brief -
Binance Suffers $5.6 Billion Hot-Wallet Hack
Binance says it will cover losses after billions moved from exchange-linked wallets, marking the biggest crypto theft on record.
It's Thursday, October 29, 2026.
Binance suffered a major hot-wallet hack on October 29, with billions of dollars in assets moved across multiple networks. Binance said it will cover the losses, while the root cause and final amount stolen remain under investigation. On-chain analysts have described a possible private-key or signing compromise.
No user action is required at this time. Stay safe and do nothing.
Support ETH Daily Security
Support ETH Daily with a small donation to help our security initiative reach the threshold for qualification in TheDAO Fund's mid-November vote.
The Hack Involved Multiple Networks
The first alerts appeared on October 29, when on-chain observers reported that assets had moved from Binance-labeled wallets into newly created addresses. Blockaid said the outflows began at about 20:24 UTC across multiple networks. An estimated $5.5 billion in ETH, BTC, USDT, USDC and dozens of other assets was drained from the exchange. The figure makes it the largest crypto hack in history, surpassing the $1.5 billion Bybit hack on February 21, 2025.
On Ethereum, the attacker used EIP-7702 to delegate a Binance hot wallet to contract code that swept over $3.5 billion in token balances. That transaction required wallet authorization. Because outflows were reported across other networks, such as Bitcoin, they raise the possibility of a compromised private key or signing process. Binance has not confirmed the root cause, and the use of an EIP-7702 transaction alone does not establish how access was obtained.
Ecosystem Freezes Over $2.5 Billion
Tether and Circle froze stablecoins linked to the incident. Tether said it had frozen more than $1.567 billion USDT, while Circle said it had frozen more than $800 million USDC. Binance later put the verified total frozen at $2.54 billion, while noting that the figure could rise.
The Binance attacker was able to deposit stolen USDT into Aave as collateral and borrow nearly 20,000 ETH. Aave said its contracts were unaffected and existing positions remained overcollateralized. As a precaution, Aave froze DAO-operated markets across V3 and V4, pausing new deposits and borrowing while leaving withdrawals and repayments open.
The Arbitrum Security Council separately froze about $30.5 million, including 74,559,805 ARB and 8,425 ETH being held in the attacker's address on Arbitrum One.
Binance Pauses Withdrawals
Binance said deposits and withdrawals are temporarily suspended while its teams conduct security checks and work with law enforcement. The exchange said user funds were safe and it would cover hacking losses, which are estimated at $3.3 billion after accounting for frozen assets. Exactly how the hot wallets were authorized to delegate execution remains unconfirmed.
My takeaway: Self-custody is best if you can manage your own keys. EIP-7702 is not the issue here. But we do need to figure out opsec for private keys and wallet signing.
In Ethereum News
Amid the hack, there was an interesting phenomenon where the price of ETH diverged between CEXs and onchain DEXs. While the price was down on CEXs, the attacker used the stolen funds to purchase ETH onchain as fast as possible. Given the volume, the price of $ETH temperarily peaked toward $3,000 onchain.
The price surge was short-lived. Ethereum gas fees also topped to about 300 gwei during the incident. The prices have since settled. Polymarket also suffered a front end compromise resulting in about $2.5 million in losses.
In good news, Gattaca releases a new consensus layer client called Silver. Uniswap launches TJAR. Aztec releases Noir 1.0. And devs move EIP-8148 to CFI for Hegota.
P.S. If you can spare a few gwei, please support the ETH Daily Security initiative.
Disclaimer: Content is for informational and educational purposes only and does not constitute financial, investment, legal, or other professional advice. No representations or warranties are made as to accuracy, completeness, or timeliness. Use of this content is at your own risk, and you should consult a qualified professional before making decisions. No fiduciary or advisory relationship is created
