Press play to start listening
The cryprocurrency exchange Binance is investigating a suspected hack after billions of dollars moved from wallets associated with the exchange on October 29, 2026. Outside investigators have estimated the suspicious transfers at up to $5.8 billion, a figure that would make this the largest cryptocurrency theft publicly reported if confirmed.
The exchange has not confirmed that amount as stolen but confirmed that it was investigating the incident and assured customers that their funds were “completely safe.” Meanwhile, cryptocurrency issuers began freezing assets linked to the suspicious activity.
Billions Moved Before Issuers Froze Assets
Blockchain investigators began examining large transfers involving several networks, with their estimates changing as additional transactions were identified.
Blockchain security company Blockaid said in a tweet it was investigating approximately $3.3 billion in suspicious outflows involving Ethereum, Arbitrum and Avalanche. Coinbase executive Conor Grogan placed the amount as high as $5.8 billion.
Those figures represent assessments made at different stages of the investigation. They should not be added together or treated as Binance’s final loss.
Binance said in an October 30 update that approximately $3 billion had been verified as frozen. The exchange is working with law enforcement, token issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets. It reiterated that user funds are safe.
Freezing prevents affected tokens from being transferred under the issuer’s controls. It does not mean that the money has already been returned to Binance or establish how much the exchange will ultimately recover.
How the Incident Unfolded
As investigators traced the transfers, Binance began issuing updates and stablecoin issuers froze funds. The timeline below follows those developments using Decrypt’s reporting and Unchained’s account of the announcements. The initial compromise may have occurred before the first recorded transfer.
| Time | Reported development |
| 20.24 | An Ethereum transaction moved 167,464 ETH and multiple other tokens, according to Decrypt’s analysis. |
| 21.01 | Tether began freezing assets associated with the suspicious transfers. |
| 21.04 | Circle froze approximately $823 million in USDC. |
| 21.15 | Binance founder Changpeng Zhao (CZ) said the activity appeared to be a hack and that he expected customer funds to be covered. |
| 21.16 | Binance publicly acknowledged that it was investigating. |
| 21.29 | The exchange updated its statement to say user funds were completely safe. |
Researchers Examine a Signed Wallet Delegation
Investigators examining the Ethereum transfers identified a signed authorization shortly before the funds moved. The authorization used EIP-7702, an Ethereum feature that allows a wallet to delegate functions to smart-contract code.
Phylax Systems founder Odysseas Lamtzidi described how that delegation could allow code to execute through the affected wallet and authorize further transfers. Decrypt reported that the authorization appeared three minutes and 24 seconds before the initial Ethereum transaction.
That finding could explain part of the transfer mechanism, but it does not explain how the required signature was obtained. The available reporting has not established whether an attacker stole signing credentials, compromised a signing system or persuaded someone to approve a malicious request. Nor does the use of EIP-7702 itself demonstrate a flaw in Ethereum.
No Attacker Has Been Publicly Identified
Binance had not publicly attributed the incident to a named group in the statements reviewed for this report. The initial entry point, the people responsible and the full extent of access remained unknown. However, the incident comes about a month after Bitget reported a hack and suspected involvement by North Korea’s Lazarus Group.
CZ, who said he does not manage Binance anymore, wrote on X that the activity looked like a hack. Speaking as a shareholder, he said he expected all user funds to be fully covered. That was his expectation, separate from the exchange’s investigation and its own customer assurances.
If the upper estimates are confirmed as stolen funds, the incident would exceed the approximately $1.5 billion Bybit theft in February 2025. However, the gross value moved, the amount frozen and the eventual unrecovered loss are different figures. None should be substituted for another while the investigation continues.
Binance.US separately said it was unaffected.
Binance Warns Customers About Unofficial Messages
Customers seeking information were directed to Binance’s official announcements. In its initial statement, the exchange warned users about unofficial links, messages and requests for account information.
The unresolved questions now concern how the transfers were authorized, whether the attacker retains any access and how much of the moved cryptocurrency can be recovered. Binance’s assurance that customer funds are safe does not yet provide a final accounting of the incident.
