Bulletin ISB-2026-10-30-01. Status: ongoing, under investigation. Severity: critical. Last updated 01:15 UTC on 30 October 2026. This bulletin covers a live incident; figures are moving and each is attributed below.
On 29 October 2026, between roughly 20:20 and 20:41 UTC, wallets labelled as belonging to Binance moved an estimated $5.5 billion to $5.9 billion in crypto assets to attacker-controlled addresses across Ethereum, Bitcoin and Tron [2][3][4]. Binance has confirmed it is investigating a security issue, suspended deposits and withdrawals, and says user funds are safe. Its co-CEO has said the exchange will cover all hacking losses [3].
A plain-language FAQ near the end of this bulletin explains nonces, signatures, delegations and stablecoin freezes for readers who do not work with crypto daily.
If the figure holds, this is the largest crypto theft on record, roughly three and a half times the $1.5 billion Bybit theft of February 2025 [4]. Tether and Circle have frozen billions in stablecoins tied to the incident, which is the main reason the recoverable share may be materially higher than in previous exchange breaches [3][4][5].
Figure 1. The sequence on-chain analysts reconstructed. The signature that authorised the delegation is the unresolved question.
Summary for decision makers
- What happened: multiple Binance hot wallets were drained in a short window, starting with a 167,464 ETH transaction from the wallet labelled Binance 14 at 20:24 UTC [2][7].
- How, as far as is public: on-chain analysts assess that the attacker installed an EIP-7702 delegation on the hot wallet four minutes before the drain, pointing the wallet’s code at an attacker-controlled contract, then called it to sweep the balance [7].
- How much: estimates range from $5.5 billion to $5.9 billion depending on the firm and the snapshot. Binance has not published a figure [2][3][4].
- What is frozen: Tether reports over $1.567 billion of USDT frozen; Circle reports over $800 million of USDC frozen in coordination with law enforcement, which CNBC totals at $2.54 billion across firms [3][5][6].
- Status: deposits and withdrawals are suspended, Binance promises a full post-mortem, and no official attribution has been made. Two private firms have assessed North Korea as likely behind it [3].
Confirmed, claimed and unconfirmed
| Item | Status | Detail |
|---|---|---|
| Binance is investigating a security incident | Confirmed | Binance publicly stated it is aware of reports of a potential security issue and is actively investigating [1][2][4] |
| Deposits and withdrawals suspended | Confirmed by Binance | Co-CEO Yi He said deposits and withdrawals are temporarily suspended while the team conducts security checks, freezes funds and works with law enforcement [3] |
| Losses covered | Stated by Binance | Yi He said the platform would cover all hacking losses; CZ said he expects user funds to be fully covered [1][3] |
| Amount stolen | Estimated, not confirmed by Binance | Arkham data puts the attacker wallet above $5.7 billion; Chainalysis estimated roughly $5.9 billion at the time of theft; Decrypt’s on-chain tally is $5.57 billion across three chains; BleepingComputer reports up to $5.8 billion [2][3][4] |
| EIP-7702 delegation as the mechanism | Assessed by on-chain analysts | Reported from Ethereum records by several analysts. Binance has not commented on the mechanism [7] |
| Attribution to North Korea | Unconfirmed assessment | ZachXBT and Blockaid said North Korea was likely behind the hack, per CoinDesk. No government attribution and no Binance attribution at the time of writing [3] |
| A full post-mortem | Promised | Yi He said a full post-mortem will follow once the investigation is complete [3] |
Timeline (UTC, 29 October 2026)
| Time | Event |
|---|---|
| 20:20:59 | An attacker relayer submits an EIP-7702 authorisation tying the wallet Binance 14 to an attacker-controlled delegate contract [7] |
| 20:24 | Binance 14 transfers 167,464 ETH and 63 token transfers, including 1.615 billion USDT, to a newly created address [2][7] |
| 20:26 (approx.) | A second Binance-labelled wallet sends a further 28,005.6 ETH to the same destination [7] |
| 20:32 | On-chain analyst Spreek publicly flags the transaction as suspicious, noting the attacker’s gas had been funded through Tornado Cash [7] |
| 20:41 | A third outflow of 780 million USDC follows the same route [7] |
| 21:05 to 21:15 | Tether and Circle begin freezing stablecoins; CZ posts that it does look like a hack on Binance [7] |
| 21:24 | Binance says it is urgently investigating reports of a potential security issue [7] |
| Late evening | Binance suspends deposits and withdrawals; Yi He says all hacking losses will be covered and promises a post-mortem [3] |
How the theft appears to have worked
EIP-7702 went live with Ethereum’s Pectra upgrade in May 2025. It lets an ordinary externally owned account, one controlled by a private key, delegate its execution to a smart contract, so the account can batch operations and behave like a smart account. Exchanges use it to distribute funds efficiently. The important control is that the delegation only takes effect if it is signed with the account’s own key [7].
According to the on-chain reconstruction, the attacker obtained exactly such a signature. At 20:20:59 UTC a relayer submitted an authorisation pointing Binance 14 at a contract the attacker had deployed, and four minutes later called that contract, at which point the wallet transferred everything it held to a fresh address [7]. Analysts report the authorisation transaction carried 50 delegations, one for each upcoming nonce, which would keep later authorisations valid even if the exchange revoked the first one quickly. The delegate contract reportedly accepts calls only from the Tornado-funded relayer [7].
The economics are the point. Moving roughly $2.8 billion in the first wave cost less than one dollar in fees, because the wallet did the work itself under the delegation. There was no forged withdrawal request to detect in an application log, and no key needed to leave the signing infrastructure for the funds to move.
What is not established is how the signature was obtained. Three routes are plausible and none is proven: the hot wallet’s private key was stolen; the signing system was manipulated into signing a foreign instruction, which is the pattern attributed in the 2025 Bybit case; or someone with internal access was involved [7]. Binance has not commented. Until it does, treat the mechanism as a well-supported hypothesis rather than a confirmed root cause.
Scale, and what has been frozen
| Measure | Figure | Source |
|---|---|---|
| Total outflow, Ethereum | $3.51 billion in the on-chain tally | Decrypt [2] |
| Total outflow, Bitcoin | $1.44 billion, 18,270 BTC | Decrypt [2] |
| Total outflow, Tron | $630 million | Decrypt [2] |
| Combined estimate | $5.57 billion (Decrypt), above $5.7 billion (Arkham via CoinDesk), roughly $5.9 billion (Chainalysis), up to $5.8 billion (BleepingComputer) | Decrypt, CoinDesk, BleepingComputer [2][3][4] |
| First transaction | 167,464 ETH plus 63 tokens, including 1.615 billion USDT | Decrypt, CryptoTicker [2][7] |
| USDT frozen | More than $1.567 billion | Tether CEO Paolo Ardoino, via BleepingComputer [4] |
| USDC frozen | More than $800 million, in coordination with law enforcement | Circle CEO Jeremy Allaire, via BleepingComputer [4] |
| Combined freeze | $2.54 billion across firms, per CNBC; Decrypt reports $1.8 billion frozen in the main receiving wallet | CNBC, Decrypt [2][5] |
The divergence in the totals is not noise, it reflects what is being counted. The first figures, around $2.4 billion to $3.5 billion, counted one or two wallets on Ethereum. Later tallies added more Binance-labelled wallets and the Bitcoin and Tron outflows. The freeze totals differ for the same reason: one counts the main receiving wallet, another counts every address the issuers acted on, and both were snapshots taken at different times. Any single number quoted without a time and a scope should be treated as provisional [2][3][4][5].
Operational and market impact
- Binance suspended deposits and withdrawals, so customers cannot move funds in either direction while the review runs [3].
- Bitcoin fell below $80,000 and traded near $77,000 at one point, BNB fell around 7 to 8 per cent, and ether and most large caps fell with them. Monero rose, which is the usual pattern when privacy coins are bid on laundering expectations [2][3].
- The attacker moved assets through decentralised trading and lending venues, according to CoinDesk, which is consistent with converting freezable stablecoins into assets no issuer can freeze [3].
- Arkham is tracking dozens of addresses under a single entity label, and Chainalysis has said it is revising its estimate, so the on-chain picture is still being assembled [3][4].
Attribution
Two private investigators, ZachXBT and Blockaid, assessed that North Korea was likely behind the theft, according to CoinDesk [3]. That is an assessment by private firms, not an official attribution. No government agency had attributed the incident at the time of writing, Binance has not attributed it, and the on-chain evidence that would support it, such as laundering patterns or infrastructure overlaps, has not been published in a form that can be independently checked. Given the size and the target, state involvement will be the default hypothesis in most newsrooms; treat it as a hypothesis until evidence is published.
Detection guidance for other exchanges and custodians
The novel control in this incident is EIP-7702, and most exchanges have no alerting for it. The checks below are the ones that would have shown this attack in progress.
- Enumerate delegations on every treasury and hot-wallet EOA. A delegated account returns bytecode beginning with the 0xef0100 prefix followed by the delegate address. Call eth_getCode on every address you control; any non-empty result on an account that should be a plain EOA is an incident, not a configuration detail [7].
- Alert on any EIP-7702 authorisation naming your addresses. These arrive as authorisation tuples in type 4 transactions. Monitor the mempool and blocks for authorisations whose authority is one of your wallets, and route the alert to the same on-call as a large withdrawal.
- Alert on batches across consecutive nonces. A single authorisation is a change; fifty authorisations covering the next fifty nonces is an attempt to survive revocation. That pattern has almost no legitimate use in a hot wallet [7].
- Correlate delegation installation with outflows. Here the gap was four minutes. A rule that fires when a delegation is installed on a wallet that then sends more than its normal daily volume would have caught this before the second wallet was touched.
- Allowlist delegate contracts. If your platform uses 7702 for batching, maintain a short list of audited delegate contracts. Any other delegate is a critical alert, including one deployed hours earlier by an unrelated address.
- Watch the gas source. The relayer in this incident was reportedly funded through Tornado Cash. Treasury wallets should never be interacted with by addresses whose funding traces to mixers or sanctioned services; that signal alone is worth paging on.
- Reconcile balances continuously. Balance snapshots at fixed intervals are not enough when a wallet can be emptied in one transaction. Stream balance deltas per wallet and alert on deviations from expected float.
- Know your issuer contacts before you need them. Tether and Circle froze billions within roughly 40 minutes of the first transaction [7]. That speed depends on pre-existing relationships and a clear request process, not on discovering the right email at 3am.
Hardening recommendations
- Treat a 7702 authorisation as a privileged signing operation. It should not be possible for a hot-wallet key to sign one without out-of-band, human approval. Enforce that in the HSM or MPC policy, not in application code.
- Do not delegate hot wallets to arbitrary contracts. If your batching requires 7702, use a delegate you wrote or audited, with guards on who can call it, which assets it can move and what limits apply.
- Shrink what a delegation can reach. Keep the hot float to the operational minimum, use withdraw-only wallets for customer flows, and enforce velocity limits outside the wallet process.
- Practise revocation. Revoking a delegation means signing a new authorisation that points the account back to an empty delegate. Confirm that your signing stack can do that under pressure, and that it takes minutes rather than hours.
- Rotate and re-verify after any suspicion. If a hot key may have been exposed, rotate it, re-check every address that key controlled for delegations, and reconcile the chain rather than the database.
- Prepare the freeze playbook. Issuer freezes are the most effective recovery lever in stablecoin-heavy thefts. Have the contacts, the evidence format and the legal pathway ready in advance.
Indicators
| Type | Value | Note |
|---|---|---|
| Receiving address | 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c | Etherscan labels it Binance Hot Wallet Exploiter 2; first destination of the 167,464 ETH transaction [7][8] |
| Compromised wallet | 0x28C6c06298d514Db089934071355E5743bf21d60 | The address labelled Binance 14 [9] |
| Delegate contract | 0x63e842B0…73e9c6fAe | Truncated in public reporting; recover the full address from the EIP-7702 delegation record on Binance 14 rather than from a news article |
| Relayer | Not published in the sources reviewed | Reportedly funded through Tornado Cash [7] |
| Tracking | Dozens of addresses under one Arkham entity label | Expect the address set to grow as tracing continues [4] |
What to watch
- Binance’s promised post-mortem, which should state the root cause and whether the signing key or the signing system was compromised [3].
- Resumption of deposits and withdrawals, and any conditions attached.
- Further issuer freezes and any law enforcement seizure or blacklisting action.
- Movement of the non-stablecoin assets: swaps into ETH, bridges, and any interaction with mixers.
- Any official attribution, and the technical evidence behind it.
FAQ: the crypto and smart-contract basics behind this incident
This section is written for readers who do not work with crypto daily. It explains the concepts the rest of the bulletin assumes, including the two very different things called a nonce, and what a signature actually authorises.
What is a hot wallet, and how is it different from a cold wallet?
A wallet is not a container holding coins. It is a key, or a set of keys, plus the software that uses them. A hot wallet is one whose key sits on a machine connected to the internet so it can sign transactions automatically, which is what an exchange needs for customer withdrawals. A cold wallet keeps the key offline and requires a deliberate manual step to sign. Most large exchanges use a warm layer in between. The trade-off is straightforward: hot keys are fast and exposed, cold keys are slow and safer. Customer funds sit in addresses controlled by these keys, not in individual wallets per customer.
What is a private key, and what does signing actually do?
A private key is a very large number. From it the wallet derives a public key, and from that an address. A signature is a mathematical proof, produced with the private key, that a specific message was approved by whoever controls that address. Anyone can verify it using only the address and the message, without learning the key. Signing is not encryption: the message is not hidden, it is authorised. This is why a valid signature is as dangerous as the key itself for the action it covers. If an attacker obtains a signature that authorises moving your funds, they do not need your key to move them.
What is a nonce, and can an attacker really guess it?
Every Ethereum account carries an account nonce: a counter of how many transactions it has sent. It is public, sequential and visible to anyone reading the chain, so there is nothing to guess. The attacker reads the current value and knows the next one will be current plus one. Its purpose is replay protection: a transaction signed for nonce 42 cannot be replayed later, because the account has moved on. This is also why pre-signing works. If you hold a key, or can get it to sign, you can produce authorisations for a whole run of future nonces in advance, and each becomes valid when the account reaches that number. That is exactly what the reported 50 delegations do.
I have read that a reused nonce can expose a private key. Is that the same nonce?
No, and the confusion is common. That statement is about the nonce used inside the ECDSA signature algorithm, sometimes called k. It must be secret and unpredictable for every signature. If the same k is used twice, or is predictable because of a broken random number generator, anyone who sees the two signatures can solve for the private key with simple algebra. That is how the PlayStation 3 signing key was recovered in 2010, and how a flaw in Android’s random number generator drained Bitcoin wallets in 2013. It is a failure of the signing implementation, not of the account counter. Nothing public suggests this is what happened at Binance.
What is a smart contract, in plain terms?
A smart contract is code deployed at an address on the blockchain. When a transaction calls that address, the code runs, and it can read and write storage, hold assets and send them onward. It has no administrator in the usual sense: it does what it was written to do. The useful property is that rules can be enforced without trusting an operator. The dangerous property is that a contract given authority over your assets can exercise all of it, and a bug or a malicious design is not reversible. In this incident the relevant code was the delegate contract the attacker deployed, not Binance’s own trading engine.
What is EIP-7702, and why does an ordinary wallet suddenly have code?
EIP-7702 went live with Ethereum’s Pectra upgrade in May 2025. It lets a normal, key-controlled account point at a smart contract and say: from now on, execute my calls through that code. The account keeps its address and its balance, but its behaviour changes. This lets a plain wallet batch transactions, pay fees in other tokens or add recovery rules without migrating to a new address. The crucial detail is consent: the delegation only takes effect if the account’s own key signs an authorisation naming the contract. So a wallet showing code is not evidence of a bug in Ethereum. It is evidence that someone signed a delegation, or that the key was used without the owner’s intent.
Why would an attacker sign 50 delegations instead of one?
Because each authorisation is tied to a nonce, and a nonce is used once. If the attacker signed a single delegation for the current nonce and the exchange noticed and revoked it, any later attempt would need a fresh signature. Signing a batch covering the next 50 nonces means the exchange’s revocation only clears the nonce it was submitted for; the remaining authorisations stay valid and become usable as the account’s nonce advances. It is a persistence technique, not a technical requirement, and it tells you the attacker expected a race.
If Binance’s private key was not stolen, how else could someone get a valid signature?
A signature is produced by a system, not only by a key. If the machine or service that builds and signs transactions is compromised, it can be made to sign something the operator never intended. If the interface shown to a human approver says one thing while the payload says another, the human approves the malicious version. This is the pattern in the 2025 Bybit case, where signers interacted with a manipulated interface and approved a change they did not intend. The third route is someone with legitimate access acting against the organisation. All three produce the same on-chain result, which is why the root cause has to come from Binance’s logs and signing records rather than from the blockchain.
Why could the attacker move customer assets at all?
Because on a centralised exchange, customer crypto is usually held in a small number of omnibus wallets controlled by the exchange. Your balance is a database entry, an IOU from the company, not a labelled pile of coins in your name. When the exchange signs a transfer, it moves assets that belong to many customers at once. That structure is what makes withdrawals fast and fees low, and it is also what makes a single key compromise catastrophic: there is no per-customer segregation to stop at. The customer’s protection is the exchange’s solvency and its promise to cover losses, not the blockchain.
Why can Tether and Circle freeze funds when nobody can freeze bitcoin?
USDT and USDC are tokens issued by companies. The issuer’s contract contains functions that let it block an address and, in some designs, destroy the blocked balance. That is a deliberate feature for compliance and recovery, and it is why stolen stablecoins are often recoverable. Bitcoin and ether have no issuer and no such switch, so once they move, the only levers are tracing, exchange deposits being blocked, and law enforcement. Attackers know this, which is why large thefts usually convert stablecoins into assets that cannot be frozen. In this incident the issuers froze billions within about 40 minutes, which limits the attacker’s usable proceeds but does not make the victims whole by itself.
Does user funds are safe mean my balance cannot be lost?
It means the company says customer balances are intact and that it will cover the loss. That is a statement about the exchange’s books and its willingness to absorb the hit, not a guarantee enforced by the blockchain. Whether it holds depends on reserves, insurance, and the difference between what the exchange owns and what it owes customers. A withdrawal suspension is the point at which that promise is tested, because it stops a run while the exchange establishes the size of the hole. Treat official statements as claims to be verified against the post-mortem, published reserve data and the resumption of withdrawals, not as a settlement.
What is a relayer, and why does it matter that it was funded through Tornado Cash?
A relayer is an address that pays the gas fee for someone else’s transaction, so the beneficiary does not need to hold ether or reveal its own address. Relaying is a normal pattern, used by smart accounts and privacy tools. Tornado Cash is a mixing service that breaks the on-chain link between the source of funds and the destination, and it is sanctioned by the US Treasury. A relayer funded through a mixer, submitting an authorisation against an exchange wallet, is a strong signal of deliberate concealment. It does not prove who was behind it, but it is the kind of indicator that should wake up a monitoring team at 3am.
How can I check whether my own wallet has been delegated, and how is it undone?
Ask the chain, not the app. For any address you control, read its code with eth_getCode. A normal account returns nothing. A delegated account returns a short value beginning 0xef0100 followed by the address of the contract it delegates to. Block explorers increasingly display this, but the raw check is authoritative. Undoing it means signing a new authorisation with an empty delegate address, at the account’s next nonce, and confirming the code is gone afterwards. Not every wallet or hardware device can produce that authorisation yet, which is itself worth knowing before you need it.
What should I actually do as an exchange user during an incident like this?
Do not rush a withdrawal to an address you have not verified because a post told you to. Confirm everything through the exchange’s own status page and app, enable phishing-resistant two-factor authentication, whitelist withdrawal addresses, and keep only working balances on any exchange. Spread custody across more than one venue, and understand that self-custody removes counterparty risk but adds key-loss risk, so it is not automatically safer for everyone. Expect phishing to spike during the incident, including fake support, fake recovery offers and fake post-mortems. No legitimate exchange will ask for your seed phrase, your password or a remote screen session.
Sources
- Binance, official statement on X (29 October 2026): the exchange said it was aware of reports of a potential security issue, was actively investigating, and had not confirmed any impact to user funds. Quoted in full by Decrypt and CoinDesk. · https://x.com/binance
- Decrypt, “Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 Billion” (29 October 2026), for the three-chain tally, the Binance statement text and the freeze figures in the main receiving wallet. · https://decrypt.co/382191/binance-suspected-hack-5-billion-tether-circle-freeze-crypto
- CoinDesk, “Binance loses $5.7 billion in biggest crypto hack in history” (29 October 2026), for the Arkham and Chainalysis estimates, the co-CEO and CZ statements, the ZachXBT and Blockaid attribution assessment, and market impact. · https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets
- BleepingComputer, “Binance probes potential $5.8 billion crypto-theft hack” (29 October 2026), for the Binance spokesperson statement, the Tether and Circle freeze figures and the Arkham tracking detail. · https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/
- CNBC, “Binance potential security issue sees $2.54 billion frozen by the likes of Circle, Tether” (29 October 2026), for the combined freeze total and market reaction. · https://www.cnbc.com/2026/10/29/circle-tether-freeze-funds-impacted-by-potential-binance-security-issue.html
- TechCrunch, “Binance pauses withdrawals as hackers suspected of stealing billions in crypto” (29 October 2026), for Binance’s confirmation to the press that it is investigating. · https://techcrunch.com/2026/10/29/binance-pauses-withdrawals-as-hackers-suspected-of-stealing-billions-in-crypto/
- CryptoTicker, “Binance Hack: $2.8B Drained From Hot Wallet via EIP-7702” (29 October 2026), for the EIP-7702 reconstruction, the timestamps, the 50-delegation detail, the Tornado Cash funding and the fee. · https://cryptoticker.io/en/binance-hack-hot-wallet-drained/
- Crypto Adventure, “Binance Wallets See $2.77B Outflows, Hack Unconfirmed” (29 October 2026), for the full receiving address as independently reported. · https://cryptoadventure.com/binance-wallets-see-2-77b-outflows-hack-unconfirmed/
- Etherscan address page for the Binance 14 wallet, used to verify the compromised address reproduced here. · https://etherscan.io/address/0x28c6c06298d514db089934071355e5743bf21d60
Bulletin notes
This is a developing incident. Figures, the mechanism and attribution may change as Binance publishes its post-mortem and as on-chain tracing continues. The bulletin will be updated in place rather than replaced, so the URL stays stable. Corrections will be noted at the top.
Prepared for defensive and risk-management use. Nothing here is investment advice, and nothing should be treated as confirmed beyond the status labels in the tables above.