A suspected security breach at Binance has grown into a multibillion-dollar cryptocurrency emergency, with analysts tracking as much as $5.8 billion in potentially compromised assets across several blockchains. The exchange suspended withdrawals on October 29 while Tether, Circle, and other issuers froze more than $2 billion in tokens. Binance maintains customer funds are safe, but investigators are examining how a sophisticated wallet-delegation maneuver may have enabled one of the largest cryptocurrency thefts on record.
The Initial Breach
The incident began on Thursday, October 29, 2026, when cryptocurrency began flowing out of Binance-linked addresses. One Ethereum transaction reportedly swept away approximately 167,464 ETH, 1.615 billion USDT and dozens of other tokens. Within 40 minutes, one receiving address had collected an estimated $3.52 billion.
Subsequent analysis identified additional movements involving bitcoin, Tron and other networks, pushing some estimates beyond $5.5 billion. Stablecoin companies raced to freeze the proceeds, Binance stopped withdrawals, and founder Changpeng Zhao acknowledged that the activity appeared to be a hack. The exchange itself has yet to confirm a final theft amount or its financial toll.
Technical Analysis
The leading technical explanation centers on EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025. The feature allows an ordinary cryptocurrency wallet to authorize a smart contract to execute instructions on its behalf.
Investigators identified a delegation transaction submitted at approximately 4:20 p.m. Eastern time on the day of the breach. According to Blockaid's analysis, the transaction contained 50 authorizations designed to account for different transaction counters, known as nonces. One matched.
About three minutes later, the wallet's assets were swept into an external address. Researchers also identified a contract deployed earlier that day and an associated address funded through Tornado Cash, a cryptocurrency privacy protocol.
Analysts are examining whether the attacker obtained a private key, tricked an authorized signer into approving malicious instructions or compromised another part of Binance's signing infrastructure. However, the movements on Bitcoin and Tron networks remain unexplained, leaving investigators with a considerably larger puzzle.
Stablecoin Freezes
While investigators worked through the transaction history, stablecoin issuers began blocking access to assets linked to the suspected exploit. Tether CEO Paolo Ardoino reported freezing more than 1.567 billion USDT. Circle CEO Jeremy Allaire confirmed his company had frozen more than 800 million USDC in coordination with law enforcement.
Binance co-CEO Yi He credited Ripple with freezing approximately $200 million, while World Liberty Financial co-founder Zach Witkoff reported a separate freeze involving about $27 million in USD1. Together, these reported actions represent approximately $2.6 billion, though the figures have not been independently reconciled.
Freezing a token is not the same as returning it to its rightful owner. Centralized stablecoin issuers can block transfers from designated addresses, but native assets such as bitcoin and ether lack an equivalent issuer-controlled freeze mechanism. Analysts observed the suspected operator moving ether between wallets, swapping tokens through decentralized trading infrastructure and borrowing against cryptocurrency collateral.
Binance's Response
Binance acknowledged a potential security issue and said its teams were investigating. The exchange suspended withdrawals while conducting security checks, promising to restore access once the issue was resolved, and maintained that customer funds were completely safe.
Changpeng Zhao, who stepped down as CEO in 2023, offered a more direct assessment. It does look like a hack on Binance, he wrote on X, while emphasizing that he no longer manages the exchange. As a shareholder, he said he expected all customer funds to be covered and suggested the loss might be higher than initially reported.
Binance Co-Founder and Chief Customer Service Officer Yi He stated: User funds are safe. Binance will cover all hacking losses. She added that deposits and withdrawals were temporarily suspended while the team conducted security checks and worked with law enforcement.
Market Impact
The incident occurred during an already difficult trading session. Bitcoin fell toward $76,000 before recovering somewhat, while ethereum declined approximately 4.6 percent and BNB lost nearly 7.7 percent. Coinglass data shows roughly $1.4 billion in leveraged positions were liquidated within 24 hours, predominantly bullish bets.
Outstanding Questions
Investigators must determine which transfers were unauthorized, how the necessary wallet permissions were obtained and whether the assets circulating through external addresses can be recovered. Binance must answer whether customer funds will be genuinely protected when withdrawals resume.
Questions about the attacker's identity also remain unanswered. Some researchers raised the possibility of North Korean involvement, but no official attribution has been established.
