Live updates
Correction: Zhao's words, Binance's user-funds line and Tether's freeze figure
We corrected three points in entries 2 and 3. Changpeng Zhao wrote "It does look like a hack on Binance", not that Binance "was indeed hacked". Binance's "not confirmed that user funds have been affected" was an earlier statement; its current line, emailed to TechCrunch, is that user funds are "completely safe". Tether's own figure is more than 1.567B USDT frozen, CEO Paolo Ardoino wrote; 971 million was Zhao's number. Circle's CEO said the freeze of more than 800M USDC was "in coordination with law enforcement".
Our own check of Ethereum at 23:13 UTC: 0x5227…2f8c is blacklisted by both issuers and holds about 1.175 billion USDT and 823 million USDC. The 195,460 ETH on the second address had not moved.
Binance pauses withdrawals, but its own sources disagree on how many
Binance co-founder Yi He wrote on X at 22:22 UTC that "withdrawals are currently disabled until the environment is confirmed to be secure." A spokesperson told TechCrunch the exchange had "temporarily suspended withdrawals on multiple networks" as a precaution. Her post also thanked World Liberty Financial for freezing $27 million of USD1 and 48 million WLFI.
The scope is unclear. At 23:14 UTC, Binance's public network status showed withdrawals disabled only on some networks, including Solana and XRP Ledger, citing maintenance, while BTC, ETH and USDT on Ethereum and Tron were enabled. The status flag may not reflect account-level holds.
On-chain analysts say the EIP-7702 delegation was signed with Binance's own key
Two on-chain analysts say the delegation was signed with the hot wallet's own key. Defimon wrote that "Setting a 7702 delegation requires a signature from the account's own key, so this is a signing/private-key compromise of an exchange hot wallet." Detective Pho described "50 delegations signed by Binance 14's own key, one per upcoming nonce", which, CryptoTicker noted, protected the attacker against a quick revocation by Binance. A second wallet, Binance 16, sent 28,005.6 ETH, CryptoTicker reported. Binance has not named a cause.
For exchanges, this puts the check on the signer: refuse set-code authorizations by default, and alert on any new delegation on a hot wallet.
Tether and Circle freeze about $1.8 billion of the stablecoins
Tether froze about 971 million USDT and Circle about 823 million USDC held by the receiving address, Zhao wrote in a post thanking both issuers, Blockchain Reporter reported. The ETH, roughly 195,000 coins, is out of reach of any freeze and had already moved to a second address by 20:38 UTC.
For treasury teams, this is the step that worked: a direct line to stablecoin issuers turned most of the stolen USDT and USDC into frozen balances within about an hour.
Binance says it is investigating; Zhao says it "looks like" a hack
Binance wrote on X that it is aware of reports of a possible security issue and "at this time we have not confirmed that user funds have been affected." Founder Changpeng Zhao, who no longer runs the exchange, wrote that user funds are safe and that "it looks like Binance was indeed hacked."
More than $2.5 billion leaves Binance hot wallets in 40 minutes
From 20:24 to 21:04 UTC, ETH, USDT, USDC and about 60 other tokens moved from Binance hot wallets to a new address, 0x5227…2f8c. Tree News counted about $2.53 billion; other trackers put it at up to $3.55 billion across six blockchains, FinanceFeeds reported. The first transfer alone carried 167,464 ETH.
Between 20:24 and 21:04 UTC on Oct. 29, 2026, more than $2.5 billion in ETH, USDT, USDC and about 60 other tokens left Binance hot wallets on Ethereum, by Tree News' count. Other trackers put the total at up to $3.55 billion across six blockchains, FinanceFeeds reported. Binance said it is investigating a "potential security issue" and, in a statement to TechCrunch, that user funds are "completely safe." Founder Changpeng Zhao wrote: "It does look like a hack on Binance."
This page follows the incident and any related exchange thefts as they develop. The newest entries are at the top.
What the on-chain data shows
At 20:24:23 UTC, 167,464 ETH and 63 token transfers, including about 1.6 billion USDT, moved from the wallet Etherscan labels Binance 14 to a new address, 0x5227…2f8c. At 20:41:23 UTC, 780 million USDC followed from Binance: Hot Wallet 34, Coindoo found on Etherscan. By 20:38 UTC about 195,460 ETH had moved on to a second address.
The withdrawals were triggered by an address funded through Tornado Cash. Four minutes before the first transfer, Binance 14 was pointed at that address's contract code through an EIP-7702 delegation, FinanceFeeds reported. If that holds, whoever ran the attack could sign on behalf of the hot wallet: a stolen key, or control of the system that signs for it. Binance has not said which.
EIP-7702, live on Ethereum since May 2025, lets an ordinary account delegate to contract code with one signed authorization. Once delegated, the code can move everything the account holds in one transaction, which would explain 63 token transfers with the same timestamp.
What exchanges and treasury teams should check now
- Wallet operations: list every hot and warm wallet and check whether any carries an EIP-7702 delegation. On Ethereum, a delegated account has code that starts with
0xef0100. Alert on any authorization you did not plan. - Signing policy: make the signing service refuse EIP-7702 authorizations and set-code transactions unless two people approve them, the same way it treats a new withdrawal address.
- Withdrawal limits: cap how much a hot wallet can send per hour, enforced by the signer, not only by the application in front of it.
- Incident contacts: keep direct contacts at Tether and Circle in the playbook. Here, Tether and Circle froze stablecoins within about an hour of the first transfer, while the ETH moved on.
