On 29 October 2026, on-chain activity showed multi-billion-dollar outflows from wallets labeled as Binance hot wallets across Ethereum and other chains. The movements occurred within a short window, involved newly created recipient addresses, and displayed indicators consistent with unauthorized control of operational keys rather than a smart-contract vulnerability. Binance stated it was investigating a potential security issue, asserted that user funds remain safe, and later announced that withdrawals would resume only after security checks were completed. Changpeng Zhao, a major shareholder and former CEO, publicly described the activity as appearing to be a hack and stated that user funds would be covered.
The scale of tracked outflows has been reported between approximately $2.5 billion and $5.8 billion depending on the chains and wallets included. Tether and Circle froze more than $2 billion in USDT and USDC associated with the receiving addresses. Additional freezes were reported for other issuer-controlled assets. These actions limited further movement of stablecoins but left native assets such as ETH outside the reach of issuer blacklisting.
Incident Timeline and Scope
The first major transfer originated from the address labeled Binance 14 on Ethereum at approximately 20:24 UTC. A single transaction moved roughly 167,000 ETH together with more than 1.6 billion USDT and dozens of other tokens to a previously unused externally owned account. Additional transfers followed within minutes from other Binance-labeled hot wallets, including further ETH and large USDC movements. Recipient addresses subsequently forwarded portions of the funds to secondary addresses.
On-chain researchers noted that the operator address used to trigger the activity had received funding through Tornado Cash in the preceding days and had deployed a contract shortly before the main sweep. Etherscan and other explorers applied “exploiter” or similar labels to the relevant addresses. Later activity included an additional sweep from Binance 14 after an intermediate transfer of USDT into that wallet, indicating continued control for a period after the initial events.
Binance’s public statements evolved within a short period. An initial post indicated the exchange was investigating and had not yet confirmed impact to user funds. Subsequent edits and follow-up posts stated that user funds are completely safe and that withdrawals would remain restricted until security checks concluded. No detailed root-cause analysis or confirmed loss figure has been published by the exchange as of this writing.
Technical Analysis: EIP-7702 Delegation and Key Control
Public transaction analysis indicates that the Binance 14 hot wallet was placed under an EIP-7702 delegation pointing to attacker-controlled code. EIP-7702 allows an externally owned account to temporarily delegate execution to contract code by means of a signed authorization. Setting or updating such a delegation requires a valid signature from the account’s own private key.
In this case, the delegation was set so that a subsequent call from an operator address could invoke a sweep function that transferred the wallet’s token balances and ETH to the attacker collection address. Because the authorization itself was signed by the hot wallet key, the sequence is consistent with compromise of that signing key rather than exploitation of a protocol bug or unauthorized contract interaction that bypasses the key.
The same access pattern appears to have been applied across multiple Binance hot wallets and chains. This suggests either shared key material, a common signing infrastructure that was compromised, or sequential compromise of several operational keys. Hot wallets by design maintain online signing capability to support withdrawals and liquidity operations; any weakness in key generation, storage, access controls, or monitoring of signing activity can produce exactly this outcome.
The use of a freshly funded operator address and a purpose-deployed contract is consistent with preparation for a targeted sweep rather than opportunistic activity. Once the delegation was in place, a single transaction could drain a large multi-token inventory.
Response and Containment
Stablecoin issuers acted rapidly. Tether blacklisted receiving addresses, freezing more than 1.5 billion USDT. Circle froze approximately 823 million USDC, with its CEO noting coordination with law enforcement. Other issuers took similar steps for assets they control. These freezes prevent further on-chain transfer of the blacklisted tokens but do not reverse already completed transfers of native assets.
Binance paused or restricted withdrawals while conducting security checks and stated that user funds remain safe. Historically the exchange has maintained a Secure Asset Fund for Users (SAFU) reserve intended to cover losses from security incidents. Whether and to what extent that reserve will be drawn upon has not been confirmed. The combination of issuer freezes and an exchange-level coverage commitment reduces the immediate risk of unrecovered stablecoin losses for users, while native-asset portions remain subject to recovery efforts or insurance.
Implications for Exchange Custody and Key Management
Hot-wallet architectures remain a high-value target because they concentrate online signing authority. The indicators in this incident highlight several recurring control failures:
- Private keys or signing systems that can authorize EIP-7702 delegations or arbitrary transfers without additional multi-party or time-delayed controls.
- Insufficient real-time monitoring of unusual delegation or sweep transactions from known operational addresses.
- Limited ability to revoke or interrupt compromised signing capability once an attacker obtains a valid signature.
For CISOs and security teams evaluating exchange counterparty risk, the event underscores that “user funds are safe” statements must be evaluated against the actual segregation of hot and cold reserves, the size and composition of any insurance or SAFU-style fund, and the speed of operational response (withdrawal freezes, issuer coordination). Organizations that rely on centralized exchanges for treasury or operational liquidity should reassess withdrawal limits, multi-sig or MPC requirements where available, and contingency plans for temporary loss of withdrawal access.
Security engineers should treat EIP-7702 and similar account-abstraction or delegation mechanisms as new attack surface on chains that support them. Detection rules that alert on unexpected set-code or delegation transactions from high-value addresses, combined with strict key-ceremony and hardware-backed signing policies for hot wallets, reduce the window available to an attacker who obtains a single key.
MITRE ATT&CK Mapping
| Tactic | Technique | ID | Relevance |
|---|---|---|---|
| Initial Access | Valid Accounts | T1078 | Compromise of hot-wallet private key provided authorized signing capability |
| Execution | Command and Scripting Interpreter | T1059 | Operator-controlled contract executed sweep logic under delegated code |
| Impact | Financial Theft | T1657 | Large-scale transfer of assets from operational wallets |
| Defense Evasion | Impair Defenses | T1562 | Use of Tornado Cash funding and fresh addresses to obscure origin |
Indicators of Compromise
The following addresses were publicly associated with the activity. They are presented defanged.
- Receiver / collection: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c
- Secondary forward address (ETH): 0x8532fa14acaf483729c449b8458aeddb900543d4
- Operator / funding address (Tornado-linked): 0x7c8601d4645b93cea45f71e118a729332e6b5ca0
Additional Binance-labeled hot wallets and downstream addresses appear in public explorers under “Binance Hot Wallet Exploiter” or similar tags. Transaction hashes and full traces are available on Etherscan and equivalent explorers for the relevant chains.
Source: On-chain data (Etherscan and related explorers), public statements from Binance (@binance), Changpeng Zhao (@cz_binance), Tether, and Circle, and contemporaneous reporting from multiple blockchain analytics and news outlets, 29–30 October 2026.