Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion Frozen - Hackread
Binance is probing a suspected cryptocurrency hack that saw billions of dollars moved from its associated wallets on October 29, 2026, with investigators estimating the suspicious transfers at up to $5.8 billion.
Blockchain security firms and industry executives have identified massive outflows from wallets linked to the exchange, with estimates ranging from $3.3 billion to $5.8 billion across networks like Ethereum, Arbitrum, and Avalanche.
Binance has confirmed that approximately $3 billion of the moved assets have been verified as frozen, a figure that would make this the largest publicly reported cryptocurrency theft if the upper estimates are confirmed.
The exchange stated that user funds are completely safe and is working with law enforcement, token issuers, and blockchain intelligence firms to trace and freeze additional assets.
Update: The current verified total frozen amount is around $3 billion. Our teams continue to work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets.
Freezing Assets and Timeline
Stablecoin issuers have moved to freeze assets linked to the suspicious activity, with Circle confirming that it has frozen more than $800 million of USDC in coordination with law enforcement.
Binance began issuing updates and freezing funds as blockchain investigators traced the transfers, though the initial compromise may have occurred before the first recorded transfer.
The process of freezing tokens prevents them from being transferred under the issuer’s controls, but it does not mean the money has been returned to Binance or establish the final loss.
Binance.US has stated that it was unaffected by the incident.
Technical Details of the Transfer
Investigators examining the Ethereum transfers identified a signed authorization shortly before the funds moved, which used EIP-7702, a feature that allows a wallet to delegate functions to smart-contract code.
Phylax Systems founder Odysseas Lamtzidi described how that delegation could allow code to execute through the affected wallet and authorize further transfers.
The authorization appeared three minutes and 24 seconds before the initial Ethereum transaction, providing a potential explanation for the transfer mechanism.
However, the available reporting has not established whether an attacker stole signing credentials, compromised a signing system, or persuaded someone to approve a malicious request.
The use of EIP-7702 itself does not demonstrate a flaw in Ethereum.
Investigation and Reactions
Binance has not publicly attributed the incident to a named group, and the initial entry point, the people responsible, and the full extent of access remain unknown.
The incident comes about a month after Bitget reported a hack and suspected involvement by North Korea’s Lazarus Group.
Speaking as a shareholder, he said he expected all user funds to be fully covered.
Binance warned customers about unofficial links, messages, and requests for account information, directing them to official announcements for accurate information.
The unresolved questions now concern how the transfers were authorized, whether the attacker retains any access, and how much of the moved cryptocurrency can be recovered.
Binance’s assurance that customer funds are safe does not yet provide a final accounting of the incident.
Related
