Note: this story was developing as of the morning of 30 October 2026. Figures below reflect what was confirmed at the time of writing and may be revised.
Overnight on 29–30 October 2026, Binance — the world's largest cryptocurrency exchange — was hit by the biggest crypto theft in history. The estimated damage: around $6.3 billion, roughly four times the previous record. Here is what happened, how the attackers pulled it off, and what it means for anyone with money on the platform.
What happened: the timeline
The attack began at 20:24 UTC on 29 October, according to on-chain data. The first big movement was 167,464 ETH (worth about $388 million at the time) drained from a wallet labelled "Binance 14". Minutes later, another 28,005.6 ETH left "Binance 16". On top of that, roughly $823 million in USDC was taken. Blockchain analysts at Etherscan quickly tagged the receiving addresses as the "Binance Hot Wallet Exploiter".
Independent estimates of the total theft vary: Chainalysis put it at $5.912 billion at the time of the theft, Glassnode at $5.3–5.9 billion, while Binance's own estimate stands at around $6.3 billion. Binance says it will only share confirmed figures as the investigation continues.
How the attackers got in
Binance's initial finding is that this was not a private-key leak — the classic way exchanges get drained. Instead, the attackers compromised a DevOps engineer's laptop, used it to reach a service container, and then triggered unauthorised withdrawals using something called EIP-7702.
EIP-7702 is a relatively new Ethereum feature that lets a normal wallet temporarily act like a smart contract. In plain English: it gave the attackers a way to authorise transfers from Binance's hot wallets without ever holding the actual private keys. It's a reminder that in crypto, the weakest link is often not the cryptography — it's the humans and the machines around it.
Investigators also noted the attacker's wallets were funded through Tornado Cash, a mixing service used to obscure the origin of crypto funds — a common step in laundering stolen coins.
Where the money went — and how much got frozen
One unusual thing about crypto heists is that everything happens in public. The stolen funds sit on the blockchain for everyone to see, and the industry can move to freeze them. Here's what had been frozen as of the morning of 30 October:
| Frozen by | Amount | Asset |
|---|---|---|
| Tether (CEO Paolo Ardoino) | $1.567 billion | USDT |
| Circle (CEO Jeremy Allaire) | $800+ million | USDC |
| Ripple | ~$200 million | XRP ecosystem |
| Arbitrum Security Council | ~$30.5 million | ARB ecosystem |
| World Liberty Financial | $27 million | USD1 |
In total, Binance said around $3 billion had been frozen on-chain within hours of the attack. That's a coordinated industry response at a scale we've never seen before.
Hot wallets vs cold wallets: why billions sit online
One question readers always ask after a hack like this: why was $6 billion sitting in wallets connected to the internet in the first place? The answer is the trade-off every exchange lives with.
A hot wallet is connected to the internet so it can process deposits and withdrawals instantly — exactly what users expect from an exchange. A cold wallet is kept offline (often on hardware locked in a vault), making it nearly impossible to hack remotely, but useless for day-to-day transactions. Exchanges keep most customer funds in cold storage and a working float in hot wallets. The problem is scale: when you're the world's largest exchange, even a small working float is billions of dollars. That float is the prize attackers go after, and as this theft shows, the attack surface isn't just the wallet software — it's every laptop, container and API key in the building.
Will users lose their money?
This is the question that matters to Binance's hundreds of millions of users. The answer so far: Binance says no.
Co-CEO Yi He pledged that the exchange will cover all user losses, drawing on its SAFU fund — the Secure Asset Fund for Users, an emergency insurance pool holding roughly $1 billion in bitcoin — plus company funds. Founder Changpeng "CZ" Zhao posted on X: "User funds are safe! It does look like a hack… I expect all user funds will be fully covered."
Some context from the proof-of-reserves data: the "Binance 14" wallet held 1.26 billion USDT plus 89,475 ETH in the 1 October proof-of-reserves snapshot. The roughly 204,500 ETH taken represents about 5.6% of Binance's ETH reserves, with ETH backing near 94% after the theft. Deposits and withdrawals were temporarily suspended while the team secured the platform, and Binance promised an updated proof-of-reserves report.
Why this matters even if you don't own crypto
A theft this size shakes the whole market. In the hours after the news broke:
- Bitcoin fell below $77,000 (around $76,664 late Thursday evening ET, ~$76,573 in Friday's Asian morning session)
- BNB, Binance's own token, dropped 7.1% to $698.65
- $1.55 billion in positions were liquidated, with 246,482 traders liquidated in a single day, according to CoinGlass and The Block
For perspective on the scale: the previous record holder was the Bybit hack of February 2025, at about $1.5 billion — attributed to North Korea-affiliated hackers. This theft is roughly four times larger. It also raises hard questions about centralised exchanges: billions of dollars in customer funds sit in hot wallets that need to stay online to process withdrawals, and that convenience is exactly what attackers target.
The story also connects to a broader theme we've covered before: blockchains are transparent by design, which is why the industry could coordinate a $3 billion freeze in hours. Learn more about how the underlying technology works in our explainer on blockchain beyond crypto, and for the anatomy of digital extortion schemes, see how ransomware works.
Takeaway checklist
- The scale is unprecedented: ~$6.3 billion stolen, ~4x the previous record (Bybit, $1.5B).
- The method was new: a compromised DevOps laptop plus EIP-7702 smart-wallet trickery — no private keys stolen.
- ~$3 billion was frozen within hours thanks to blockchain transparency and industry coordination.
- Binance pledges full user reimbursement from its ~$1B SAFU fund plus company reserves; withdrawals are paused for now.
- Markets reacted hard: bitcoin under $77K, BNB down 7%, $1.55B in liquidations.
- Figures are still being confirmed — treat every number above as "as of 30 October morning" and check for updates.
