Suspected Binance hack: up to $5.6bn drained from the crypto exchange’s wallets

If a theft is confirmed, it will be the largest in the history of the crypto market. Early estimates put the outflow at $2.4–3.5 billion, but a later tally of on-chain data raised it to at least $5.57 billion across three networks: about $3.51 billion on Ethereum, $1.44 billion in bitcoin (18,270 BTC) and $630 million on Tron. The exchange has not commented on these figures.

How the funds left

The large transfers on Ethereum began at 22:24 Cyprus time. According to the Etherscan blockchain explorer, a wallet labelled Binance 14 sent about 167,464 ETH (around $388 million), roughly $1.6 billion in the USDT stablecoin and more than 60 other tokens to a new address in a single transaction. Twenty-four seconds later, about 28,000 ETH left the Binance 16 wallet for the same address, and a third hot wallet then sent out $823 million in USDC. The main wave of Ethereum transfers was over by 23:04.

Why it looks like an attack

• According to Etherscan and on-chain researchers, the address that triggered the withdrawal was funded through the Tornado Cash mixer, with three deposits of about 0.1 ETH on 28 and 29 October. The receiving address did not exist before 29 October.
• The same address deployed the smart contract that executed the withdrawals at 17:59, more than four hours before the drain. A few minutes before the first transfer, Binance 14 was linked to that contract via EIP-7702. Once linked, the contract’s code can move the wallet’s funds without further signatures, but the link itself has to be signed with the wallet’s key. How the attackers obtained that signature is unknown, the founder of Phylax Systems noted.
• Earlier in the day, the same steps had been run against three smaller wallets, which looks like a test run.
• Within 15 minutes, the recipient forwarded 195,460 ETH (around $450 million) to yet another new address, while the USDT was split across new addresses and sold on decentralised exchanges, according to on-chain researcher Spreek.
• Etherscan has labelled the addresses “Binance Hot Wallet Exploiter”.

Binance had announced scheduled maintenance of its Ethereum wallets for 28 October, so an internal reshuffle of reserves was not ruled out at first. Analysts, however, say the on-chain pattern is hard to square with that explanation.

What Zhao and Binance say

At around 23:15, Changpeng Zhao (CZ), Binance’s co-founder and former chief executive, wrote on X: “User funds are safe! It looks like Binance was indeed hacked.” He added: “I no longer run Binance, but as a shareholder I expect all user funds to be fully compensated.”

The exchange has not confirmed a hack. Binance said it was aware of reports of a potential security issue and was actively investigating: “We have not confirmed any impact to user funds. Our security teams are reviewing all relevant information with urgency.” Co-founder Yi He said updates would come only through official Binance channels and warned users not to trust unofficial links, messages or requests for account information. Binance has not said whether it will draw on its SAFU emergency fund, and no suspension of withdrawals had been announced at the time of publication.

Stablecoins frozen

Tether and Circle moved quickly to block stablecoins at the receiving addresses. Tether initially froze about $975 million in USDT, and later reports put the figure at more than $1.5 billion. Circle froze $823 million in USDC. “In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident,” Circle chief executive Jeremy Allaire wrote. Zhao publicly thanked both companies. Ether and the other tokens, however, cannot be frozen by an issuer, and the ETH alone held by the attackers is worth around $450 million.

Market reaction

Bitcoin dropped below $79,000 and Ether below $2,300. BNB, the exchange’s own token, lost as much as 9%, falling below $700. According to Coinglass, $628 million in trader positions were liquidated within an hour, almost all of them longs. Of that, $345 million was on Binance itself.

The Bybit precedent

The largest exchange hack to date was the theft of about $1.5 billion from Bybit in February 2025, which the FBI attributed to North Korean hackers. Binance itself was hacked in 2019, when attackers stole 7,000 BTC (about $40 million at the time) and the exchange covered the losses from its SAFU fund. On 27 October, Binance said its security team had repelled several attacks linked to North Korea. It is not yet known who is behind the latest outflow.

This story is being updated.