Binance Hack: Suspected $5.7B Drain Is Crypto’s Largest Ever

The suspected Binance hack is the largest theft in crypto history if confirmed: an estimated $5.7B left Binance hot wallets on 29 October 2026. The attacker turned one of Binance’s biggest Ethereum hot wallets into a self-draining contract using EIP-7702, then emptied wallets on Bitcoin and Tron. About $2.6B has been frozen. The real question is how they got Binance’s signature.

Status as of 07:00 Bangkok / 00:00 UTC, Friday 30 October 2026. All figures are on-chain estimates and still moving. Binance has not published a loss figure or a root cause.

Key takeaways

• Size: an estimated $5.57B to $5.8B left Binance hot wallets in about 40 minutes, more than three times Bybit’s record loss.
• Method: 50 signed EIP-7702 authorizations turned the “Binance 14” hot wallet into a contract that drained itself.
• Freezes: Tether, Circle, Ripple, World Liberty Financial and Paxos have locked roughly $2.6B.
• Binance: says user funds are safe and withdrawals are paused on several networks. CZ expects all user funds to be covered.

What happened in the Binance hack

At 20:24 UTC on Thursday 29 October, a single Ethereum transaction emptied the Binance hot wallet labelled “Binance 14”. It sent 167,464 ETH and 63 different tokens, including about 1.615B USDT, to a brand-new address.

Within roughly 40 minutes, wallets tagged as Binance hot wallets had shed an estimated $5.57B to $5.8B. The running tally is about $3.51B on Ethereum, 18,270 BTC (about $1.44B) on Bitcoin and about $630M on Tron. Arkham puts the hacker’s holdings at $5.7B. Trackers that add XRP Ledger and Solana outflows put the total near $6B.

If confirmed, that is more than three times the previous record: Bybit’s roughly $1.5B loss in February 2025.

How the attack worked, step by step

1. Gas money. On 28 and 29 October, a fresh wallet (0x7C86…5CA0) received three 0.1 ETH withdrawals from Tornado Cash.
2. The sweeper. On the afternoon of 29 October, that wallet deployed an unverified contract (0x63e8…6fAe). Only the attacker’s address can trigger it. Its sweep() function pulls every ERC-20 token plus ETH, leaving 1 ETH for gas.
3. The spray. At 20:20:59 UTC, the attacker sent one EIP-7702 transaction carrying 50 signed authorizations for Binance 14, each for a different nonce. The hot wallet was still processing withdrawals, so its nonce kept moving. One of the 50 matched, and Binance 14 was now running the attacker’s code.
4. The drain. At 20:24:23 UTC, 3 minutes 24 seconds later, the attacker called sweep() on Binance 14 itself. The wallet emptied itself in one transaction.
5. Round two. Binance 16 sent 28,005.6 ETH down the same route, and calls through Binance 14 pulled 780M USDC, then 43M more, from Hot Wallet 34. After Binance’s first statement, a second sweep took about 200M more USDT and roughly 370 ETH that had flowed into Binance 14.

EIP-7702 is the tool, not the hole

EIP-7702 arrived with Ethereum’s Pectra upgrade in May 2025. It lets a normal wallet point at smart-contract code, so it can batch transactions or use smart-wallet features. The catch: every authorization must be signed with that wallet’s own private key.

So Ethereum did exactly what it was told. Whoever produced those 50 signatures could already control Binance 14. The candidates are a stolen key, a compromised signing system, or a malicious payload signed as a routine one, which is how Bybit was hit in 2025. Compromised keys were also behind the Drift Protocol exploit earlier this year.

On-chain analyst 0xQuit’s reading is that the attacker held signatures but not the key itself. Otherwise they would not have needed the relayer setup. 7702 also had a practical advantage: one transaction moved 63 tokens before any issuer could freeze them. Developers flagged this kind of scenario during the EIP-7702 debates around two years ago.

There is a second open question. EIP-7702 only exists on EVM chains, so it cannot explain the Bitcoin and Tron outflows. How those wallets were emptied is unknown. Some on-chain watchers argue part of those movements may be Binance moving funds to safety. That is not confirmed.

The freeze race: about $2.6B locked

That is roughly $2.6B locked. The attacker moved fast too: about 700M USDT left the receiving address before the blacklist landed, and much of it was swapped to ETH on Uniswap. One wallet deposited about $60M USDT on Aave and borrowed nearly 19,762 ETH before Aave froze its markets.

The attacker forwarded about 195,460 ETH to a fresh wallet and is now dumping PEPE, UNI and LINK for ETH. It still holds about 217M ENA, 7.58T PEPE, 2.575M LINK and 128K AAVE. ETH and BTC cannot be frozen by anyone.

What Binance and CZ say

Binance posted its first statement at 21:15 UTC and edited it three times. An early version said it had not confirmed any impact to user funds. The final version, at 21:29 UTC, says user funds are completely safe. Binance has since paused withdrawals on multiple networks and says they will resume once the security issue is resolved.

CZ was blunter: it “does look like a hack.” He said that, as a shareholder, he expects all user funds to be fully covered. He later replied to DefiLlama founder 0xngmi’s estimate of about a $1B net loss after freezes, around 0.69% of Binance’s ~$144B in custody, saying the loss may be slightly higher but will be covered. Co-CEO Yi He thanked Ripple and said user funds are SAFU.

Binance’s SAFU emergency fund holds about $1B in bitcoin. Binance has not said whether it will use SAFU or its balance sheet.

Who did it?

There is no official attribution. Analyst 0xQuit believes North Korea’s Lazarus Group is behind it. The timing stands out: two days earlier, Binance said it had blocked a week of North Korea-linked attacks using fake job interviews. The pattern fits past Lazarus heists, but nothing is proven.

Watch THORChain. After Bybit, Lazarus converted about 84% of the stolen ETH to BTC through it. Monero rose about 6% on Thursday, which some read as a rotation into privacy coins, a pattern seen after earlier large thefts.

Market reaction: BTC below $79K, $1B in liquidations

Bitcoin fell below $79,000, touching about $78,177. ETH dropped 2.6% within an hour to around $2,251. BNB fell between 6% and 9%, to near $710. Coinglass logged $628M in liquidations in one hour, 97% of it longs, and more than half of it on Binance itself. Liquidations topped $1B over 24 hours.

It was a bad day all round. Polymarket also halted trading after a compromised vendor injected malicious code into its frontend, draining about $2.6M. Bitget lost about $388M only a month ago.

What the Binance hack means for investors

• This is not FTX. It is a hot-wallet loss, not missing customer deposits. If the ~$1B net estimate holds, Binance can absorb it.
• The overhang is ETH and BTC. About 195K ETH and 18K BTC sit with the attacker. Laundering and selling could weigh on prices for weeks.
• Stablecoins proved they are permissioned. Freezes saved about $2.6B, and showed that issuers can lock any address within an hour.
• EIP-7702 is now under the microscope. Expect exchanges and custodians to audit their signing systems and 7702 policies.

What to do now if you use Binance

1. Don’t panic. Withdrawals are paused anyway. Be careful with leverage while headlines are moving.
2. Trust only official Binance channels. Expect a wave of fake “compensation” and “verify your account” links.
3. Never blind-sign. Read what a wallet is asking you to approve, especially any 7702 delegation request.
4. Self-custody long-term holdings. Coins on your own hardware wallet had zero exposure to this attack.

Binance hack FAQ

How much was stolen from Binance?

On-chain trackers estimate $5.57B to $5.8B left Binance hot wallets, with Arkham putting the attacker’s holdings at $5.7B. About $2.6B has since been frozen, and DefiLlama’s founder estimates the net loss near $1B. Binance has not published its own figure.

Are Binance user funds safe?

Binance says user funds are completely safe, and CZ says he expects all user funds to be fully covered. Withdrawals are paused on several networks until the security issue is resolved.

Did EIP-7702 cause the hack?

No. EIP-7702 was the delivery method, but every authorization had to be signed with the hot wallet’s own key. The root cause is how the attacker obtained those signatures, which is still unknown.

Who was behind the Binance hack?

Nobody has been officially named. Some analysts suspect North Korea’s Lazarus Group because the pattern matches past heists, but this is unproven.

Your turn: are you moving coins off exchanges after this? This story is still developing, and BlockDesk News will update it as Binance publishes its loss figure and root cause.