Update (October 29, around 21:00 UTC): The drain is much bigger than first reported. According to a tally shared by WazzCrypto on X, at least $5.57 billion left Binance hot wallets across Ethereum, Bitcoin and Tron. Tether froze 975.1 million USDT and Circle froze 823 million USDC, about $1.8 billion in total. Tether also blacklisted three relay wallets, but the USDT had already moved on.
Update (October 29, evening UTC): Binance founder CZ says it looks like a hack and that user funds are safe. He no longer manages Binance, but as a shareholder he expects all user funds to be fully covered. So far, the update has come from CZ, not from Binance’s official channels.
Binance hot wallets lost at least $5.57 billion on October 29, across Ethereum, Bitcoin and Tron. That makes it the biggest crypto hack on record, more than three times the size of Bybit’s 2025 hack. Binance founder CZ says it does look like a hack, and Tether and Circle have frozen about $1.8 billion of the stolen stablecoins. We’ll update this post when possible as new details come in.
Here’s what happened, how the attack worked, and what Binance users should do right now.
What Happened to the Binance Hot Wallets
The first sign came at 20:24 UTC, when one transaction emptied Binance 14, a long-known Binance hot wallet on Ethereum. In one shot, 167,464 ETH, about 1.62 billion USDT and more than 60 other tokens landed in a brand-new wallet.
According to 0xQuit’s breakdown, the biggest assets in that sweep were:
- 1.615 billion USDT
- 62.6 million RLUSD
- 29,934 wBETH
- 11,372 XAUt
- 6.19 million UNI
- 198.4 million ENA
- 7.175 trillion PEPE
- 27.8 million USD1
- 2.26 million LINK
- 127,853 AAVE
Seconds later, Binance 16 sent another 28,005 ETH to the same address. After that, the attacker pulled 780 million USDC out of Binance Hot Wallet 34.
Ethereum turned out to be only part of the story. Here’s the latest tally per chain, as shared by WazzCrypto:
- Ethereum: $3.51 billion, from Binance 14, Binance 16 and Hot Wallet 34
- Bitcoin: $1.44 billion, or 18,270 BTC, from a Binance hot wallet
- Tron: $0.63 billion, made up of 612.7 million USDT plus 46.4 million TRX, from Binance-Hot 7
That adds up to at least $5.57 billion. For comparison, Bybit’s $1.5 billion hack in February 2025 was the previous record.
How the Binance Hack Worked
On Ethereum, 0xQuit laid out the attack step by step:
- At 15:59 UTC, the attacker’s relayer wallet deployed a delegate contract.
- About four hours later, the relayer submitted an EIP-7702 authorization that installed that malicious code on Binance 14.
- Next, the relayer called Binance 14 and ran a “sweep” function. Its input was a list of token contracts plus ETH, so it emptied the wallet in one go.
- Later, the relayer used the same delegate to pull 780 million USDC from Binance Hot Wallet 34.
The relayer itself got its gas money from three 0.1 ETH Tornado Cash withdrawals over the two days before the attack.
One detail stands out. If the attacker had Binance’s private keys, they wouldn’t have needed a relayer on Ethereum. 0xQuit’s read is that they only had EIP-7702 authorization signatures, most likely phished.
However, the Bitcoin and Tron drains complicate that picture. EIP-7702 only exists on EVM chains, so it can’t explain how those wallets were emptied. How the attacker got into them is still unknown.
0xQuit also thinks it’s safe to assume North Korea’s Lazarus Group is behind it. That attribution isn’t confirmed. Still, the timing is striking: just two days ago, Binance said it had blocked a week of North Korea-linked attacks that used fake job interviews.
Tether and Circle Freeze $1.8 Billion
Stablecoin issuers moved fast. Tether froze 975.1 million USDT in the main receiving wallet. Shortly after, at 21:04 UTC, Circle froze 823 million USDC in the same wallet. CZ publicly thanked both for the quick action.
Tether also blacklisted three relay wallets. Unfortunately, the attacker had already passed that USDT on before the blacklist hit.
That leaves most of the haul out of reach of the freezes:
- Bitcoin: 18,270 BTC can’t be frozen by any issuer.
- ETH: The attacker forwarded 195,460 ETH, worth about $450 million, to a fresh wallet that has made only one transaction.
- Tron: As far as the on-chain data shows, the 612.7 million USDT taken there isn’t frozen yet.
In short, about $1.8 billion is frozen, while roughly $3.8 billion is still outside the freezes. That alone is more than double the entire Bybit hack.
How I Traded the Binance Hack
I was taking a nap when it happened. My phone woke me up, with friends calling one after another. By the time I checked the charts, BTC had already dropped to $78,000.
Needless to say, my longs all hit their stops. Luckily, most of those stops were already at entry, so the damage stayed limited.
My HYPE long was out before any of this. I opened it on Monday at $75.59 and kept you posted through the ICE Hyperliquid deal this morning. Then Stan Druckenmiller’s first tweet ever added fuel, and I closed the long at $94 with a good profit locked in.
After the drain, I went long $XMR. When the news of Tether’s USDT freeze hit, I closed that long too.
As always, this isn’t financial advice. Size your positions for days like this one, because volatility around a hack this big cuts both ways.
Should You Withdraw From Binance?
CZ says user funds are safe, and he expects them to be fully covered. That’s reassuring. However, he no longer runs Binance, and the exchange hasn’t confirmed a recovery plan through its own channels yet.
So my advice stands. If you hold funds on Binance, I’d withdraw them now. In 2019, Binance paused withdrawals for about a week after its hot wallet hack. The people who get out first are the ones who don’t get stuck.
Binance also keeps a Secure Asset Fund for Users (SAFU) for events like this. Still, nobody knows yet how it will handle a loss this size, and there’s no reason to find out the hard way.
Here’s how to get out safely:
- Withdraw to a wallet you control. New to that? Our guide on self-custody vs keeping crypto on an exchange walks you through it.
- Or spread your funds across other platforms. Our Binance alternatives list covers the exchanges we trust.
- Only use the official Binance app or website. Fake “Binance support” DMs and “refund” links always follow a hack.
- Double-check the network and address on every withdrawal. Rushing is how people make expensive mistakes.
If Binance makes everyone whole, you lose nothing by sitting in your own wallet for a few days. If it doesn’t, you’re already out.
For the wider checklist on phishing and drainers, see our crypto safety guide.
Binance’s Security Track Record
This isn’t Binance’s first hack. In May 2019, attackers stole over 7,000 BTC from its hot wallet. Three years later, a bridge exploit on BNB Chain minted around $570 million in extra BNB.
Exchange breaches have also piled up in 2026. Bitget lost about $350 million in September, as covered in our Bitget hack breakdown. Earlier today, Polymarket halted trading after its own third-party provider breach.
For the full picture of the exchange itself, our Binance review covers its fees, features and history.
What We’re Watching Next
- An official statement from Binance itself
- Confirmation of how user funds will be covered
- How the Bitcoin and Tron wallets were breached
- Whether Tether freezes the Tron USDT
- Where the 18,270 BTC and 195,460 ETH go next
- Official attribution, including whether Lazarus is behind it
We’ll update this post as new details land. Every hack we track goes into our crypto security coverage.
Keep This Content Free
On days like this, fast and free coverage matters, and your support keeps it that way. If you trade on a centralized exchange, you can sign up through our OKX link or our Bybit link at no extra cost to you. And if you’re trading through this volatility, keep an eye on our trading airdrops as well.
Final Words
What looked like one suspicious transfer is now the biggest crypto hack on record. At least $5.57 billion left Binance hot wallets across three chains. Fortunately, Tether and Circle froze about $1.8 billion, and CZ expects users to be fully covered.
Until Binance confirms that itself, I’d stay cautious. Get your funds off the exchange, avoid unofficial links, and be the first out, not the last. We’ll update this post as soon as Binance confirms the details, the final loss figure and its recovery plan..
FAQ
Was Binance hacked?
It looks that way. On October 29, 2026, an attacker drained Binance hot wallets on Ethereum, Bitcoin and Tron, and Binance founder CZ said it does look like a hack. Binance itself has not yet posted an official statement.
How much was stolen from Binance?
At least $5.57 billion, according to on-chain tallies. That breaks down to $3.51 billion on Ethereum, $1.44 billion in Bitcoin and $0.63 billion on Tron.
Is this the biggest crypto hack ever?
Yes. At over $5.5 billion, it’s more than three times the size of Bybit’s $1.5 billion hack from February 2025.
How much of the stolen crypto was frozen?
About $1.8 billion. Tether froze 975.1 million USDT, and Circle froze 823 million USDC. The stolen Bitcoin can’t be frozen by any issuer.
Are Binance user funds safe?
CZ says user funds are safe and that he expects them to be fully covered. He no longer manages Binance, though, so watch for an official statement from the exchange.
Who is behind the Binance hack?
There’s no official attribution yet. On-chain analyst 0xQuit believes North Korea’s Lazarus Group is behind it.
Should I withdraw from Binance?
Yes, in my view. Until Binance itself confirms how users are covered, there’s little upside to leaving funds on the exchange. Withdraw to self-custody or another exchange, and only through the official Binance app or website.
Credit: Source link
