Binance Suspected Hack: Up to $5.8 Billion in Outflows, Withdrawals Paused, and What Users Need to Do Right Now

Breaking: Suspicious Outflows Begin at 20:24 UTC

Shortly after 8:00 p.m. UTC on Thursday, October 29, 2026, on-chain analyst Spreek posted what would become the first widely circulated alarm: "Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash." Within minutes, blockchain data showed abnormal outflows from multiple hot wallets labeled "Binance 14," "Binance 16," and "Binance 34" across Ethereum, Arbitrum, and Avalanche.

By 21:04 UTC, the suspicious movements had largely ceased — but the damage, according to multiple on-chain analysts, was already done. Binance's exchange rate, its users' nerves, and the broader crypto market had all taken a significant hit.

What Binance Has — and Has Not — Confirmed

It is critical to be precise here. As of the time of publication, Binance has officially acknowledged only a "potential security issue" and confirmed it has temporarily suspended withdrawals on multiple networks as a precaution. In an emailed statement to TechCrunch, the exchange said:

"Rest assured that user funds are completely safe. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information."

Binance spokesperson Ross O'Leary separately confirmed to TechCrunch that withdrawals were paused on multiple networks. The exchange has not officially confirmed a hack, a total amount stolen, or any information about the attackers. Users should only follow updates via official Binance channels.

Binance co-founder and largest shareholder Changpeng Zhao (CZ), who no longer manages daily operations, went further in a personal post on X: "User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." CZ's statement that funds will be "fully covered" represents his personal expectation as a shareholder — it is not an official commitment from Binance, and should not be read as one.

The Numbers: A Wide — and Disputed — Range

Estimates of the total stolen vary dramatically across sources, and none have been confirmed by Binance. Readers should treat all figures as preliminary and subject to significant revision:

~$2.8B–$3.3B — The lower end of estimates, cited by CryptoTicker and technical breakdown site CyberKendra, and corroborated by on-chain security firm Blockaid's tally of approximately $3.3B drained across Ethereum, Arbitrum, and Avalanche.
~$3.55B — Analyst Spreek's estimate of incoming transfers to the primary unlabeled externally owned account (EOA), per The Block.
~$5.7B–$5.8B — The top of the reported range, cited by CoinDesk, Coinbase director Conor Grogan, and the Kobeissi Letter on X. The Kobeissi Letter separately claimed outflows spanned Ethereum, Bitcoin, and TRON networks, including ~$1.45B in BTC and ~$875M in ETH — however, this cross-chain claim has not been corroborated by The Block, CoinDesk, Blockaid, or Cointelegraph, all of which describe activity primarily on Ethereum, Arbitrum, and Avalanche. Treat the $5.7B–$5.8B figure and its BTC/TRON breakdown as reported, not verified.
~$5.72B — Crypto analytics platform Arkham labeled the suspected attacker entity "binance-hacker-1029" and tracked roughly $5.72B in holdings including 1.567B USDT, 18,270 BTC, 385,800 ETH, and 823M USDC, per Crypto Banter's X post citing Arkham data.

The divergence between estimates reflects different methodologies: some totals include the portion of stablecoins that issuers subsequently froze; others attempt to separate out cross-chain double-counting. No single figure should be taken as definitive until Binance provides an official accounting.

The Technical Vector: A Possible EIP-7702 Exploit

(Reported — sourced to Blockaid CEO Ido Ben-Natan via Cointelegraph; not confirmed by Binance.)

Blockaid CEO Ido Ben-Natan offered the most detailed publicly available technical analysis of the attack vector. His assessment: this was "a compromise of signing infrastructure — we don't think a key was leaked." According to Ben-Natan, the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting the wallet labeled "Binance 14." One of those bundled authorizations matched the required nonce. This caused the compromised account to be temporarily delegated — under the EIP-7702 mechanism introduced in Ethereum's Pectra upgrade — to an unverified "sweeper" smart contract, which then drained ETH and more than 60 token types in a single transaction.

The primary receiving EOA, flagged by CyberKendra, is 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c — a newly created address. A fee-funding address linked to the operation was reportedly financed via 0.1 ETH Tornado Cash deposits on October 28–29. The primary transaction hash flagged by CyberKendra is 0x53bd38b8…e2f3.

Ben-Natan drew an explicit parallel to the February 2025 Bybit hack — the $1.4 billion breach then-attributed to North Korean actors — calling the pattern "very, very similar." This is speculation based on pattern-matching only; no attribution evidence has been disclosed by any party, and Binance has made no statement on the identity of the attackers.

Stablecoin Issuers Move Quickly — But Not Uniformly

Three stablecoin issuers acted to freeze assets linked to the suspected attack, though the reported figures diverge:

Tether — CEO Paolo Ardoino posted on X that Tether froze more than 1.567 billion USDT "related to a potential Binance exchange hack." Notably, CZ's X post cited only "~$971m" frozen by Tether — a significant discrepancy with Ardoino's own figure that has not been explained by either party.
Circle — CEO Jeremy Allaire confirmed on X that Circle froze approximately $800M–$823M in USDC passing through its networks, a figure cited by both TechCrunch and The Block.
Additional freezes — CryptoSlate reports that Ripple (RLUSD) and World Liberty Financial (USD1) also participated in freezes, bringing the combined total toward approximately $2.6B. This is a single-source figure from CryptoSlate and has not been independently corroborated at time of publication.

Despite the rapid issuer response, an estimated ~$900 million in stolen assets reportedly moved before the freezes landed, according to The Block — meaning a portion of the funds may already be beyond recovery through standard blacklisting mechanisms.

DeFi Protocols React: Aave Pauses Markets

The attacker did not simply hold the stolen funds. According to Crypto Briefing and The Block, the suspected hacker deposited approximately $60M in USDT into Aave and used it as collateral to borrow roughly 19,800 ETH (approximately $45M) — a classic DeFi leverage move to liquidate stolen stablecoins into harder-to-freeze assets before Tether's blacklist could catch up. In response, Aave governance paused most Ethereum lending markets (and reportedly Avalanche markets as well), though withdrawals and debt repayments remained available. The rapid DeFi intervention appears to have limited but not fully blocked the attacker's laundering path.

Market Impact: Bitcoin Below $79K, $628M Liquidated in One Hour

The suspected breach triggered an immediate market reaction. Bitcoin Magazine reported that BTC fell from a 24-hour high of approximately $81,890 to $78,177 — a drop of roughly $3,700 — as hack reports spread after 4 p.m. ET. BNB declined over 5.5% at the peak of the selloff, according to The Block.

BeInCrypto reported that $627.7M in positions were liquidated in a single hour late Thursday, with $606.6M of that on long positions — a highly skewed liquidation cascade consistent with a sudden downward price shock. Binance alone accounted for $344.8M of that hour's liquidations, reflecting both the exchange's dominant market share and elevated trader exposure on the platform.

Historical Context: If Confirmed, the Largest Breach in Crypto History

For context: the current record for a single crypto exchange breach is the February 2025 Bybit hack, in which approximately $1.4 billion was stolen, later attributed to North Korean state actors. Even the lower bound of current Binance estimates — approximately $2.8 billion — would more than double that record. At the upper reported range of $5.7–5.8 billion, the incident would surpass every crypto theft tracked on Rekt.news's historical leaderboard. These comparisons remain conditional: Binance has not confirmed any total, and final figures could differ materially once the investigation concludes.

What Vietnamese Binance Users Should Do Right Now

Vietnam is one of the largest retail crypto markets in Southeast Asia, and Binance is the dominant exchange platform for Vietnamese traders. Here is a clear-eyed action checklist based only on confirmed facts:

Expect withdrawals to remain paused. Binance confirmed it has suspended withdrawals on multiple networks. There is no confirmed timeline for resumption. Do not make financial plans that depend on immediate access to Binance funds.
Do not act on unofficial information. Binance explicitly warned: "Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information." Phishing attempts typically spike during high-profile security incidents. Do not click links from Telegram groups, unofficial Discord servers, or unsolicited DMs claiming to offer withdrawal workarounds.
Monitor only official channels. Updates will come via Binance's official website, app, and verified social accounts. Treat everything else — including viral X posts citing unconfirmed figures — as noise until corroborated by Binance directly.
Do not panic-sell on unverified data. The total stolen has not been confirmed. The range between sources is enormous ($2.8B–$5.8B). Market overreaction to unverified figures is a known pattern in crypto breaches; informed decisions require confirmed information.
Consider your long-term custody strategy. Regardless of how this incident resolves, it reinforces a principle that experienced users already know: hot wallets on centralized exchanges carry custodial risk. If you hold crypto intended as a long-term store of value, a hardware wallet removes exchange counterparty risk from the equation.
Note that Binance.US is unaffected. Binance.US confirmed in a separate statement that its systems are not impacted by this incident.

What Remains Unknown

As of publication, the following questions are unanswered: the precise total of funds stolen; whether any funds remain recoverable; the complete technical attack vector (Blockaid's EIP-7702 analysis is reported, not confirmed by Binance); whether the attack has fully stopped or is ongoing; the identity of the attackers; and whether Binance will issue a formal commitment — not just a shareholder's expectation — to cover any user losses in full. W3BStation will update this report as confirmed information becomes available.