At least $5.57 billion in cryptocurrency has been drained from wallets linked to Binance across Ethereum, Bitcoin, and Tron blockchains on October 29, 2026. The outflow occurred from hot wallets used by the exchange to process customer withdrawals. On-chain data indicates that $3.51 billion was moved on Ethereum, $1.44 billion (comprising 18,270 Bitcoin) on the Bitcoin network, and $630 million on Tron. The initial Ethereum transaction involved 167,464 ETH and various token transfers, including 1.615 billion USDT, sent to a newly created address.
Binance stated it is aware of a "potential security issue" and is actively investigating, but has not confirmed any impact on user funds. Security analysts suggest the breach may have exploited EIP-7702, an Ethereum feature allowing ordinary wallets to execute smart-contract code via delegation. A delegation for a Binance hot wallet was submitted three minutes before the fund movement by an address funded through Tornado Cash.
In response, stablecoin issuers took immediate action to mitigate losses. Tether froze 975.1 million USDT, and Circle froze 823 million USDC in the main receiving wallet, totaling approximately $1.8 billion in frozen assets. Circle CEO Jeremy Allaire confirmed coordination with law enforcement regarding the incident. Market reactions were sharp: Bitcoin fell below $79,000, BNB dropped about 7%, while Monero rose roughly 6%. If verified, this event would surpass the February 2025 Bybit heist as the largest crypto hack on record.
The suspected drain of $5.57 billion from Binance’s hot wallets highlights critical vulnerabilities in centralized exchange custody mechanisms, particularly concerning advanced smart contract interactions like EIP-7702. While Binance maintains that user funds are unaffected pending investigation, the scale of the outflow tests the resilience of its insurance frameworks and operational transparency. The rapid deployment of freezing tools by Tether and Circle demonstrates the effectiveness of centralized stablecoin issuers in acting as circuit breakers during high-stakes security incidents, preventing a larger portion of the stolen assets from entering circulation or being laundered through mixers.
This event underscores the persistent tension between blockchain composability and security. The alleged exploitation of wallet delegation features suggests that attackers are increasingly targeting the intersection of legacy account structures and new protocol upgrades. For institutional participants and regulators, the incident raises questions about the adequacy of current security audits for hot wallet infrastructure and the speed of incident response protocols. The market’s reaction, characterized by a flight to privacy coins like Monero alongside declines in major assets, reflects heightened uncertainty and a potential shift in risk perception among retail and institutional investors alike.
