcoin fell over 4% to about $77,995 on Friday, extending losses after breaking below $80,000; Ether dropped about 4.8% to $2,247; and Binance’s BNB token fell about 7.7% to $694. The same report noted that Hyperliquid’s HYPE token rose, a reminder that capital often rotates within crypto rather than leaving it entirely.

Some of that move is mechanical: traders reduce exposure to exchange-linked assets when withdrawals are paused, and market makers widen spreads when a major venue is in an uncertain state. Some of it is confidence. The question is not whether Binance can cover the loss, but whether customers can get their assets when they want them. A temporary withdrawal pause is a liquidity and operational event even when the balance sheet is solvent.

What is still unknown

Four questions remain open. First, what was the final audited loss? Binance estimates the total impact at around $6.3 billion and says about $3 billion has been frozen, but the final net figure is not settled. Second, how did the compromise lead to signing authority? Binance’s preliminary account points to a DevOps laptop and a service container, but the technical chain from that access to the wallet authorizations is not public. Third, who is responsible? No attribution has been confirmed. Fourth, what does the post-mortem show about Binance’s key management and withdrawal controls?

There is also a transparency question. As of publication, Binance has not published an address list, a reconciliation, or a timeline with transaction hashes. Public trackers such as Arkham and Etherscan have done much of the tracing. That is useful, but it is not a substitute for the exchange’s own accounting. The proof-of-reserves snapshot is a starting point, not a real-time guarantee.

What users should do

If you have funds on Binance, the practical advice is unglamorous. Use only official Binance channels and the status page; do not trust direct messages, “recovery” offers, or links posted in replies. Assume withdrawal delays until Binance says otherwise. Do not move funds to an address someone sends you in a chat. If you are trading, remember that a paused withdrawal queue can distort prices and funding rates.

For the longer term, the incident is a reason to revisit exchange concentration. Keeping trading balances on an exchange is a counterparty decision, not a storage decision. Diversifying across custodians and keeping long-term holdings in self-custody reduces exposure to any single exchange’s operational failure, though it introduces key-management risk of its own. There is no free lunch; there is only a choice of which risk you are equipped to manage.

This is not financial advice, and it is not a prediction that Binance will fail to cover the loss. It is a reminder that “user funds are safe” and “your funds are available now” are different claims. The gap between them is where panic and scams thrive.

The wider lesson

The Binance incident is a case study in how crypto security has moved. The old story was a smart contract bug or a phishing site. The new story is a combination of key management, transaction authorization, and operational concentration. A hot wallet is not just a wallet; it is a signing service with automated rules, and every rule is a potential attack path.

The stablecoin freezes show that centralized issuers can act faster than courts in the first hours of an incident. That is a real capability, and it is also a concentration risk: the same issuers that can freeze an attacker’s USDT can freeze someone else’s. The EIP-7702 angle shows that protocol upgrades can expand what a single signature can do. The withdrawal pause shows that liquidity and solvency are separate questions.

The next useful disclosure will be Binance’s post-mortem. It should explain how the key or signing authority was obtained, which controls failed, how much was frozen versus lost, and what changes are being made. Until that arrives, the responsible conclusion is narrow: on-chain trackers show a very large amount of crypto moved from wallets that CoinDesk reported are part of Binance’s reserves; Binance says it will cover the loss; and Binance’s own $6.3 billion impact estimate is still provisional.

Sources and references

• TechCrunch, Binance pauses withdrawals as hackers suspected of stealing billions in crypto, October 29, 2026.
• BleepingComputer, Binance probes potential $5.8 billion crypto-theft hack, October 29, 2026.
• CNBC, Bitcoin tumbles below $78,000 as Binance security scare rattles crypto markets, October 30, 2026.
• Binance, Security Incident Update, October 30, 2026; Binance, official statement on covering losses and suspending deposits/withdrawals; Yi He, statement.
• Blockaid, analysis of the Binance 14 drain; 808bits, the 50 EIP-7702 delegations.
• Aave/LlamaRisk, Binance Hot Wallet Exploit: Aave’s Response, October 30, 2026; Aave, statement on the freeze and overcollateralized positions.
• Ethereum, EIP-7702: Set EOA account code.
• CoinDesk, Binance hack drained wallets backing customer assets, reserve data shows, October 30, 2026.
• Bitquery, Polymarket hack investigation, October 2026.