BTC $78,638.00 −1.89%ETH $2,247.23 −3.03%SOL $98.09 −2.06%S&P 500 7,720.39 −0.30%Nasdaq 100 29,402.50 −1.38%Gold $3,998.40 −0.82%Brent $112.26 +1.32%EUR/USD 1.1187 +0.05%DXY 101.81 −0.22%US10Y 4.99% −1.11%NVDA $213.66 −0.80%TSLA $403.30 −0.23%
FREEKONOMIST
Sign in
EN
RUРусскийENEnglishESEspañolPTPortuguêsZH中文ARالعربية
CryptoAnnounced

$3.3B left a Binance hot wallet in 40 minutes: what the blockchain shows

On-chain data shows Binance's hot wallet "Binance 14" emptied into an address Etherscan tags as a suspected exploiter. Tether and Circle froze $1.8B. CZ says it looks like a hack; Binance is investigating.

Event: October 29, 2026
Primary source: October 29, 2026
Published here: October 29, 2026 at 09:21 PM UTC
Updated: October 30, 2026 at 12:20 AM UTC
Read: 3 min

What changed (October 30, 2026 at 12:20 AM UTC): Binance has acknowledged the hack. 00:04 UTC Yi He: "Binance will cover all hacking losses." 00:13 UTC Binance: "Binance will cover all losses"; all deposits and withdrawals are temporarily suspended while it freezes funds and works with law enforcement; a full post-mortem is promised. 23:22 UTC Binance: verified total frozen is $2.54B and may grow. Binance Alpha trading is also paused. Binance has not yet given a total loss. The 195,460 ETH on 0x8532 had not moved as of 00:16 UTC.

What happened

On 29 October at 20:24 UTC one transaction moved 167,464 ETH and 63 tokens out of Binance's hot wallet "Binance 14". By 21:04 about $3.33B had left it on Ethereum. Four minutes before, a wallet that got its gas from Tornado Cash had switched Binance 14 to its own code using EIP-7702. Etherscan tags the receiver "Suspect Binance Hot Wallet Exploiter 2". Tether and Circle have frozen 975M USDT and 823M USDC there.

Why it matters to you

If confirmed, it is the biggest hack in crypto history, bigger than Bybit's $1.5B in 2025. BNB fell up to 8% and BTC up to 3% within half an hour. CZ wrote at 21:15 UTC that it "does look like a hack", that user funds are safe and that he expects them to be fully covered. Binance said at 21:16 it is investigating and has not confirmed any impact on user funds.

What to check and watch

Follow updates only on Binance's official channels. Do not panic-sell and do not click "withdraw now" or "compensation" links: scammers move fast on news like this. If you use EIP-7702 wallets, check what your account is delegated to.

Donut chart: $3.33B left Binance 14: USDT 49%, USDC 25%, ETH 11%, 61 other tokens 15%
What left Binance 14. Token prices from Blockscout, ETH at $2,260.
Minute-by-minute timeline of the attack, 28-29 October
Every step can be opened on Etherscan, links in the sources.
Bars: 975M USDT and 823M USDC frozen, 700M USDT and 195,460 ETH moved on
We checked the freezes directly in the USDT and USDC contracts.
BNB and BTC charts 19:10-21:05 UTC: BNB down up to 8%, BTC up to 3% after 20:24
Binance futures, 5-minute candles.
Open the transaction on Etherscan

What we checked ourselves. We read every transaction on Ethereum through Blockscout and a public node and opened the addresses on Etherscan. Binance 14 (0x28c6...1d60) is one of Binance's best-known hot wallets.

The setup. On 28 and 29 October a fresh wallet (0x7c86...5ca0) received three payments of about 0.1 ETH from Tornado Cash, a mixer that hides where money came from. At 02:28 UTC it deployed a contract. Between 13:51 and 16:47 it ran the same sweep function on three small wallets, which looks like a rehearsal.

The drain. At 20:20:59 a type-4 transaction (EIP-7702) set Binance 14's code to that contract. EIP-7702 lets an ordinary wallet act like a smart contract, but only with a signature from that wallet's own key. So either the key or Binance's signing process was compromised, or Binance signed it itself; nothing public says which. At 20:24:23 one call sent 167,464 ETH plus 63 tokens, including 1.615B USDT, to 0x5227...2f8c. More followed at 20:41 (780M USDC), 20:59 (43M USDC) and 21:04 (1,700 ETH and 22 tokens).

A strange detail. At 20:24:47 another Binance hot wallet, Binance 16, sent 28,005.6 ETH to the same address. We do not know why.

Cash-out and freeze. Within 15 minutes the receiver sent 500M and 200M USDT to two new addresses and 195,460 ETH (about $442M) to a third. By 21:15 UTC Tether and Circle had blacklisted it, freezing 975M USDT and 823M USDC. The two USDT receivers are blacklisted too, but their balances were already zero.

What it is not. This is not a bug in Bitcoin or Ethereum. Whale Alert also flagged large BTC, SOL and XRP moves out of Binance in the same hour; we have not linked those to the attacker. This is an investigation, not trading advice.

Confirmed facts

  • At 20:24:23 UTC on 29 October one transaction moved 167,464 ETH and 63 tokens from Binance 14 to 0x5227...2f8c.[1]
  • At 20:20:59 a type-4 (EIP-7702) transaction set Binance 14's code to a contract deployed by the caller wallet.[2][4]
  • The caller wallet received about 0.1 ETH three times from Tornado Cash on 28-29 October and ran the same function on three small wallets before the drain.[4]
  • Etherscan tags 0x5227...2f8c "Suspect Binance Hot Wallet Exploiter 2".[3]
  • Binance 16 sent 28,005.6 ETH to the same address at 20:24:47 UTC.[5]
  • 195,460 ETH left 0x5227...2f8c for a new address at 20:38:47 UTC.[6]
  • The USDT and USDC contracts show 0x5227...2f8c blacklisted, with 975M USDT and 823M USDC frozen.[7]
  • PeckShield flagged unexpected large outflows from Binance hot wallets at 20:55 UTC.[8]
  • At 21:15 UTC Binance founder CZ wrote that it "does look like a hack on Binance", that user funds are safe, and thanked Tether (~$971M) and Circle (~$823M) for the quick freeze.[10]
  • At 21:16 UTC Binance said its teams are investigating a potential security issue and have not confirmed any impact on user funds.[11]
  • BNB fell from about $745 to a low of $677.76 and BTC from about $80,850 to $78,210 between 20:20 and 20:50 UTC.[9]

Implications

  • ConfirmedAbout $1.8B of the moved funds is frozen in stablecoins; about $1.1B in USDT and ETH moved on before the freeze.
  • Our readingIf confirmed as a hack, it is the largest crypto theft on record.
  • Our readingA compromised signing key or signing process at Binance is the most likely way the delegation was authorised.

Still unknown

  • Whether Binance officially confirms the hack and covers the loss in full, as CZ expects.
  • How the attacker got a valid signature from Binance 14.
  • Whether the BTC, SOL and XRP outflows in the same hour are linked.
  • Why Binance 16 sent 28,005.6 ETH to the receiving address.

Who it affects

Global. Binance users and anyone holding BNB, BTC or ETH

Sources

  1. Etherscan: Binance 14 sweep transaction: 167,464 ETH and 63 tokens to 0x5227...2f8c, 20:24:23 UTC October 29, 2026 · official
  2. Etherscan: EIP-7702 (type 4) transaction that set new code on Binance 14, 20:20:59 UTC October 29, 2026 · official
  3. Etherscan: 0x5227...2f8c, tagged "Suspect Binance Hot Wallet Exploiter 2" October 29, 2026 · official
  4. Etherscan: Caller wallet 0x7c86...5ca0: Tornado Cash funding, test runs, sweep calls October 29, 2026 · official
  5. Etherscan: Binance 16 sends 28,005.6 ETH to 0x5227...2f8c, 20:24:47 UTC October 29, 2026 · official
  6. Etherscan: 195,460 ETH moved from 0x5227...2f8c to 0x8532...43d4, 20:38:47 UTC October 29, 2026 · official
  7. Tether USDT contract (Etherscan): isBlackListed(0x5227...2f8c) = true; USDC contract isBlacklisted = true October 29, 2026 · official
  8. PeckShield: Unexpected large outflows from Binance hot wallets October 29, 2026 · media
  9. Binance Futures: BNBUSDT and BTCUSDT 5-minute candles, 19:10-21:10 UTC October 29, 2026 · official
  10. Changpeng Zhao (CZ) on X: User funds are safe! It does look like a hack on Binance October 29, 2026 · official
  11. Binance on X: Our teams are aware of reports of a potential security issue and are actively investigating October 29, 2026 · official
  12. Binance on X: We're aware of crypto withdrawal issues some users are experiencing due to a technical error October 29, 2026 · official
  13. X: Our team is conducting security checks. Withdrawals will resume as soon as the security issue is fully resolved. October 29, 2026 · official
  14. X: Yi He: thanks to World Liberty for $27m USD1 and ~$2m WLFI frozen; withdrawals disabled until the environment is confirmed secure October 29, 2026 · official
  15. X: Yi He: thanks to Ripple for freezing approximately 200 million October 29, 2026 · official
  16. X: CZ: Loss might be a bit higher than that, but will cover. October 29, 2026 · official
  17. X: Binance will cover all losses. All deposits and withdrawals are temporarily suspended October 30, 2026 · official
  18. X: The current verified total frozen is $2.54 billion October 29, 2026 · official
  19. X: Yi He: Binance will cover all hacking losses October 30, 2026 · official
Cover as an image
Did this make it clearer?

Cover: Freekonomist graphic, a symbolic image, not a photo of the event. This is a news explainer, not financial advice.

More stories

Morning brief by email

The night's key moves and what matters today, in 2 minutes. One-click unsubscribe.

By tapping Subscribe you agree to receive Freekonomist emails and accept the data policy.