BULLSTAR 
Last updated: October 30, 2026, 00:30 UTC. This is a developing story and we will update it as new information is confirmed.
On the evening of October 29, 2026, billions of dollars in crypto moved out of Binance hot wallets in a few minutes. On-chain trackers now estimate the outflows at $5.5 billion to $5.8 billion, which would make it the largest exchange hack on record. Binance says it is investigating a "potential security issue", has paused withdrawals on several networks and says user funds are safe.
Here is everything we know so far about the Binance hack: what happened minute by minute, how much was stolen, the hacker's wallet address, how much has been frozen, what Binance and CZ said, and what it means if you have funds on Binance.
- When: October 29, 2026, from about 20:20 UTC.
- How much: about $5.5 to $5.8 billion in gross outflows, based on on-chain estimates. Not confirmed by Binance.
- Frozen: about $2.4 billion in USDT and USDC, plus smaller freezes by Ripple and World Liberty Financial.
- Net loss: estimated at around $1 billion. CZ said it "may be slightly higher, but will be fully covered".
- Withdrawals: suspended on several networks as a precaution.
- Hacker address:
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
What Happened: Binance Hack Timeline
The first signs came from on-chain analysts, not from Binance. Here is the sequence as reported by Etherscan data and public posts (all times UTC, October 29, 2026):
| Time (UTC) | What happened |
|---|---|
| Oct 28-29 | A trigger address funded through Tornado Cash receives three small ETH deposits. |
| 20:20 | The Binance 14 hot wallet is delegated to an outside smart contract through EIP-7702. |
| 20:24 | About 167,464 ETH and 63 other tokens, including about 1.6 billion USDT, move in one transaction to a new address, 0x5227...B2f8c. Binance 16 sends another 28,005 ETH seconds later. |
| 20:39 | About 195,460 ETH is forwarded from that address to another new wallet. |
| 20:41 | 780 million USDC leaves a second Binance hot wallet to the same address. |
| 20:50-21:05 | BNB, Bitcoin and Ether hit their lows of the evening. |
| 21:15 | Changpeng Zhao (CZ) posts that it "does look like a hack on Binance". |
| 21:16 | Binance posts that it is aware of a potential security issue and is investigating. |
| 21:18-21:25 | Circle freezes about 823 million USDC and Tether freezes more than 1.5 billion USDT. |
| 21:29 | Binance edits its post to add: "User funds are completely safe." |
| Later | Binance suspends withdrawals on several networks. The attacker starts swapping altcoins for ETH on-chain. |
How Much Was Stolen in the Binance Hack?
There is no official number yet, and early estimates differ because analysts count different wallets and chains. Here are the main figures reported so far:
| Source | Estimate | What it measures |
|---|---|---|
| Lookonchain | Over $5.8 billion | Total assets involved |
| Conor Grogan (Coinbase) | Up to $5.8 billion | Total outflows |
| Decrypt | At least $5.57 billion | Across three chains |
| On-chain analysts (via Bloomingbit) | About $5.6 billion | Ethereum, Bitcoin and Tron |
| Blockaid | About $3.3 billion | Suspicious hot wallet outflows |
| DefiLlama founder 0xngmi | About $1 billion | Net loss after freezes |
One reported breakdown of the outflows by asset looks like this. These are on-chain estimates, not Binance's final figures:
| Asset | Amount | Approx. value |
|---|---|---|
| USDT | 2.29 billion | $2.29 billion |
| Bitcoin (BTC) | 18,270 BTC | $1.45 billion |
| USDC | 823 million | $823 million |
| Ether (ETH) | About 197,170 ETH | $451 million |
| RLUSD | 88.6 million | $88.6 million |
| wBETH | $75.3 million | |
| XAUt (gold token) | $50.5 million | |
| Altcoins (ENA, PEPE, LINK, AAVE, UNI, ARB and more) | Tens of millions each |
The gap between $5.8 billion and $1 billion is mostly the frozen stablecoins. Tether and Circle can freeze USDT and USDC on-chain, but nobody can freeze ETH or BTC once they have moved.
The Binance Hacker's Wallet Address
Etherscan has labelled the main receiving address "Binance Hot Wallet Exploiter 2":
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c
You can follow it on Etherscan. It was funded by the Binance 14 hot wallet, and in the hours after the attack it was still sending tokens out and forwarding ETH to other addresses. Etherscan also lists related addresses on other chains through its multichain view.
Never send funds to this address, and ignore anyone on Telegram or X who claims they can "recover" your Binance funds for a fee. Big hacks always bring a wave of scams.
How Did the Binance Hack Happen?
Binance has not explained the cause. Based on the on-chain data, analysts point to an EIP-7702 delegation:
- What EIP-7702 does: it lets a normal Ethereum wallet hand its control to a smart contract. This needs a valid signature from that wallet's private key.
- What happened here: at 20:20 UTC the Binance 14 wallet was delegated to an outside contract, and about four minutes later that contract swept the wallet. Security firm Defimon called it "abuse of an EIP-7702 delegation with a compromised key".
- The trigger: the contract only accepted calls from an address funded through Tornado Cash, according to analysts.
The big open question is how the attacker got a valid signature. The possibilities being discussed are a stolen hot wallet key, a compromised signing system like in the 2025 Bybit hack, or an insider. None of these is confirmed, and no group has been officially blamed.
How Much Has Been Frozen?
| Who | What was frozen |
|---|---|
| Tether | About 1.56 billion USDT |
| Circle | About 823 million USDC |
| Ripple | About 200 million in related assets, reported as RLUSD |
| World Liberty Financial | $27 million USD1 and 48 million WLFI (about $2 million) |
| Aave | Froze its V3 and V4 markets so the attacker could not borrow against stolen tokens |
Together, the stablecoin freezes cover roughly 40% of the estimated total. The rest, mainly BTC and ETH, can't be frozen, and the attacker has started swapping altcoins like PEPE, UNI and LINK for ETH on decentralized exchanges.
What Binance and CZ Said
- Binance's first post (21:16 UTC): "Our teams are aware of reports of a potential security issue and are actively investigating." It first said it had "not confirmed any impact to user funds", then edited the post twice within 13 minutes to say "User funds are completely safe."
- Yi He, co-founder: thanked Tether, Circle, Ripple and World Liberty Financial for freezing assets, and said withdrawals are suspended "until the environment is confirmed safe".
- Changpeng Zhao (CZ): said it "does look like a hack", and that as a shareholder he expects all user funds to be fully covered. Replying to a $1 billion net loss estimate, he said the loss may be slightly higher but will be fully covered.
- Binance.US: said it is independently operated, was not affected, and is working normally.
Are Funds on Binance Safe?
Binance says yes. Here is what supports that, and what is still unknown:
- Hot wallets are a small part of reserves. Exchanges keep most funds in cold storage. 0xngmi estimated the net loss at around 0.69% of the roughly $144 billion Binance holds for users.
- Binance has covered losses before. In 2019 it covered a 7,000 BTC hack with its SAFU emergency fund, and the fund now holds about $1 billion.
- Still unknown: the exact cause, the final loss, and when withdrawals will fully reopen.
Market Impact
| Before (20:15 UTC) | Evening low | Change | |
|---|---|---|---|
| BNB | $738.90 | $692.32 | About -6% |
| Bitcoin | $80,327 | $78,763 | About -2% |
| Ether | $2,313 | $2,251 | About -3% |
About $628 million in leveraged positions were liquidated within an hour, about $607 million of them longs, according to CoinGlass data. The altcoins the hacker holds, such as ENA, PEPE, LINK, AAVE, UNI and ARB, may face extra selling pressure while the funds are being swapped.
How It Compares With the Biggest Crypto Hacks
| Hack | Year | Amount |
|---|---|---|
| Binance (gross outflows, estimated) | 2026 | $5.5-5.8 billion |
| Bybit | 2025 | About $1.5 billion |
| Ronin Network (Axie Infinity) | 2022 | About $625 million |
| Poly Network | 2021 | About $611 million |
| BNB Chain bridge | 2022 | About $570 million |
| Binance | 2019 | 7,000 BTC (about $40 million then) |
The gross number puts this far above Bybit. If the net loss really ends up near $1 billion after freezes, it would still rank among the largest exchange losses ever.
What Binance Users Should Do Now
- Don't panic-sell. Hacks bring sharp, fast moves. Selling at the low locks in a loss.
- Use only official channels. Open Binance through the app or by typing the URL. Ignore DMs, emails or "compensation" links. Our guide on how to spot fake crypto channels covers the common tricks.
- Check your security. Keep 2FA and the anti-phishing code on, and review your API keys. Remove withdrawal rights from any key that doesn't need them.
- Watch your leverage. Volatility after a hack can liquidate high-leverage positions fast. Use a stop loss and size positions with our position size calculator.
- Think about self-custody. Keep only what you trade on an exchange, and hold long-term savings in a wallet you control.
Frequently Asked Questions
Was Binance hacked?
Binance has said it is investigating a "potential security issue" and has not formally called it a hack. Former CEO Changpeng Zhao said it "does look like a hack", and on-chain data shows billions moving from Binance hot wallets to an address Etherscan labels "Binance Hot Wallet Exploiter 2".
How much was stolen in the Binance hack?
On-chain trackers estimate between $5.5 billion and $5.8 billion left Binance hot wallets. About $2.4 billion in USDT and USDC was frozen by Tether and Circle, and DefiLlama's founder estimated the net loss at about $1 billion. Binance has not confirmed a final figure.
Are funds on Binance safe?
Binance says user funds are "completely safe", and Changpeng Zhao said he expects all user funds to be fully covered. Hot wallets hold only a small part of an exchange's reserves. Withdrawals were suspended on several networks while Binance checks its systems.
Are Binance withdrawals paused?
Yes. Binance spokesperson Ross O'Leary and co-founder Yi He said withdrawals were suspended as a precaution until the environment is confirmed safe. Check Binance's official X account and app for when they resume.
What is the Binance hacker's wallet address?
The main Ethereum address is 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c, labelled "Binance Hot Wallet Exploiter 2" on Etherscan. Funds have since been moved to other addresses.
How did the Binance hack happen?
It is not confirmed. Analysts say the Binance 14 hot wallet was delegated to an attacker's smart contract using EIP-7702, which needs a valid signature from the wallet's key. How the attacker got that signature, whether a stolen key, a compromised signing system or an insider, is unknown.
Is this the biggest crypto hack ever?
If the gross figure of over $5 billion holds, it would be the largest exchange hack on record, well above the roughly $1.5 billion Bybit hack in February 2025. After freezes, the net loss is estimated to be much smaller.
Is Binance.US affected?
No. Binance.US said it is an independently operated platform, was not affected by the incident, and its services are operating normally.
Should I withdraw my crypto from Binance?
That is your decision, and the facts are still coming out. Don't act on panic or on messages promising compensation. Whatever you choose, keep 2FA on, use only the official app, and consider holding long-term savings in a wallet you control.
This article is based on on-chain data and public statements available at the time of writing. Figures are estimates and may change as Binance confirms details. Not financial advice.