Binance suspends withdrawals as suspected hack drains more than $5.5 billion from its wallets

Binance has not formally confirmed a hack or put a figure on any loss. The amounts below are on-chain estimates by outside trackers, and they differ.

More than $5.5 billion in crypto left wallets linked to Binance, the world’s largest cryptocurrency exchange, on Thursday 29 October, according to on-chain trackers. Binance has suspended withdrawals on multiple networks and says user funds are safe. If the outflow is confirmed as a hack, it would be the biggest in crypto history, well ahead of the roughly $1.5 billion stolen from Bybit in February 2025.

What the blockchain shows. Decrypt’s tally put the outflow at $5.57 billion across Ethereum, Bitcoin and Tron: about $3.51 billion on Ethereum, $1.44 billion in 18,270 bitcoin and $630 million on Tron. Arkham Intelligence labelled a group of wallets “binance-hacker-1029” and reported they held about $5.84 billion, which Cointelegraph noted is a figure for holdings and not a confirmed estimate of stolen funds. CoinDesk, citing Arkham, put the total above $5.7 billion. Early reports had been lower, and TechCrunch said some estimates were as low as $2 billion.

The first Ethereum transaction was at 20:24 GMT, when 167,464 ETH and 63 token transfers, including about $1.6 billion in tether (USDT), went from a wallet labelled “Binance 14” to a brand-new address, according to Etherscan data cited by Decrypt. Another labelled wallet, “Binance 16”, sent 28,005 ETH to the same address 24 seconds later, BeInCrypto reported.

How it was done. About three minutes before the first transfer, an address funded through the Tornado Cash mixer set up an EIP-7702 delegation on Binance 14. EIP-7702 is an Ethereum feature that lets an ordinary wallet run smart-contract code. How the attacker obtained the authorisation is still unknown, Decrypt said. The security firm Blockaid said the attacker submitted 50 such authorisations in one transaction and only one took effect, according to a TechFlow report.

What Binance has said. At about 21:16 GMT Binance said on X that it was “aware of reports of a potential security issue” and had “not confirmed any impact to user funds”, Unchained reported. A revised statement at about 21:29 GMT said: “Rest assured that user funds are completely safe.” Spokesperson Ross O’Leary told TechCrunch that Binance had “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.”

Later posts on X, relayed by PANews, said some users were having withdrawal problems because of a technical error, and then that withdrawals would resume only once the security issue was fully resolved. Co-founder Yi He said withdrawals were suspended until the environment was confirmed safe and that user funds were “SAFU”, Binance’s name for its emergency reserve fund. No resumption had been announced as of 22:40 GMT on Thursday.

Binance founder Changpeng Zhao, who stepped down as chief executive in 2023 and no longer runs the exchange, wrote that “it does look like a hack on Binance”. As a shareholder, he said, he expects all user funds to be fully covered.

Freezes. Tether blacklisted the main receiving address at about 21:01 GMT and Circle froze 823 million USDC in it at about 21:04 GMT, Decrypt and Unchained reported. Tether froze 975.1 million USDT in that wallet; its chief executive, Paolo Ardoino, said the company had frozen more than $1.567 billion of USDT related to the incident in total. Circle chief executive Jeremy Allaire said Circle had frozen more than $800 million in USDC “in coordination with law enforcement”. Yi He also thanked Ripple for freezing about $200 million of related assets and World Liberty Financial for freezing $27 million of its USD1 stablecoin and 48 million WLFI tokens, PANews reported. These posts have not been independently verified.

Where the money is. The receiving address forwarded 195,460 ETH, worth more than $440 million, to another new address within about 15 minutes. Cryptoticker said that ether was still untouched at 22:13 GMT. The same report said the attacker had begun sending out tokens that stablecoin issuers cannot freeze, including 88.5 million RLUSD, 7.77 trillion PEPE and 217.5 million ENA, and had funded fresh wallets with small amounts of ETH for gas.

The attacker also used the Aave lending protocol. An address linked to the incident deposited about $60 million of USDT and borrowed 19,762 wrapped ether (about $44 million), according to Phylax Systems, which was cited by PANews. The Block and Crypto Briefing reported that Aave froze its lending markets on Avalanche to stop the attacker borrowing against stolen assets, although Aave had not published a statement at the time.

Markets. Bitcoin fell below $79,000, down about 3% on the day, and ether dropped under $2,240, BeInCrypto reported. BNB, Binance’s own token, fell about 7% to about $699, while the privacy coin Monero rose about 6% to $637, Decrypt said. Aave’s token fell about 8%, CoinDesk reported. Coinglass data showed $627.7 million of leveraged positions were liquidated in one hour, $606.6 million of them bets on rising prices. Binance itself accounted for $344.8 million of that total.

Context. Binance lost about 7,000 bitcoin, then worth about $40 million, in a 2019 hack, and covered users’ losses from its SAFU fund. Separately on Thursday, the prediction market Polymarket said one of its third-party providers had been breached, with losses of under $3 million, CoinDesk reported.

Binance has said it will provide updates through official channels and has warned users to ignore unofficial links, messages and requests for account information.