Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion Frozen

Listen to this article

Press play to start listening

The cryprocurrency exchangeBinanceis investigating a suspected hack after billions of dollars moved from wallets associated with the exchange on October 29, 2026. Outside investigators have estimated the suspicious transfers at up to $5.8 billion, a figure that would make this the largest cryptocurrency theft publicly reported if confirmed.

The exchange has not confirmed that amount as stolen but confirmed that it was investigating the incident and assured customers that their funds were “completely safe.” Meanwhile, cryptocurrency issuers began freezing assets linked to the suspicious activity.

Blockchain investigatorsbegan examining large transfers involving several networks, with their estimates changing as additional transactions were identified.

Blockchain security company Blockaidsaid in a tweetit was investigating approximately $3.3 billion in suspicious outflows involving Ethereum, Arbitrum and Avalanche. Coinbase executive Conor Grogan placed the amount as high as $5.8 billion.

Those figures represent assessments made at different stages of the investigation. They should not be added together or treated as Binance’s final loss.

Binance said in anOctober 30 updatethat approximately $3 billion had been verified as frozen. The exchange is working with law enforcement, token issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets. It reiterated that user funds are safe.

Freezing prevents affected tokens from being transferred under the issuer’s controls. It does not mean that the money has already been returned to Binance or establish how much the exchange will ultimately recover.

Update: The current verified total frozen amount is around $3 billion.Our teams continue to work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets.We will only share confirmed figures and will…pic.twitter.com/e5RHM1VwOU

As investigators traced the transfers, Binance began issuing updates and stablecoin issuers froze funds. The timeline below follows those developments using Decrypt’sreportingand Unchained’s account of theannouncements. The initial compromise may have occurred before the first recorded transfer.

Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.

Investigators examining the Ethereum transfers identified a signed authorization shortly before the funds moved. The authorization used EIP-7702, an Ethereum feature that allows a wallet to delegate functions to smart-contract code.

Phylax Systems founder Odysseas Lamtzididescribedhow that delegation could allow code to execute through the affected wallet and authorize further transfers. Decrypt reported that the authorization appeared three minutes and 24 seconds before the initial Ethereum transaction.

1/4 EIP-7702 can turn the wallet itself into the sweeper.A Binance-labeled wallet moved 167,464 ETH + 63 tokens, including 1.615B USDT, just 3m24s after a signed delegation was installed.This is bad.https://t.co/GrvUiya16Dpic.twitter.com/zONu8cwW63

That finding could explain part of the transfer mechanism, but it does not explain how the required signature was obtained. The available reporting has not established whether an attacker stole signing credentials, compromised a signing system or persuaded someone to approve a malicious request. Nor does the use of EIP-7702 itself demonstrate a flaw in Ethereum.

Binance had not publicly attributed the incident to a named group in the statements reviewed for this report. The initial entry point, the people responsible and the full extent of access remained unknown. However, the incident comes about a month afterBitget reported a hackand suspected involvement by North Korea’s Lazarus Group.

CZ, who said he does not manage Binance anymore,wrote on X⁠ that the activity looked like a hack. Speaking as a shareholder, he said he expected all user funds to be fully covered. That was his expectation, separate from the exchange’s investigation and its own customer assurances.

If the upper estimates are confirmed as stolen funds, the incident would exceed the approximately $1.5 billion Bybit theft in February 2025. However, the gross value moved, the amount frozen and the eventual unrecovered loss are different figures. None should be substituted for another while the investigation continues.

Binance.USseparately saidit was unaffected.

Customers seeking information were directed to Binance’s official announcements. In itsinitial statement⁠, the exchange warned users about unofficial links, messages and requests for account information.

The unresolved questions now concern how the transfers were authorized, whether the attacker retains any access and how much of the moved cryptocurrency can be recovered. Binance’s assurance that customer funds are safe does not yet provide a final accounting of the incident.

Your email address will not be published.Required fields are marked*

Comment*

Name*

Email*

Website

Δ

Email Address*

FIRSTNAME

LASTNAME