From October 29 to 30, 2026, Binance experienced an unusually large security incident, though its impact was ultimately substantially mitigated. The core facts are these: multiple hot wallets were anomalously “swept” within a very short period, with the outflow initially tracked at tens of billions of dollars. However, major stablecoin issuers quickly froze most of the funds involved. CZ estimated the actual net loss at slightly over $1 billion, and Binance pledged to cover it in full.

Unusual outflows: Multiple hot wallets swept in quick succession

The incident began at approximately 4:24 a.m. Taipei time on October 30 (20:24 UTC on October 29), when a hot wallet labeled “Binance 14” by Binance triggered a sweep transaction, transferring approximately 167,464 ETH and 63 ERC-20 tokens in a single transaction, including about 1.615 billion USDT, then valued at approximately $2.5 billion.

Immediately afterward, the abnormal activity did not stop:

· Just 24 seconds later, another hot wallet, “Binance 16,” transferred about 28,005 ETH, along with assets including approximately 55.74 million USDT and 25.94 million RLUSD, to the same receiving address.

· About 17 minutes later (at 4:41), “Hot Wallet 34” transferred another 780 million USDC to the same address. A subsequent transfer of $43 million in USDC followed.

Because funds flowed from multiple independent hot wallets to an address created that same day within a short period, on-chain alerts initially could not rule out the possibility of a “routine operational transfer.” But the newly created receiving address, the rapid onward transfer of assets, and the use of a sweep function soon led the market to conclude that it was an attack.

Attack method: The issue was not the private key, but “signature authorization”

What makes this incident technically unusual is that the attacker apparently did not directly steal the private keys to Binance’s wallets.

On-chain analysis points to the abuse of Ethereum’s EIP-7702 mechanism. This mechanism allows an externally owned account to delegate execution rights to specific code through “signature authorization.” The attacker is suspected of obtaining such authorization through phishing or similar means, enabling them to install malicious code with a “sweeping” function on Binance-linked wallets, then call sweep to transfer assets in bulk. Security analysts noted that if the attacker had actually obtained the private keys, they would not have needed a relayer or an authorization process; they could have transferred the assets directly in an atomic transaction. Therefore, “obtaining only an EIP-7702 authorization signature” is the more plausible explanation.

This means the bar for an attack was significantly lowered: there is no need to crack a private key; tricking someone into granting signature authorization once could be enough to put an address in a state where it can be “swept.” The fact that assets could still be transferred out of the same wallet again after the initial sweep also suggests that the authorization remained effective for some time after the incident.

Freezing and confirmation: From “under investigation” to “definitely an attack”

After the incident, Binance’s public statements became noticeably more definitive. Its initial statement only said it was “investigating a potential security issue” and had “not confirmed any impact on user funds.” Over the following dozen or so minutes, the statement was revised several times. The final version said that “user funds are completely safe,” although it still did not officially describe the incident as a “theft” or “hack.”

The turning point came with CZ (Changpeng Zhao)’s statement. He explicitly said, “This does look like a hack against Binance,” while emphasizing that user funds were safe and thanking Tether and Circle for their swift freezing actions. CZ also explained that he no longer manages Binance’s day-to-day operations, but as a shareholder, he expected all user funds to be fully covered.

Stablecoin issuers froze funds as the incident was being characterized:

· Tether froze more than 1.567 billion USDT (other reports put the figure at about $971 million);

· Circle froze approximately 823 million USDC.

The two freezes totaled approximately $2.39 billion, which is key to understanding the huge gap between the subsequent “funds transferred out” figures and the “actual losses.”

Reported figures versus actual losses: Why the estimate fell from billions to “just over $1 billion”

Because the attack involved multiple wallets, several blockchains, and dozens of tokens, on-chain estimates of the total outflow were initially highly inconsistent: from early figures of about $2.5 billion and $2.8 billion, to a later estimate of about $3.3 billion, and even estimates of more than $5.8 billion from some monitoring firms.

But these figures mainly represent the volume of transfers, not the final unrecoverable net loss. An estimate by DefiLlama founder 0xngmi offers a clearer picture: after the large-scale freezes of USDT and USDC, the incident’s total losses were about $1 billion—just 0.69% of Binance’s approximately $144 billion in assets under custody, an amount Binance’s balance sheet could easily cover. CZ reposted this estimate and added that “the loss may be a little higher than this, but it will be fully covered.”

The figures fit together as follows: Of the assets transferred by the attacker, about $2.4 billion in stablecoins were frozen by their issuers. The portion that truly left Binance’s control and was not frozen in the short term came to around $1 billion. Binance therefore faced a net loss it could cover, rather than a total wipeout of tens of billions of dollars.

Withdrawals suspended and the actual impact on users

During the security review, Binance suspended withdrawals. The company initially said some users’ withdrawals were blocked by a “technical error,” then clarified that “withdrawals will resume once the security issue has been fully resolved,” reiterating that user funds were safe. This means the direct impact on ordinary users was mainly a temporary interruption to withdrawals, rather than their account balances being wiped out. CZ and Binance’s official statements were consistent: user funds were “completely safe,” and the platform would cover the losses.

Overall, the true picture of this incident is that it was a large-scale unauthorized sweep targeting Binance hot wallets by exploiting the EIP-7702 authorization mechanism. The reported outflow once reached tens of billions of dollars, but thanks to stablecoin freezes and the buffer provided by the platform’s balance sheet, the actual net loss was reduced to around $1 billion. Users suffered no direct losses, and withdrawals resumed after security was confirmed. The attacker’s identity and the specific method used to obtain authorization have not yet been disclosed, and investigations and efforts to recover the funds are ongoing.