Between 20:24 and 21:04 UTC on October 29, 2026, on-chain trackers flagged $3.3 billion to $5.6 billion in outflows from Binance-labeled hot wallets across Ethereum, Bitcoin, and Tron. Etherscan tagged the receiving addresses as "Binance Hot Wallet Exploiter." Tether froze $1.567 billion in USDT ...
"It does look like a hack. I expect all user funds will be fully covered." — Changpeng Zhao, Binance Co-Founder and Former CEO, via X on October 29, 2026
Between 20:24 and 21:04 UTC on October 29, 2026, on-chain trackers flagged $3.3 billion to $5.6 billion in outflows from Binance-labeled hot wallets across Ethereum, Bitcoin, and Tron. Etherscan tagged the receiving addresses as "Binance Hot Wallet Exploiter." Tether froze $1.567 billion in USDT and Circle froze $823 million in USDC within hours — $2.39 billion in stablecoins locked.
If confirmed as a single-event theft, the incident exceeds the $1.5 billion Bybit breach of February 2025 by more than two-fold, placing it among the largest exchange security failures in crypto history. Binance held $165.12 billion in tracked reserves as of October 1, representing 68.7% of reserves across eight major exchanges. The exchange has not formally confirmed a breach but co-founder Changpeng Zhao acknowledged it "does look like a hack" and said user funds would be fully covered.
The attack vector appears to involve EIP-7702, an Ethereum feature introduced with the Pectra upgrade that allows externally owned accounts to temporarily behave as smart contracts — a mechanism that had already drawn security scrutiny in mid-2026. The attacker funded operations through Tornado Cash, deployed an exploit contract hours before execution, and drained assets across six blockchains in approximately 40 minutes.
The attack unfolded in a tight window. According to on-chain data reported by The Block, Decrypt, and CoinTelegraph:
Binance co-founder and Chief Customer Service Officer Yi He stated: "We are aware of reports of a potential security issue and we are actively investigating."
The total outflow figure varies by source and timing of measurement. According to PANews and TechFlowPost, multi-chain tracking showed approximately $5.643 billion in outflows from Binance-labeled wallets:
| Chain | Estimated Outflow | |-------|------------------| | Ethereum | $3.528 billion | | Bitcoin | $1.449 billion | | Tron | $628 million | | Arbitrum, Optimism, Base | $38 million combined |
The Ethereum outflow — the best-documented portion — comprised 167,464 ETH, approximately $1.6 billion in USDT, and 63 additional ERC-20 tokens from a single wallet in a single transaction.
Binance's October 1 proof-of-reserves filing showed total tracked reserves of $165.12 billion, broken down as: $57.56 billion in BTC, $44.74 billion in stablecoins, $33.45 billion in platform tokens (BNB), $10.73 billion in ETH, $12.63 billion in major alts, and $6.01 billion in other alt assets. Reserve ratios exceeded 100% for BTC (100.35%), USDT (103.88%), ETH (100%), and BNB (100.47%).
Even taking the higher outflow estimate of $5.6 billion, the sum represents approximately 3.4% of Binance's total tracked reserves. Zhao stated the exchange would cover losses in full.
The technical core of this exploit involves EIP-7702, a feature introduced with Ethereum's Pectra upgrade. EIP-7702 allows an externally owned account (EOA) — a standard wallet controlled by a private key — to temporarily delegate its execution logic to a smart contract. Setting this delegation requires a valid signature from the wallet's own private key.
This means one of two things: either the attacker obtained the private key for Binance 14, or found a way to forge the delegation signature. No public analysis had confirmed which scenario occurred as of October 30.
The EIP-7702 vector is not new to security researchers. In August 2026, a security study highlighted delegation risks from the Pectra upgrade. By mid-2026, wallet drainers exploiting EIP-7702 had stolen $1.54 million in separate incidents, and a single user lost $22,000 in an earlier EIP-7702 wallet attack documented by Crypto News. The Binance incident, however, represents a different order of magnitude — the first time EIP-7702 delegation has been linked to a potential theft exceeding $1 billion.
The attacker used Tornado Cash to fund the initiating wallet, standard operational security for concealing the origin of funds. The exploit contract was deployed more than four hours before the drain, suggesting planned execution rather than an opportunistic attack.
The speed of stablecoin issuer response marked one of the most significant containment actions in crypto history.
Combined, $2.39 billion in stablecoins were immobilized. This works mechanically like a bank canceling a stolen card: the tokens remain at the address but cannot be transferred. However, approximately $700 million in USDT and ETH reportedly moved before the blacklisting was applied or fell outside its reach.
The episode underscores a structural reality: centralized stablecoins function as a de facto kill switch for stolen funds, provided issuers act quickly. This capability contrasts with decentralized stablecoins like DAI — which lack protocol-level freeze functions — and native assets like ETH and BTC, which cannot be frozen by any single entity. The $700 million that escaped containment likely consisted of ETH and assets swapped before issuers intervened.
The suspected breach triggered immediate market contagion.
Price Impact: Bitcoin fell to $79,100, down 2.7% within an hour. Ethereum dropped 3.9% to approximately $2,270. BNB declined 5.4% to $716. Solana touched $95, according to CryptoBriefing.
Liquidations: Coinglass data shows $627.7 million in crypto liquidations within a single hour. Of that total, $606.6 million — 96.6% — came from long positions. Bitcoin longs accounted for $189.1 million, Ethereum longs for $156.8 million, and Solana longs for $46.8 million. The cascade reflected leveraged traders caught on the wrong side as prices gapped lower on the news.
Market Cap: The total crypto market cap fell 1.3% to $2.77 trillion on the day, with total trading volume at $69.3 billion.
In a separate incident on the same day, prediction market Polymarket suffered a $2.65 million exploit traced to a compromised third-party provider. According to The Block, researchers at Hudson Rock identified malicious code in a script loaded from DebugBear, a web performance monitoring service. The injected code attempted to access logged-in users' trading sessions, sell their positions, and redirect funds.
Nearly 1,000 Polymarket accounts were reportedly drained. The platform suspended trading and entered cancel-only mode before resuming operations later in the day. Polymarket stated affected users would be "made whole." The incident affected the offshore international platform, not the CFTC-regulated U.S. entity.
The simultaneous nature of the two attacks — both occurring on October 29 — is notable, though no evidence of coordination has been reported. Taken together, approximately $5.7 billion to $8.3 billion in platform assets were compromised or displaced in a single calendar day, an unprecedented figure for the industry.
If the higher estimates are confirmed, the Binance incident would rank as the largest single exchange breach in crypto history:
| Incident | Year | Loss (at time of theft) | |----------|------|------------------------| | Binance (suspected) | 2026 | $3.3B–$5.6B | | Bybit | 2025 | $1.5 billion | | Mt. Gox | 2014 | ~$473 million (850K BTC at 2014 prices) | | Ronin Bridge | 2022 | $625 million | | Poly Network | 2021 | $611 million |
The Bybit breach of February 2025, previously the record holder, was attributed by the FBI to North Korea's Lazarus Group. Bybit remained solvent and compensated users. Attribution for the Binance incident has not been established.
A critical distinction: Binance's reserve base of $165.12 billion means even a $5.6 billion loss represents 3.4% of assets — significant but not solvency-threatening if reserve ratios held as reported. Mt. Gox, by contrast, was hacked into insolvency.
EIP-7702 as an attack surface. The Pectra upgrade introduced account abstraction features intended to improve user experience by letting wallets behave as smart contracts. The trade-off is that a compromised private key can now enable more sophisticated exploit payloads than a simple transfer. Exchange security models built around EOA hot wallets require reassessment in a post-Pectra environment.
Stablecoin issuers as first responders. Tether and Circle's ability to freeze $2.39 billion within hours contained the damage. This capacity is unique to centralized stablecoins and raises questions about systemic dependency on two private companies acting as emergency backstops for the industry.
Hot wallet architecture. Binance held $165 billion in reserves, but the breach targeted hot wallets — the portion kept online for liquidity. The concentration of assets in accessible wallets remains the fundamental tension between operational efficiency and security. Every major exchange hack in the past decade has exploited this same design choice.
Multi-chain vulnerability. Outflows spanned six blockchains. Cross-chain containment is structurally harder than single-chain response, as freeze capabilities, block confirmation times, and governance mechanisms differ by network.
The October 29 incident marks a stress test for multiple layers of crypto infrastructure simultaneously: exchange security models, stablecoin issuer emergency protocols, Ethereum's post-Pectra feature set, and market microstructure under shock conditions. The fact that $2.39 billion was frozen within hours demonstrates that centralized stablecoins have become a de facto containment mechanism. The fact that $700 million still escaped demonstrates the limits of that mechanism.
Binance's solvency does not appear at risk given its reserve base, but the incident exposes questions about hot wallet management at scale, the security implications of EIP-7702 delegation, and the industry's structural dependence on rapid stablecoin issuer intervention. The investigation is ongoing. Attribution has not been established. Final loss figures remain subject to revision.