On the evening of 29 October 2026, a flurry of unauthorized transactions swept through wallets that Binance identifies as its hot wallets. Within roughly 40 minutes, billions of dollars in crypto vanished, prompting the world’s largest exchange to launch an emergency response and issue a series of public statements. The incident quickly became the biggest story in the crypto sphere, with estimates ranging from $2.8 billion to nearly $6 billion depending on the source and the assets considered.
How the breach unfolded
Blockchain forensics show that an attacker linked Binance’s hot wallet labeled “Binance 14” to a freshly deployed smart-contract using EIP-7702, an Ethereum feature that permits an account to delegate execution to contract code. The transaction, recorded at 20:24 UTC, bundled 50 authorisations—one of which matched the required nonce—allowing the contract to act on Binance’s behalf. Less than four minutes later, the contract emptied the wallet, moving large amounts of ETH, USDT, USDC and other tokens to a previously unknown address funded through Tornado Cash. While the exact method of obtaining the necessary signature remains unverified, the pattern suggests a compromise of the signing infrastructure rather than a simple private-key theft.
Preliminary technical assessment
Blockaid, a security firm tasked with the initial analysis, highlighted a phenomenon it calls “key misuse.” According to Blockaid’s lead analyst, Ben-Natan, the attackers likely tricked or infiltrated Binance’s signing system, causing it to approve malicious transfers without the private key ever leaving the platform. He explained, “It seems to be … a compromise of signing infrastructure. We don’t think a key was leaked.” This assessment aligns with Binance’s own early findings, which point to a compromised DevOps engineer’s laptop as the entry point that may have granted the attacker access to a service container capable of issuing withdrawal commands.
Financial impact and Binance’s response
The exchange now estimates the total impact at approximately $6.3 billion. Working with blockchain partners, Binance has managed to freeze roughly $3 billion of the affected assets on-chain, including $2.54 billion verified by the exchange itself. Tether and Circle have also frozen more than $2.3 billion in stablecoins linked to the outflows. Despite the scale of the loss, Binance asserts that user funds are completely safe, pledging to cover all losses through its Secure Asset Fund for Users (SAFU) and additional corporate reserves. The platform temporarily halted deposits and withdrawals, revoked the compromised address’s authorisation, and promised a detailed technical post-mortem once investigations are finalised.
Parallels with past attacks and attribution hints
When asked whether the breach resembled the February 2025 Bybit incident, Ben-Natan described the two events as “very, very similar.” The Bybit breach involved a compromised developer’s credentials, allowing attackers to manipulate the wallet provider’s infrastructure and deceive signers into approving malicious transactions. Blockaid also noted operational similarities with attacks attributed to North Korea’s Lazarus group, though no concrete attribution has been made in the Binance case. Earlier, Arkham CEO Miguel Morel warned that the hack might still be ongoing, emphasizing the difficulty of confirming whether the intrusion stemmed from stolen keys or a broader infrastructure compromise.
Market reaction and broader implications
Crypto markets responded sharply. Binance’s native token BNB slid more than 5 %, while Bitcoin dipped around 2.5 % and Ether fell roughly 3 % in the hours following the breach. Some observers mentioned a brief uptick in privacy-coin interest, though no definitive link to the stolen assets has emerged. The incident has reignited debate over the safety of custodial solutions versus self-custody, especially as the exchange’s SAFU reserve—reported to hold about 15,000 BTC, or $1.18 billion—may be tapped to reimburse affected users.
As law-enforcement agencies and blockchain intelligence firms continue to trace the flow of the stolen funds, Binance’s commitment to keep user balances intact remains a central narrative. The exchange has promised to release an updated Proof of Reserves and will publish a comprehensive technical report once forensic analysis is complete.
