For years the record for the biggest crypto theft belonged to Bybit’s $1.5 billion loss in February 2025. On the evening of Thursday, October 29, 2026, Binance took it — by a factor of about four. In roughly twenty minutes starting at 20:05 UTC, attackers pulled funds out of Binance hot wallets on ten blockchains. Binance’s own estimate of the impact: about $6.3 billion.
Binance says user funds are safe and it will cover all losses. But the mechanics of the attack — and how much of it stablecoin issuers could freeze — are a lesson for everyone who keeps coins on an exchange.
Key facts
- On October 29, 2026, attackers drained Binance wallets on ten blockchains, mostly within about 20 minutes from 20:05 UTC, according to TRM Labs.
- Binance estimates the total impact at about $6.3 billion; TRM Labs counts about $6.36 billion, roughly four times the 2025 Bybit hack.
- On Ethereum, the hot wallet “Binance 14” was taken over via an EIP-7702 delegation and swept of 167,464 ETH and 63 tokens, including 1.615 billion USDT, in one transaction.
- Bitcoin outflows totalled 18,270 BTC (about $1.47 billion); the XRP Ledger lost 233.46 million XRP; Tron lost 612.7 million USDT and 46.4 million TRX.
- Tether froze 971.1 million USDT 37 minutes after the main sweep; Circle froze 823 million USDC; Ripple and World Liberty froze RLUSD and USD1. Binance reported $2.54 billion verified frozen by 23:35 UTC.
- Binance suspended deposits and withdrawals and said it will cover losses through its SAFU fund and company funds.
What happened in the Binance hack on October 29, 2026?
Attackers obtained the ability to sign transactions from Binance hot wallets and used it across ten chains in quick succession. The first outflows hit five XRP Ledger wallets between 20:05 and 20:09 UTC; Solana, Optimism, Bitcoin and Tron followed; at 20:20 UTC the attacker took control of Ethereum hot wallet “Binance 14” and swept it at 20:24. A second wave hit Avalanche and Polygon around 23:05 UTC.
According to TRM Labs’ analysis, preparation started at least 36 hours earlier: three small Tornado Cash withdrawals funded an operator wallet on October 28, and the attack code was tested on two wallets and rehearsed on a third before being used against Binance.
How EIP-7702 was used
EIP-7702, live on Ethereum since the Pectra upgrade in May 2025, lets a wallet delegate its behaviour to a smart contract via a signed authorisation. At 20:20 UTC the operator submitted one transaction carrying 50 authorisations signed with the Binance 14 key, each pointing to a sweeper contract — pre-signed for 50 consecutive nonces so one would match. One did. Three minutes and 24 seconds later, the full balance left. The delegation stayed active and caught later incoming funds too.
The chain worked perfectly. It executed exactly what Binance’s own keys signed.
How much did stablecoin issuers freeze?
Billions — fast. Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the sweep, plus further balances on Ethereum, Tron, Avalanche and Polygon. Circle froze 823 million USDC at 21:04 in coordination with law enforcement. Ripple froze 40.5 million RLUSD of 88.5 million taken; World Liberty froze 27.8 million USD1. Arbitrum’s Security Council used emergency powers to move about $30 million out of the attacker’s reach.
Binance reported $2.54 billion in verified frozen funds by 23:35 UTC; TRM counted about $2.7 billion by 00:30 UTC on October 30. What couldn’t be frozen was native coins: the attacker still controlled more than 420,000 ETH and 18,270 BTC — about $2.4 billion beyond any issuer’s reach. Some USDT had already been sold through intent-based DEX contracts at a discount of more than 10% before freezes landed.
Are Binance user funds safe?
Binance says yes. Co-CEO Yi He wrote that user funds are “SAFU” and that Binance will cover all hacking losses through its SAFU fund and company funds. Binance suspended deposits and withdrawals, revoked the affected authorisation and promised proof of reserves and a post-mortem. In its official announcement, it said it was investigating with partners.
The market moved, but less than the headline might suggest. BNB fell about 6% in 24 hours to around $711; Bitcoin was near $79,400 and Ether near $2,287 at 21:26 UTC. DefiLlama counted about $144 billion in Binance’s public wallets before the hack, so the loss is roughly 4.4% of visible holdings. This is not financial advice.
What this means for exchange users and swap users
A hot wallet is, by design, a wallet whose keys sit on internet-connected systems so withdrawals can be processed automatically. Every exchange has one. When the signing infrastructure behind it is compromised, the user on the other side has no say — only the exchange’s balance sheet stands between the loss and the customer.
That’s the core argument for keeping only trading balances on exchanges and holding the rest in self-custody. If you need to convert while an exchange has paused withdrawals, you can’t — your coins are inside. With a non-custodial swap on SwapZilla, coins go from your wallet to a provider and back to your own address, without an account balance that can be frozen. Our analysis of CEX risk and cold storage guide go further.
Final thoughts
October 29 rewrote the record book: about $6.3 billion in one evening, roughly 40% of it frozen within hours, the rest moving on-chain. Binance can absorb it. The lesson for users doesn’t depend on whether it can: if the keys aren’t yours, the risk isn’t either — until the day it is.