Last updated: October 30, 2026
Binance, the biggest crypto exchange in the world, is dealing with what could be the largest crypto hack ever. On the evening of October 29, 2026, users and blockchain analysts saw huge amounts of crypto leaving Binance’s hot wallets. Within hours, Binance paused withdrawals, Tether and Circle froze stolen stablecoins, and crypto prices dropped. Here is what we know so far, what is still unconfirmed, and what you should do if you have money on Binance.
What Happened in the Binance Hack?
A hot wallet is a wallet connected to the internet that an exchange uses to process withdrawals quickly. Most of an exchange’s money normally sits in offline cold wallets, which are much harder to attack. This attack hit the hot wallets.
According to an on-chain investigation by Bitquery, the attacker emptied 17 Binance hot wallets between 20:04 and 23:56 UTC on October 29, worth about $6.3 billion at the time of each transfer. TechCrunch reported estimates of at least $2 billion and up to $5.7 billion. Binance itself has not confirmed a figure.
| Blockchain | Amount drained (Bitquery estimate) |
|---|---|
| Ethereum | $3.77 billion |
| Bitcoin | $1.48 billion |
| TRON | $628 million |
| XRP Ledger | $300 million |
| Solana | $96 million |
| Arbitrum | $32 million |
| Polygon | $10 million |
| Optimism | $4.8 million |
| Base | $2.7 million |
Timeline of the Attack
- 14:54 UTC: a new wallet receives about 1 ETH from the Tornado Cash mixer to pay for gas fees.
- 20:04 UTC: the first drain starts on the XRP Ledger, followed by Solana, TRON and Bitcoin.
- 20:24 UTC: the main Ethereum drain moves about 167,000 ETH, 1.6 billion USDT and 62 other tokens.
- 20:57 to 21:04 UTC: World Liberty, Tether and Circle start freezing stolen tokens.
- 22:15 UTC: Binance posts that withdrawals will resume “as soon as the security issue is fully resolved”.
- 23:56 UTC: the last Ethereum drain.
- 00:10 UTC, October 30: Binance cancels the EIP-7702 authorization linked to the attack.
- 00:18 UTC: the Arbitrum Security Council locks about 74.5 million ARB and 8,425 ETH held by the attacker.
How Did the Attackers Get In?
Binance has not published a root cause yet. Investigators have pointed to EIP-7702, an Ethereum feature that lets a normal wallet temporarily run the code of a smart contract. On-chain data shows the attacker’s wallet got a Binance hot wallet to delegate to its own contract, which gave it control until the authorization was revoked.
How the attacker got that signature is still unknown. It could be stolen keys, a compromised internal system or a supplier, as in the Bybit hack of 2025. Until Binance publishes its post-mortem, treat any detailed explanation you see online as speculation.
How Much Has Been Frozen?
Stablecoins like USDT and USDC can be frozen by the companies that issue them, which is why a large part of the loot is already blocked:
- Tether: about 1.76 billion USDT frozen on Ethereum and TRON.
- Circle: about 823 million USDC frozen.
- Others: World Liberty, Paxos, Ripple and First Digital froze about $132 million together, and the Arbitrum Security Council locked the attacker’s ARB and ETH.
Binance says verified frozen assets total about $2.54 billion. Frozen is not the same as recovered, but it means a big part of the stolen money cannot be spent. The attacker swapped about $729 million of USDT into ETH and TRX before some freezes landed, and was holding roughly $3.1 billion, mostly in ETH and BTC, a few hours later.
What Binance Says
- Binance says user funds are safe and that it will cover all losses.
- Withdrawals, deposits and trading on Binance Alpha are paused until the issue is fully resolved. No date has been given.
- Co-founder Changpeng Zhao (CZ), who no longer runs the company but is its largest shareholder, said on X he expects user funds to be fully covered.
- Binance warned users to beware of scams and not to trust unofficial links or requests for account information.
Binance has an emergency reserve called SAFU (Secure Asset Fund for Users), reportedly worth around $1 billion, which it used in 2019 to cover a 7,000 BTC hack. A loss in the billions would have to come mostly from Binance’s own balance sheet.
What Binance Users Should Do Now
- Ignore “refund” and “recovery” messages. Scammers always use big hacks to send fake emails, SMS and DMs. Binance will never ask for your password, 2FA code or seed phrase.
- Only use official channels: type binance.com yourself, use the official app and the verified Binance X account.
- Check your account security: make sure 2FA is on (ideally a passkey or an authenticator app, not SMS), set an anti-phishing code and review your withdrawal address whitelist.
- Do not panic-sell at a loss just because of the headlines. Prices are volatile right now.
- Take screenshots of your balances so you have a record in case anything looks wrong later.
- Think about self-custody for long-term holdings. Funds on any exchange depend on that exchange staying secure.
Market Reaction
The news hit the market late on October 29. Coinglass data showed about $628 million in liquidations in one hour, almost all long positions. BNB fell around 7 to 9% to about $700, and Bitcoin slipped below $78,000.
How It Compares to Other Crypto Hacks
If the losses are confirmed in the billions, this will be the biggest crypto hack on record. The previous record was the Bybit hack of February 2025, about $1.4 billion, which the FBI blamed on North Korea’s Lazarus Group. Nobody has claimed or been officially blamed for the Binance attack yet.
Frequently Asked Questions
Was Binance hacked?
Binance has confirmed a “security incident” and paused withdrawals on several networks on October 29, 2026. On-chain investigators and Binance co-founder Changpeng Zhao say the exchange was hacked. Binance has not yet published an official root cause.
How much was stolen from Binance?
There is no official figure yet. On-chain analysis by Bitquery counts about $6.3 billion moved out of 17 Binance hot wallets on 9 blockchains. Other estimates range from about $2 billion to almost $6 billion. Around $2.5 to $2.7 billion has been frozen by stablecoin issuers such as Tether and Circle.
Are my funds on Binance safe?
Binance says user funds are safe and that it will cover all losses. Changpeng Zhao also said he expects user funds to be fully covered. Until withdrawals reopen, you cannot move funds off the platform, so the main thing you can do is protect your account and ignore scams.
When will Binance withdrawals resume?
Binance has not given a firm date. It says withdrawals will resume once the security issue is fully resolved. Follow only the official Binance website, app and verified X account for updates.
How did the hackers get in?
It is not confirmed. Researchers point to an EIP-7702 delegation: a wallet funded through Tornado Cash got one Binance hot wallet to run the attacker’s smart contract. Binance revoked that authorization on October 30. A full post-mortem is still pending.