Binance Reports $6.3 Billion in Unauthorized Withdrawals
Binance is investigating a major security breach after attackers gained access to its hot wallet infrastructure on October 29, 2026. The exchange estimates that approximately $6.3 billion in cryptocurrency was affected by unauthorized withdrawals.
In its October 30 security update, Binance said the incident began at around 20:05 UTC. The company confirmed that its hot wallets had been compromised and said it would absorb the financial impact rather than pass the losses on to customers.
The scale of the incident has put the security of centralized exchanges under renewed scrutiny. Investigators are now examining how the attackers gained access, how withdrawal controls were bypassed and where the stolen assets went.
How the Attack Used Ethereum’s EIP-7702
One part of the incident involved Ethereum’s EIP-7702 functionality, introduced as part of the Pectra upgrade in May 2025. The feature allows an externally owned account, commonly called an EOA, to delegate certain operations to smart-contract code.
In the Binance incident, an attacker used this mechanism against a wallet identified as Binance 14. Blockchain records show that an attacker-controlled contract was authorized to operate the wallet. The attacker prepared 50 authorizations with consecutive nonce values, but only one was accepted by the network.
At approximately 20:24 UTC on October 29, the malicious contract transferred around 167,464 ETH and 63 other tokens, including approximately $1.6 billion in USDT. Further transfers followed as funds continued arriving in the affected wallet.
The important distinction is that EIP-7702 is a feature of Ethereum, not evidence of a failure in the Ethereum network itself. The investigation needs to establish how the attacker obtained the valid authorization that allowed the contract to operate a Binance-controlled wallet.
Read the Ethereum EIP-7702 specification and the main Ethereum transaction on Etherscan.
Investigators Trace Funds Across Multiple Blockchains
The Ethereum transactions represent only one part of the reported breach. Binance's estimate covers assets affected across multiple blockchain networks.
Bitquery's investigation identified activity involving 17 Binance hot wallets across nine networks. The movement of funds across different chains has required investigators to track transactions, identify destination wallets and follow assets as they are exchanged or transferred.
The Bitcoin portion of the incident also drew attention. Approximately 18,270 BTC was reportedly taken and distributed across 19 addresses. Tracking these addresses provides investigators with a way to monitor subsequent movements, although visible blockchain transactions do not guarantee that the funds can be recovered.
Bitquery has published its onchain investigation of the Binance incident, providing transaction-level analysis of the affected wallets and asset movements.
How the Stolen Funds Were Moved
Following the initial withdrawals, investigators observed rapid transfers between wallets and attempts to exchange some of the stolen assets.
Chainalysis described thousands of transactions that repeatedly moved funds through different addresses. Its analysis identified a sequence in which approximately $500 million in stablecoins reached a conversion wallet. Around $325 million was exchanged for approximately $285 million in ETH over nearly 20 minutes, while another $175 million moved through intermediary wallets.
These movements complicated the process of following the stolen funds. Converting stablecoins into other cryptocurrencies can also make intervention more difficult because the freezing capabilities available to some token issuers do not apply in the same way to assets such as Bitcoin and Ether.
Chainalysis continues to document the transaction patterns and response efforts in its Binance exploit investigation.
Stablecoin Issuers Freeze Assets Linked to the Breach
Crypto companies and token issuers responded by restricting assets associated with identified addresses. Circle froze approximately $823 million in USDC, while Tether froze more than $1.5 billion in associated assets. Other industry participants also took action.
Binance said that approximately $3 billion had been frozen onchain by October 30. The amount represents assets restricted through coordinated response efforts, not money that has necessarily been returned to the exchange.
That distinction matters. A freeze can prevent certain tokens from being moved, but the eventual recovery of those assets may require further technical procedures, legal steps and cooperation between the relevant companies and authorities.
Investigators are continuing to trace funds that have not been frozen and monitor whether they move through additional wallets or exchanges.
Binance Says the Investigation Found Additional Breach Points
Binance's initial investigation pointed to a potentially compromised laptop belonging to a DevOps engineer. The exchange said the device may have provided access to a service container used in the withdrawal process.
However, the company later disclosed that its investigation had identified additional points of breach beyond the laptop initially suspected. Binance also said it had found no evidence that wallet private keys were leaked.
Co-CEO Richard Teng cautioned against treating the incident as a simple case of one employee's permissions being abused. He described the attack as a more complex process, while the exchange continued working with internal and external security specialists to establish the full sequence of events.
Binance said it had contained the affected infrastructure, revoked compromised authorizations and introduced additional security controls. The malicious authorization associated with Binance 14 was revoked at approximately 00:10 UTC on October 30.
The precise route through which the attackers obtained the required authorizations remains an important unanswered question.
Binance Sets Aside $6.34 Billion to Cover the Losses
Binance temporarily suspended withdrawals while it reviewed the affected systems and carried out additional security checks. Deposits and other unaffected platform services remained operational.
In its second security update, the exchange said it had set aside more than $6.34 billion in company funds to cover the incident. Approximately $5 billion was already held in the same types of tokens affected by the theft, including USDC, USDT, BTC, ETH and BNB. Binance said it was purchasing the remaining assets through market and over-the-counter channels.
The company said the losses would be covered through its Secure Asset Fund for Users, known as SAFU, and its corporate treasury. It stated that customers would not bear the financial impact.
Binance also said it was targeting a phased restoration of withdrawals within approximately 34 hours of its October 30 update, subject to security checks. An updated Proof of Reserves snapshot was planned, with results expected by November 2, 2026.
The exchange committed to publishing a technical post-mortem once its findings had been verified and could be disclosed without affecting the ongoing investigation.
The details of the recovery plan are available in Binance's official Security Incident Update #2.
What Remains Unresolved
The investigation now centres on several questions: how the attackers obtained valid transaction authorizations, how the affected wallet infrastructure was compromised, and how much of the stolen cryptocurrency can ultimately be recovered.
Binance has committed company funds to cover the reported losses, but that commitment is separate from the process of retrieving stolen assets. The approximately $3 billion reported frozen onchain should not be treated as fully recovered funds.
The incident also demonstrates why exchange security involves more than protecting private keys. Transaction approval systems, internal access, software infrastructure and monitoring procedures can all become critical points of failure.
For Binance, the next important milestones are the restoration of withdrawals, the updated Proof of Reserves report and the publication of its technical investigation. Until those findings are available, the full attack sequence and the final recovery figure remain unresolved.
