Binance Halts Withdrawals Amid Multi-Billion-Dollar Hot Wallet Breach as Stablecoin Issuers Freeze Over $2.5 Billion

Global cryptocurrency exchange Binance suspended customer deposits and withdrawals following a massive suspected security breach on October 29, 2026, that saw billions of dollars in digital assets drained from the platform’s operational hot wallets. While the company has yet to publish a definitive loss figure or a formal post-mortem, founder and former CEO Changpeng Zhao publicly acknowledged that the incident appears to be a hack on Binance, adding that user funds are secure and expected to be fully covered.

In the hours immediately following the irregular outflows, major stablecoin issuers and blockchain projects launched an unprecedented emergency response. According to official statements from industry executives and exchange representatives, more than $2.5 billion to $3 billion in transferred tokens were rapidly frozen across multiple networks, severely restricting the attacker's ability to liquidate the stolen stablecoins.

How the Outflows Unfolded

The incident began on the afternoon of October 29, 2026, when blockchain monitoring systems and independent on-chain analysts detected massive, unscheduled asset transfers originating from Ethereum wallets publicly associated with Binance.

At 4:24:23 p.m. EDT (20:24:23 UTC), a single Ethereum transaction drained approximately 167,464 ETH, 1.615 billion USDT, and dozens of additional ERC-20 tokens from an address labeled on Etherscan as Binance 14. Just two minutes later, another 28,005.6 ETH was transferred out of a second exchange wallet labeled Binance 16. Subsequent unauthorized movements also targeted Hot Wallet 34, from which 780 million USDC was extracted via delegated permissions linked to the initial compromised wallet. At 5:04:23 p.m. EDT (21:04:23 UTC), a secondary sweep extracted an additional 1,699.92 ETH from Binance 14 to the same recipient address, demonstrating that the underlying wallet authorization remained active even as initial token freezes began.

Because the incident remains under active investigation and spanned multiple wallets and blockchain networks—with observers noting subsequent anomalous transfers on Ethereum, Bitcoin, and Tron—independent estimates of the total gross outflow vary considerably. Early security assessments cited by financial media established an unconfirmed floor of $1.7 billion, while other researchers analyzing the initial Ethereum hot wallet sweeps calculated roughly $2.8 billion to $3.5 billion in immediate movements. Broader multi-chain tracking estimates cited by industry outlets suggested that total gross outflows across all affected exchange wallets could reach up to $5.6 billion or $5.7 billion, potentially making the breach the largest single cryptocurrency theft in history.

However, security analysts and news organizations emphasize that gross transaction outflows do not represent a confirmed final loss. Early on, security firm Blockaid noted in a 5:11 p.m. EDT assessment that while the movements appeared consistent with unauthorized activity, outside observers could not immediately differentiate stolen assets from emergency internal treasury sweeps conducted by the exchange to secure remaining balances. Furthermore, billions of dollars in centralized stablecoins were blacklisted before they could be swapped or laundered.

Technical Mechanism: EIP-7702 Delegation and Key Control

On-chain forensic analysis indicates that the Ethereum portion of the drain relied heavily on EIP-7702, an Ethereum network feature introduced during the Pectra upgrade on May 7, 2025. EIP-7702 allows a standard externally owned account (EOA)—a regular cryptocurrency wallet controlled by a private key—to temporarily delegate its execution authority to smart contract code via a cryptographically signed authorization.

According to blockchain records, at 20:20:59 UTC—just three minutes and 24 seconds before the main drain—an operator address submitted a signed authorization that bound the Binance 14 hot wallet to a custom smart contract deployed by the attacker. Once that delegation was installed, the wallet effectively acted as an automated sweeper. The attacker’s operator address, which on-chain researchers noted had been funded through the Tornado Cash privacy mixer in the days preceding the attack, was then able to invoke a sweep function that drained the wallet's ETH and token balances in a single transaction without requiring separate signatures for each asset transfer.

Crucially, cybersecurity analysts point out that installing an EIP-7702 delegation requires a valid cryptographic signature from the target wallet’s own private key. Because the authorization was properly signed, researchers at security firms including Defimon and ThreatLandscape concluded that the incident was likely the result of a compromised private signing key or compromised internal signing infrastructure, rather than a vulnerability in the Ethereum protocol itself. How the attacker obtained the valid signature—whether through an external breach of key management systems or unauthorized internal access—remains unverified, and Binance has not yet commented on the root cause.

Rapid Stablecoin Freezes Limit Attacker Liquidity

While native cryptocurrencies such as Ether (ETH)—of which roughly 195,460 to 195,470 ETH (valued at over $440 million) moved into attacker-controlled addresses—cannot be centrally frozen on the blockchain, centralized stablecoin issuers moved swiftly to blacklist the recipient wallets.

• Tether (USDT): Tether CEO Paolo Ardoino announced that the company froze more than 1.567 billion USDT connected to the suspected Binance exploit.
• Circle (USDC): At 5:18 p.m. EDT, Circle CEO Jeremy Allaire confirmed that Circle, acting in coordination with law enforcement, had frozen more than 800 million USDC associated with the incident.
• USD1 and WLFI: At 6:22 p.m. EDT, Binance co-founder Yi He stated that an additional $27 million in USD1 and 48 million WLFI tokens (valued at approximately $2 million) had also been frozen.

Combined, these interventions locked down between $2.4 billion and $3 billion in digital assets within hours of the initial breach, preventing the perpetrator from moving or cashing out the vast majority of the stolen stablecoins.

Official Response, Operational Impact, and Market Reaction

Binance’s public communications evolved rapidly as the scope of the outflows became apparent. After initially attributing early withdrawal delays to a technical issue, the exchange updated its status notices to confirm it was investigating a security incident. In a statement published at 6:33 p.m. EDT, Binance announced that its team is conducting security checks, withdrawals will resume as soon as the security issue is fully resolved, and user funds remain safe. At 7:06 p.m. EDT, the platform also temporarily suspended trading on Binance Alpha as part of its ongoing security precautions, though standard spot and derivatives trading on the main exchange continued to operate.

Meanwhile, Binance.US issued a formal statement at 5:41 p.m. EDT clarifying that it was completely unaffected by the security incident at Binance.com. The U.S. entity emphasized that it operates as a separate, independent platform and that its customer deposits, withdrawals, and trading services remained fully functional. Elsewhere in the ecosystem, prediction market platform Polymarket temporarily halted trading and paused its relayer amid the broader market uncertainty triggered by the breach.

Former Binance CEO Changpeng Zhao addressed the crisis publicly, stating that while he no longer manages daily operations at Binance.com, it does look like a hack on Binance, while expressing confidence as a shareholder that all user losses will be covered in full. Binance maintains an emergency insurance reserve known as the Secure Asset Fund for Users (SAFU), established in July 2018 specifically to reimburse customers in the event of catastrophic security breaches.

The news triggered immediate volatility across global cryptocurrency markets. Within an hour of the initial on-chain alerts, more than $628 million in leveraged trading positions were liquidated across the crypto market. The price of Bitcoin (BTC) fell 3.2% to trade below $79,000 (hovering near $78,840 late Thursday), while Binance's native ecosystem token, BNB, dropped between 6.3% and 6.9% to approximately $702.97.

As of October 30, 2026, Binance deposits and withdrawals remain paused with no confirmed timeline for restoration as internal security teams, external blockchain forensic investigators, and law enforcement agencies work to trace the remaining unrecovered funds and audit the exchange's signing infrastructure.