The Binance hot wallet hack began on 29 October 2026 (UTC), when an attacker moved billions of dollars in crypto out of Binance hot wallets on Ethereum, Bitcoin and Tron. Binance says user funds are safe and that it will cover all losses. [2][5] Changpeng Zhao, who no longer runs the exchange but remains a shareholder, said it "does look like a hack on Binance" and that he expected all user funds to be fully covered. [7]
What happened
According to CoinDesk, at about 20:24 UTC on 29 October the "Binance 14" hot wallet on Ethereum sent out 167,464 ETH, followed by 28,005.6 ETH from "Binance 16". The attacker used an EIP-7702 delegation signed with the wallet's key. [1] Odaily's on-chain tally put total outflows at about $5.64 billion: about $3.53 billion on Ethereum, $1.45 billion on Bitcoin and $628 million on Tron. It also reported that the attacker's gas was funded only through Tornado Cash. [3] Cointelegraph reported that about $5.7 billion left Binance-linked wallets across the three networks. [2][8] These are early estimates of gross outflows, not a final loss figure.
Binance said its teams were investigating a potential security issue and that user funds were completely safe. [9] It then temporarily suspended Binance Alpha trading [10] and, on 30 October, said that "Binance will cover all losses". It also suspended all deposits and withdrawals while it ran security checks, froze funds and worked with law enforcement, and promised a full post-mortem once the investigation is complete. [5] He Yi posted the same commitment. [6] Binance.US said it is a separate platform and was not affected. [11]
Freezes
Several issuers and networks froze assets linked to the attacker: [cần dẫn nguồn]
- Tether froze more than 1.567 billion USDT. [12]
- Circle froze more than 800 million USDC in coordination with law enforcement. [13]
- World Liberty Financial's USD1 froze $27 million. [14]
- Ripple said it was freezing the attackers' RLUSD. [15]
- The Arbitrum Security Council froze about $30.5 million. [16]
Binance put the verified frozen total at $2.54 billion, correcting a $1.8 billion figure that was circulating [17], and later at around $3 billion. [4] Arkham data relayed by Wu Blockchain showed addresses linked to the attacker holding about $5.88 billion. That figure is holdings, not a confirmed loss. [18]
Changpeng Zhao's response
Zhao wrote that user funds were safe and that, as a shareholder, he expected all user funds to be fully covered. [7] He called Tether's freeze a "life saver". [19] When DefiLlama founder 0xngmi estimated a net loss of about $1 billion after freezes, Zhao replied: "Loss might be a bit higher than that, but will cover." [20] He also publicly thanked Circle, USD1, Ripple and ZachXBT for their freezes. [21][22][23][24]
Reserves
CoinDesk reported that the drained ETH, about 204,500 ETH, equals roughly 5.6% of the ETH Binance held for customers. That would put ETH backing near 94%, against 100% in the 1 October proof-of-reserves snapshot. The next snapshot is due on 1 November. [1]
Cause and attribution
Binance has not confirmed how the attack happened. [5] Blockaid CEO Ido Ben-Natan said it may stem from a compromised signature system rather than stolen private keys. [25] Investigator ZachXBT said it is "likely Lazarus Group", North Korea's hacking group. That is his assessment; Binance and law enforcement have not confirmed it. [26] The final loss and any timeline for resuming withdrawals had not been announced as of 30 October 01:00 UTC. [citation needed]