At least $5.57 billion in cryptocurrency has left wallets linked to Binance across Ethereum, Bitcoin, and Tron blockchains, the world’s largest cryptocurrency exchange said October 29. Binance is investigating a potential security breach after the funds moved from the exchange’s hot wallets, internet-connected systems used to process customer withdrawals.
The incident began at 20:21 UTC when an address funded through Tornado Cash, a cryptocurrency mixer, submitted a delegation for a Binance hot wallet using EIP-7702, an Ethereum feature that allows ordinary wallets to run smart-contract code. Minutes later at 20:24 UTC, the first Ethereum transaction sent 167,464 ETH and 63 token transfers to a new address.
Binance stated in a post on X: “We have not confirmed any impact to user funds. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.”
The breakdown of the $5.57 billion total shows $3.51 billion on Ethereum, $1.44 billion in Bitcoin (18,270 BTC), and $630 million on Tron. In the first Ethereum transaction alone, 1.615 billion USDT moved to the receiving wallet.
Stablecoin Issuers Freeze Assets
Tether and Circle, the two largest stablecoin issuers, moved to contain the outflow. Tether froze 975.1 million USDT associated with the incident, while Circle froze 823 million USDC. Jeremy Allaire, CEO of Circle, said: “Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.”
The combined freeze totaled $1.8 billion in stablecoins. Tether and Circle can block specific addresses from moving their tokens, a capability that allowed them to halt the flow of their assets despite the broader movement of funds from Binance wallets.
EIP-7702 and the Attack Mechanism
The attack exploited EIP-7702, an Ethereum feature that enables code delegation. Odysseas Lamtzidi, founder of Phylax Systems, explained the mechanism: “7702 lets a normal wallet execute delegated code. The delegation persists; that code can authorize later transfers without another signature from the wallet.”
This feature allowed the attacker to authorize transfers from Binance’s hot wallet without requiring an additional signature once the initial delegation was submitted. How the attacker obtained the required signature to establish the delegation remains unknown.
Market Response and Historical Context
BNB, Binance’s native token, dropped approximately 7% following the incident. Bitcoin fell below $79,000 and declined 2.6% over 24 hours. Monero rose about 6%, a pattern similar to movements after a $333 million Bitcoin theft in April 2025.
If confirmed as a complete loss, the incident would exceed the previous record hack. Bybit suffered a $1.5 billion loss in February 2025. Binance itself lost 7,000 Bitcoin in a 2019 hack, valued at approximately $40 million at that time.
The investigation is ongoing, with Binance and law enforcement agencies tracking the movement of funds across blockchains.
