AI News
Binance Suspected Hack: $5.5 Billion Drained From Hot Wallets in Crypto’s Biggest-Ever Heist
On Thursday evening, wallets linked to Binance, the world’s largest crypto exchange, were drained of at least $5.57 billion in about 40 minutes. If confirmed as a hack, it is the largest crypto theft in history — more than triple the previous record. Binance says user funds are safe. It has not confirmed a hack, and the final number is still unknown.
What happened, minute by minute
Analysts first noticed unusual movement from Binance hot wallets at about 20:24 UTC on October 29, and the main transfers were over by around 21:04. One Ethereum transaction at 20:24 UTC moved 167,464 ETH to a newly created address, together with 63 token transfers including approximately $1.615 billion in USDT. A wallet labelled Binance 14 sent about 167,464 ETH, roughly $1.6 billion in USDT and more than 60 other tokens to a fresh address in a single transaction. The on-chain tally counts roughly $3.51 billion on Ethereum, about $1.44 billion in Bitcoin (18,270 BTC) and around $630 million on Tron.
The one clue investigators have
About three minutes before the big transfer, an address funded through Tornado Cash — a mixer that scrambles the trail of crypto payments — submitted a delegation for a Binance hot wallet using EIP-7702, an Ethereum feature that lets an ordinary wallet temporarily run smart-contract code. How the attacker obtained the required signature is still unknown, and that is the central unanswered question of the whole incident. Until investigators establish how the transfers were authorised, the outflows are best treated as suspicious activity rather than a proven breach, even though the scale and pattern point strongly to a theft.
The freeze race
Stablecoin issuers moved fast, and their freezes are the reason the final loss will be far smaller than the headline number. Tether froze over $1.567 billion in USDT, Circle froze over $800 million in USDC, and Ripple froze roughly $200 million in its RLUSD stablecoin. Binance later clarified that the verified total frozen stood at $2.54 billion as of around 7:20 p.m. ET on October 29, and that the figure may keep rising. Do not add the earlier figures together: the $1.8 billion quoted early in the evening (about $975 million USDT plus $823 million USDC in the main receiving wallet) was superseded by the $2.54 billion verified total, not topped up by it.
The attacker, meanwhile, has been converting what it can into Ethereum, which no issuer can freeze. Wallets linked to the incident received tens of thousands of ETH from Uniswap contracts — one relay wallet took 20,940 ETH (about $45.58 million) — and borrowed ETH on Aave against USDT collateral, including about 19,762 ETH borrowed against $60 million in USDT. Aave has since frozen its V3 markets on Ethereum mainnet, blocking new deposits and borrowing, and Kamino, a lending protocol on Solana, paused its Solana and Bitcoin markets as a precaution. One distinction matters: freezing is not recovery. Blocklisting stops an address from sending or receiving a stablecoin, but it does not reverse a completed transaction.
What Binance is saying — and what it hasn’t said
Binance’s own statements shifted over the evening: an early post said the company had not confirmed any impact to user funds; a later one read “user funds are completely safe.” Founder Changpeng Zhao, who no longer runs the company but remains its largest shareholder, went further on X: “It does look like a hack on Binance,” and “user funds are safe,” adding that the loss after freezes might be a bit higher than about $1 billion, “but will cover.” That is Zhao’s personal characterization, not the company’s statement, and Binance itself has published no accounting of what was taken. The exchange has paused withdrawals on multiple networks as a precaution, saying they will resume as soon as the security issue is fully resolved, and it has warned users to beware of scams and unofficial links or requests for account information. Binance.US, the separate US exchange, said it is not affected.
Why this one is different
Three things set it apart. First, scale: the previous record was the roughly $1.5 billion Bybit theft in February 2025, which the FBI blamed on North Korean hackers — no attribution has been made in this case. Second, speed: the bulk of the money moved in about 40 minutes. Third, what it reveals about crypto’s safety net: hot wallets stay connected to the internet by design so exchanges can process withdrawals quickly, and that connectivity is exactly the risk. And the freeze response shows both the power and the limits of stablecoin issuers — they can stop USDT and USDC in their tracks, but every dollar converted to Ethereum before a freeze lands is beyond their reach. Binance has more than 335 million registered users, so the question of whether customer balances are whole matters far beyond one company’s balance sheet.
What to watch next
Binance’s own accounting, which it has not published; whether withdrawals resume and on what timeline; whether frozen funds lead to any recovery for customers; how the attacker obtained the signature behind the EIP-7702 delegation; and whether any attribution emerges. This story is still developing, and the figures here are the best verified tallies as of late October 29 and early October 30 — expect them to move. One caution that applies to every number in this article: estimates through the evening ranged from about $1.7 billion to $5.7 billion, and only Binance’s own reconciliation, when it comes, will settle the total.