On the afternoon of 29 October 2026 (US Eastern time), large unexplained outflows left Binance hot wallets. Binance told TechCrunch it is dealing with a security incident, said it is "actively investigating" a "potential security issue", and suspended deposits and withdrawals while it runs security checks, freezes funds and works with law enforcement. Co-founder Yi He said Binance "will cover all hacking losses" and promised a full post-mortem. No date for resuming withdrawals has been given.
How much was taken is not settled. Binance has published no figure. Blockaid is investigating about $3.3 billion of suspicious outflows; Glassnode puts it near $5.3 billion, Arkham at more than $5.7 billion and Chainalysis at roughly $5.9 billion. Blockaid's CEO called it "the biggest crypto hack in history". For comparison, the 2025 Bybit theft was about $1.4–1.5 billion.
What analysts saw on-chain: around 16:20 ET a delegation transaction changed the control of an Ethereum hot wallet labelled "Binance 14"; about three minutes later its assets were swept to an outside address, which collected an estimated $3.5 billion within 40 minutes. Blockaid says the attacker "effectively reprogrammed" the wallet so one operator could drain it and had rehearsed on test wallets. EIP-7702 delegation is the leading theory, but a stolen key, a tricked signer or compromised signing infrastructure have not been ruled out — and it would not explain movements reported on Bitcoin and Tron.
Containment: Tether froze more than 1.56 billion USDT and Circle more than 800 million USDC; Ripple, World Liberty Financial and the Arbitrum Security Council reported smaller freezes. The attacker swapped tokens through Uniswap and borrowed ether on Aave against stolen USDT, so Aave froze lending markets; Aave says its contracts are unaffected. Binance.US says it is a separate platform and is not affected. BNB fell about 5–8% and bitcoin dipped below $77,000.
Who did it is unknown. ZachXBT and Blockaid say North Korea is "likely" responsible, but there is no official attribution. Figures will change as the investigation continues.
