By About $3.3 billion in crypto left Binance hot wallets on Ethereum on Thursday evening in what blockchain data, block explorer Etherscan and Binance founder Changpeng Zhao now describe as a likely hack. Binance itself has not yet confirmed a breach.
The transfers drained ETH, stablecoins and more than 60 other tokens from two Binance hot wallets within 20 minutes. Trackers following the activity across six blockchains put total movement at as much as $3.55 billion. Tether and Circle have since frozen about $1.8 billion of the stablecoins involved.
Zhao, who stepped down as Binance CEO in 2023, wrote on X at 21:15 UTC that user funds are safe and that “it does look like a hack on Binance.” He thanked Tether and Circle for freezing roughly $971 million and $823 million respectively, and said that while he no longer runs Binance.com, as a shareholder he expects all user funds to be fully covered.
Binance itself has been more cautious. A spokesperson told Cointelegraph that the exchange was investigating reports of a potential security issue but had not confirmed any impact on user funds.
Key Takeaways
About $3.3 billion left two Binance hot wallets on Ethereum between 20:24 and 21:04 UTC on 29 October.
Etherscan has tagged the sending and receiving addresses as “Binance Hot Wallet Exploiter”.
The sender was funded through Tornado Cash and used a smart contract it deployed hours earlier.
Tether and Circle froze about $1.8 billion; roughly $700 million in USDT and $445 million in ETH moved on before or outside the freeze.
Binance says it is investigating and has not confirmed any impact on user funds. CZ says user funds are safe.
Was Binance Hacked? What the On-Chain Data Shows
At 20:24 UTC, the wallet labelled “Binance 14” sent about 167,464 ETH (around $380 million), 1.615 billion USDT and 62 other tokens, including RLUSD, wBETH, XAUt, UNI and USD1, to a fresh address in a single transaction worth roughly $2.5 billion.
Source: Etherscan, transaction 0x53bd38b8…e88e2f3, 20:24 UTC, 29 October 2026
Seventeen minutes later, “Binance: Hot Wallet 34” sent 780 million USDC to the same destination, followed by a further 43 million USDC at 20:59 UTC. A third wallet, Binance 16, sent about 28,006 ETH. Smaller balances were still being swept out of Binance 14 as late as 21:04 UTC.
Source: Etherscan, transaction 0xdc102dd8…e17481, 20:41 UTC, 29 October 2026
The receiving address forwarded about 195,460 ETH, worth roughly $445 million, to another new wallet within minutes. It also split 1.2 billion USDT across new addresses, testing each route with a small transfer first.
Source: Etherscan, address 0x5227f603…CB2f8c
Why Investigators Are Calling It an Exploit
Large exchanges move funds between their own wallets every day, and the first reports raised wallet maintenance as a possible explanation. Three details in the transaction data make that explanation harder to sustain.
First, the withdrawals were not sent by Binance 14 itself. They were triggered by a separate address, 0x7C86…5CA0, which Etherscan shows was funded through Tornado Cash, the Ethereum mixing service sanctioned by the US Treasury in 2022 and later delisted. The address received its first ETH from Tornado Cash on 28 October.
Source: Etherscan, address 0x7C8601d4…6B5CA0
Second, the same address deployed the smart contract that executed the withdrawals at 15:59 UTC, more than four hours before the drain. At 20:20 UTC, Binance 14 was switched to run that contract’s code through an EIP-7702 delegation. EIP-7702, introduced with Ethereum’s Pectra upgrade, lets a regular wallet temporarily behave like a smart contract. Setting a delegation requires a valid signature from the wallet’s own private key.
Source: Etherscan, transaction 0xad99264d…51298b, 20:20 UTC, 29 October 2026
Third, the same Tornado-funded address ran identical delegate-and-sweep transactions against three smaller wallets earlier in the day, in what looks like a test run before the main transfer.
Exchange-run infrastructure is not normally funded through a mixer. Taken together, the pattern suggests that whoever controlled the address was able to sign on behalf of a Binance hot wallet. Etherscan has labelled the sender “Binance Hot Wallet Exploiter” and the receiving wallet “Binance Hot Wallet Exploiter 2”, both marked with an “Exploit” tag.
The incident also drew a wave of address-poisoning transactions. Fake tokens named to look like ETH and USDT were sent to look-alike addresses, a tactic FinanceFeeds recently examined in its coverage of how address-poisoning attacks can manipulate transaction histories. Those decoy transfers do not change the main picture.
Investor Takeaway
Binance has not confirmed a hack, but the on-chain evidence, Etherscan’s exploit labels and CZ’s own comments all point the same way. The key question is now how much of the $3.3 billion can be recovered.
Tether and Circle Freeze $1.8 Billion
Stablecoin issuers moved within the hour. On-chain checks by FinanceFeeds show that the main receiving address is now blacklisted by both Tether and Circle, locking about 975 million USDT and 823 million USDC in place. Some reports put Tether’s total freeze at more than 1.5 billion USDT; FinanceFeeds could not verify the additional amount on Ethereum.
The freezes did not catch everything. The two wallets that received 700 million USDT from the attacker at around 20:30 UTC had already moved those funds on, through further wallets and decentralized exchange pools including Uniswap, by the time they were blacklisted. The roughly 195,460 ETH and many of the other tokens cannot be frozen by an issuer in the same way.
That leaves somewhere above $1.1 billion beyond the reach of the freezes so far, depending on how the remaining token balances are valued and whether issuers such as Ripple and Tether Gold act on RLUSD and XAUt.
A similar dispute over early on-chain evidence followed suspicious movements from CoinDCX-linked wallets earlier this month. FinanceFeeds reported that CoinDCX initially denied a fresh $16 million hack before later confirming a $15.99 million loss.
Crypto Market Reaction
Crypto prices fell as reports of a possible Binance hack spread. According to CoinGecko, Bitcoin was trading around $79,100 shortly after 21:15 UTC, down 2.7% in 24 hours. Ether fell 3.9% to about $2,270, and BNB dropped 5.4% to $716. PANews reported $629 million in liquidations across the crypto market in a single hour, almost all of them long positions.
What Happens Next for Binance Users
Binance created its Secure Asset Fund for Users (SAFU) to cover customers in security incidents. FinanceFeeds’ analysis of Binance’s SAFU reserve and its previous deployment shows that the fund was used after the exchange’s confirmed 2019 hot-wallet breach, when about 7,000 BTC were stolen.
Beyond its comments to Cointelegraph, Binance had not published a formal statement at the time of writing. On 27 October, the exchange said its security team had blocked several North Korea-linked cyberattacks over the previous week with no loss of user assets.
Users should watch for an official Binance update on deposits and withdrawals, confirmation of whether SAFU will cover the loss, and any recovery or bounty offer. If questions about reserves continue, FinanceFeeds has explained how crypto exchange proof-of-reserves systems work.
FinanceFeeds will update this story as Binance and security firms respond.
Investor Takeaway
CZ expects users to be made whole, but only Binance can commit to that. The next signal to watch is whether Binance keeps withdrawals open while it investigates.