PT

Binance hack: what we know and where the money is going

On October 29, 2026, between $2.8B and $5.87B left Binance's hot wallets within minutes, in what may be the largest exchange theft in history. The same day, Polymarket and Indodax also paused operations. Below: the attacker's wallet tracked live, the latest news and the numbers for each incident, with sources.

$2.8B+minimum estimate stolen from Binance
…in the hacker's wallets right now
…movable (not frozen)
…left the wallets in the last hour

Hacker wallet live

Binance Hot Wallet Exploiter 2 0x5227…2f8c Etherscan · Arkham · Blockscout · label: FinanceFeeds
Received ~167,464 ETH and 1.615B USDT from "Binance 14" at 20:24 UTC; then began dispersing tokens that cannot be frozen
…total balance
…movable
…priced assets
Binance Hot Wallet Exploiter 0x7C86…5CA0 Etherscan · Arkham · Blockscout · label: Etherscan
Address that triggered the attack; funded with 0.1 ETH from Tornado Cash on Oct 28
…total balance
…movable
…priced assets

Latest movements

Loading on-chain transactions…

Latest news live

  • Loading news…

Ethereum data via Blockscout, refreshed every 60 s. USDT, USDC, USD1 and PAXG show in the balance but were frozen by their issuers and cannot be moved. Arkham groups 55 addresses under the entity binance-hacker-1029, including Bitcoin and Tron wallets.

Incidents

Binanceactive

Exchange ·
$2.8B – 5.87B

Abnormal outflows from several hot wallets within minutes. Binance confirmed a "security incident", suspended withdrawals on some networks and says user funds are safe. CZ said it "does look like a hack" and that the company will cover the loss. Tether and Circle froze stablecoins tied to the attacker.

Vector: EIP-7702 delegation on the "Binance 14" hot wallet, triggered by an address funded through Tornado Cash

  • Estimates: $2.8B (Binance 14 alone) · $3.3–3.5B (Ethereum) · up to $5.6–5.87B including BTC (~18,270 BTC) and Tron (~$630M). Arkham maps $5.87B across more than 80 assets
  • Frozen: Binance says $2.54B has been verified as frozen. By issuer: Tether ~$1.567B, Circle ~$823M, Ripple ~$200M, World Liberty Financial $27M in USD1 and Paxos ~$8M in PAXG, for a total above $2.6B
  • ~204,500 ETH left the hot wallets (~5.6% of Binance's ETH reserves), including 167,464 ETH from Binance 14 and 28,005.6 ETH from Binance 16. Binance 14 was part of the Oct 1 proof-of-reserves report
  • Withdrawals at 22:32 UTC: BTC, ETH, USDT/USDC (Ethereum), USDT (Tron, BSC, Arbitrum) open; Solana, XRP and stablecoins on Solana, Optimism, Avalanche, NEAR and Polygon paused
  • Binance has not confirmed the method. Blockaid's preliminary analysis: the signing infrastructure was compromised and no key leaked. The attacker bundled 50 EIP-7702 authorizations into one transaction, and one of them had the correct nonce
EthereumBitcoinTronArbitrumAvalanche
Sources: TechCrunch · The Block · Unchained · CryptoTicker · BleepingComputer · FinanceFeeds · CoinDesk · Cointelegraph · CryptoSlate · Livecoins

Polymarketactive

Prediction market ·
$2.7M

Exchange put in cancel-only mode and relayer actions paused. A suspected attacker wallet holds ~$2.65M in POL (Arkham data). Appears to be separate from the Binance incident.

Vector: Under investigation — users report unauthorized withdrawals

Polygon
Sources: Decrypt

Indodaxmonitoring

Exchange ·
no confirmed loss

Indonesia's largest exchange suspended rupiah and crypto deposits and withdrawals as a precaution. It says it found no unauthorized withdrawals.

Vector: Significant increase in attack attempts

Sources: Crypto Briefing · TokenPost

Bitgetcontained

Exchange ·
$387.5M – 388M

Initial $351.6M estimate revised to ~$387.5M after adding Zcash and Tron assets. It was 2026's largest theft until Binance. The CEO suspects a North Korean group; Elliptic calls the link "highly likely".

Vector: Hot/warm wallets (12 addresses). Suspected Lazarus (North Korea)

EthereumTronZcash
Sources: PYMNTS · BeInCrypto

Liquid Networkresolved

Protocol ·
$320M

About $320M drained; most of it was later returned.

Vector: Exploit; attackers claimed to be white hats

Sources: Cryptonews

KelpDAO / Drift Protocolcontained

DeFi ·
$285M – 292M

Two incidents in April, each in the $285–292M range.

Vector: Separate DeFi protocol exploits

Sources: Cryptonews

How the Binance attack worked (as far as we know)

  1. A fresh address received 0.1 ETH from Tornado Cash on October 28, hiding its origin.
  2. That address deployed a contract and registered an EIP-7702 delegation on the "Binance 14" hot wallet. The feature lets a regular account run a contract's code.
  3. With the delegation active, ~167K ETH and 1.6B USDT moved to "Exploiter 2" at 20:24 UTC; other wallets were drained on Bitcoin and Tron.
  4. Tether, Circle and Ripple froze part of the stablecoins. From 21:22 UTC the attacker began swapping and dispersing tokens that cannot be frozen.

Binance has not confirmed how the attacker obtained the signature for the delegation. In a preliminary analysis, Blockaid says the signing infrastructure was compromised and no key leaked: the attacker bundled 50 EIP-7702 authorizations into one transaction, and one of them had the correct nonce. The firm sees similarities with the 2025 Bybit attack. The same vector was previously used against an institutional wallet (973K MORPHO), according to Phemex.

If you have an exchange account

  • Use only the official app and website. Scammers exploit incidents to send fake "refund" or "verification" links.
  • No exchange will ask for your password, seed phrase or 2FA code by message.
  • Don't rush to withdraw on paused networks — transactions may get stuck.
  • Review your API key permissions and withdrawal whitelist.

Frequently asked questions

Was Binance hacked?

On October 29, 2026, billions of dollars left Binance's hot wallets for addresses linked to an attacker. Binance confirmed a security incident, paused withdrawals on some networks and says user funds are safe. Former CEO Changpeng Zhao (CZ) said it "does look like a hack" and that the loss will be covered.

How much was stolen from Binance?

Estimates range from $2.8 billion to $5.87 billion. About $3.3–3.5B left on Ethereum, ~18,270 BTC ($1.44B) on Bitcoin and ~$630M on Tron. Arkham maps $5.87B across more than 80 assets. Binance has not disclosed an official figure.

What is the Binance hacker's wallet address?

Etherscan labels 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c as "Binance Hot Wallet Exploiter 2" (received the funds) and 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 as "Binance Hot Wallet Exploiter" (triggered the attack). Arkham groups 55 addresses under the entity "binance-hacker-1029".

How did the attack work?

An address funded through Tornado Cash registered an EIP-7702 delegation on the "Binance 14" hot wallet, pointing to a contract it had deployed. That let the contract move the wallet's balance. Binance has not confirmed the method; Blockaid's preliminary analysis points to a compromise of the signing infrastructure, not a leaked key.

Are Binance withdrawals working?

Partially. At 22:32 UTC on Oct 29, withdrawals of BTC, ETH, USDT and USDC (Ethereum) and USDT on Tron, BSC and Arbitrum were open. Solana, XRP and stablecoins on Solana, Optimism, Avalanche, NEAR and Polygon were paused.

How much has been frozen?

Binance says $2.54B has been verified as frozen, and the figure may rise. By issuer: Tether ~1.567B USDT, Circle ~$823M in USDC, Ripple ~$200M, World Liberty Financial $27M in USD1 and Paxos ~$8M in PAXG, for a total above $2.6B.

Which other crypto platforms were attacked?

The same day, Polymarket went cancel-only after unauthorized withdrawals (~$2.65M), and Indodax suspended deposits and withdrawals over attack attempts. The day before, the zkLink Nova bridge lost ~$780K and halted its network. In September 2026, Bitget lost ~$387.5M, with the North Korean Lazarus group suspected.