Binance hack concerns emerged on 29 October 2026 after more than $2 billion in crypto assets moved from exchange-labelled hot wallets to a newly created address. Binance said it was investigating a potential security issue, but had not confirmed a breach or any impact on user funds.
The scale, speed and structure of the transactions prompted immediate scrutiny from blockchain analysts. Later estimates suggested that suspicious movements across Ethereum, Bitcoin and Tron could total as much as $5.8 billion, although figures remain provisional while the investigation continues.
What triggered the Binance hack concerns
At approximately 20:24 UTC on 29 October, an Ethereum wallet labelled Binance 14 transferred 167,464 ETH and initiated 63 ERC20 token transfers. The assets, which included roughly $1.6 billion in USDT, were sent to a brand new address.
Seconds later, another exchange-labelled wallet, Binance 16, sent approximately 28,005 ETH to the same destination. The receiving address had not existed before that day and forwarded approximately 195,460 ETH to another newly created address within minutes.
These rapid movements resembled a wallet sweep, in which most or all available assets are consolidated and moved elsewhere. Because the source addresses were publicly labelled as Binance hot wallets, the activity raised questions about whether an unauthorised party had gained control.
A hot wallet remains connected to online systems so that an exchange can process customer transactions quickly. This accessibility makes hot wallets operationally useful, but it also means that a compromise of signing authority, wallet infrastructure or delegated permissions can allow assets to be moved rapidly.
Public reporting initially focused on more than $2 billion leaving the Ethereum wallets. Subsequent cross-chain analysis described approximately $3.51 billion on Ethereum, 18,270 BTC on Bitcoin and around $630 million on Tron. The Block reported that total suspicious outflows could be as high as $5.8 billion.
Timeline of the suspected Binance hack
- At approximately 20:24 UTC on 29 October 2026, Binance 14 transferred 167,464 ETH and 63 ERC20 tokens to a new address.
- Within seconds, Binance 16 sent approximately 28,005 ETH to the same destination.
- Within minutes, the receiving wallet forwarded about 195,460 ETH to another fresh address.
- Later that evening, Binance said it was aware of reports of a potential security issue and was actively investigating. It had not confirmed an impact on user funds.
- Tether reportedly froze approximately 975.1 million USDT, while Circle froze about 823 million USDC associated with the receiving addresses.
- Changpeng Zhao, Binance co-founder, said the exchange may have been hacked, while stating that user funds were safe and that he expected them to be covered.
The reported stablecoin freezes covered roughly $1.8 billion of the moved assets. Freezing prevents affected USDT and USDC from being transferred or redeemed, which can significantly restrict an attacker’s ability to convert or disperse those funds.
How the possible Binance hack may have worked
Analysis of the Ethereum activity identified an EIP-7702 delegation involving Binance 14 shortly before the asset sweep. EIP-7702 allows an externally owned Ethereum account, which is normally controlled by a private key, to delegate transaction execution to smart contract code.
Reporting described a Tornado Cash funded address submitting the delegation approximately three minutes before the sweep. The delegation pointed Binance 14 to a contract deployed earlier on 29 October. Once active, that contract could execute code through the wallet’s authority.
This sequence provides a possible technical explanation for how numerous assets could be swept in a coordinated transaction. Delegated code can also remain active and support later transactions without requiring a new signature for each individual asset movement.
However, the delegation alone does not explain how the required authorisation was obtained. Investigators had not established whether credentials were stolen, a signing system was compromised, an internal process was abused or another wallet security failure occurred.
The claimed connection to Tornado Cash also requires caution. Although several reports described the funding link, at least one outlet said it had not independently verified that element at the time of publication. No threat actor has been identified by Binance or law enforcement.
Wallets connected to the Ethereum transfers
The labelled source wallets provide useful indicators for organisations monitoring blockchain activity. Binance 14 is recorded as 0x28C6c06298d514Db089934071355E5743bf21d60. Binance 16 is recorded as 0xdfd5293d8e347dfe59e90efd55b2956a1343963d.
Reports said Etherscan subsequently tagged receiving addresses as being associated with a Binance hot wallet exploiter. Exact destination addresses were not consistently published by the cited reports, so responders should verify labels and transaction histories directly before using them in blocking or compliance decisions.
What is confirmed about the Binance hack
The unexplained transfers are visible on-chain, and multiple independent outlets have attributed the source addresses to Binance-labelled wallets. There is also consistent reporting of large movements across Ethereum, Bitcoin and Tron, followed by coordinated action from Tether and Circle.
What remains unconfirmed is whether the event was definitely an external Binance hack. Binance described the matter as a potential security issue under investigation and said it had not confirmed any effect on customer funds. Claims that the company had formally confirmed a major breach therefore went beyond its stated position.
The incident represents suspected exploitation in the wild rather than a theoretical vulnerability or proof of concept. The movements have already occurred, but the cause, actor, total value and final destinations remain subject to investigation.
Why the Binance outflows matter
For organisations holding crypto assets on Binance, the event creates immediate uncertainty around access, liquidity and custodial concentration. Statements that customer funds are safe and the reported freezing of stablecoins are reassuring, but they do not replace a formal incident report explaining the cause and scope.
The cross-chain activity is particularly significant because it may indicate coordinated access to several wallet environments rather than an isolated Ethereum transaction. Alternatively, some movements could prove to be legitimate internal wallet management. Only Binance’s investigation can resolve that distinction.
What organisations should do now
- Follow official Binance communications and treat social media claims or unsolicited support messages with caution.
- Review Binance account activity, withdrawal records, API keys and authorised devices for anomalies.
- Confirm that finance and security teams can access records needed to reconcile balances and transactions.
- Assess whether business-critical crypto holdings are overly concentrated on one exchange or in online custody.
- Avoid rushed transfers based solely on speculation, but prepare a controlled contingency plan if Binance reports customer impact or restricts services.
Organisations should also expect criminals to exploit Binance hack coverage through phishing emails, fake reimbursement portals and fraudulent wallet verification requests. Any instruction involving credentials, recovery phrases or transfers should be checked through independently accessed official channels.
Originally reported by Yahoo Finance.
