Breaking News! The World's Largest Exchange Hacked for 40 Billion
Between October 29 and 30, 2026, Binance experienced a major security incident, with large-scale abnormal fund outflows from related addresses across multiple blockchain networks.
According to Binance's latest announcement released on October 30, preliminary investigations indicate that the incident may involve the laptop of a DevOps engineer being compromised, through which attackers gained access to a service container and submitted unauthorized withdrawal transactions.
Binance currently estimates the total impact of the incident at approximately $6.3 billion, and has worked with blockchain partners to freeze approximately $3 billion in related assets.
Notably, Binance stated that no evidence of wallet private key leakage has been found so far, and committed to covering all losses through the SAFU fund and the company's own funds to ensure the safety of user assets.
The following retrospective is based on Binance's official announcements, public statements from co-founder Yi He and CZ (Changpeng Zhao), as well as information disclosed by on-chain analytics firms and security researchers. Official preliminary investigation conclusions and third-party analyses are labeled separately; the final attack path and loss figures remain subject to Binance's subsequent technical report.
01 Incident Overview
Time: October 29–30, 2026.
Scope: Binance-related addresses across Ethereum, Bitcoin, Tron, and multiple blockchain networks including Arbitrum, Optimism, Base, and Avalanche.
Official preliminary investigation: May involve the laptop of a DevOps engineer being compromised, through which attackers gained access to a service container and submitted unauthorized withdrawal transactions.
Private key status: Binance stated that no evidence of wallet private key leakage has been found so far.
Total impact: Official preliminary estimate of approximately $6.3 billion.
Frozen assets: Approximately $3 billion (on-chain frozen amount).
Official response: Binance committed to covering all losses through the SAFU fund and the company's own funds, and is working with law enforcement agencies and blockchain intelligence partners to trace the funds.
02 Timeline Reconstruction (Beijing Time, approximately UTC+8)
Preparation Phase (October 28–29)
According to third-party on-chain analysis, attackers may have conducted approximately one and a half days of preparation before formally moving funds.
On-chain data shows that attack-related addresses withdrew small amounts of ETH from Tornado Cash as gas fees, deployed sweeping contracts, and conducted EIP-7702 delegation and sweeping drills on test wallets.
From fund preparation and contract deployment to test transactions, the entire process demonstrates a high degree of planning.
However, these are on-chain researchers' analyses of the attack preparation phase; Binance has not yet published complete internal investigation results.
Main Attack Phase (from approximately 4:00 AM on October 30)
According to public on-chain data, multiple Binance-related wallets showed large abnormal transfers within a short period.
Bitcoin: Related hot wallets transferred out approximately 18,270 BTC.
Ethereum: The wallet labeled Binance 14 transferred out approximately 167,464 ETH, approximately 1.615 billion USDT, and over 60 other tokens in a single transaction, with the asset value involved in the single transaction reaching approximately $2.5 billion.
Subsequent transfers: Approximately 24 seconds later, the Binance 16 wallet transferred out approximately 28,005 ETH to the same address.
Other networks: Subsequently, Tron, Arbitrum, Avalanche, and other networks also saw large fund transfers, with some USDC transferred out through related smart contract wallets.
Based on on-chain transaction timing, the main fund transfers were concentrated within approximately 40 minutes, with some remaining balances continuing to be processed afterward.
Response Phase
After the incident, stablecoin issuers and blockchain ecosystem institutions took swift action.
Issuers including Tether and Circle froze some related stablecoin assets, and other project teams and security firms also participated in fund tracing.
Protocols such as Aave implemented restrictive measures to prevent related assets from being further transferred through collateralized lending and other means.
Meanwhile, Binance suspended deposits and withdrawals, conducted security checks, revoked authorizations on affected addresses, and worked with law enforcement and blockchain intelligence partners to trace and recover funds.
03 Key Official Statements
Yi He (Binance Co-founder) (Beijing Time approximately 8:04)
"Yi He stated that user funds are safe and Binance will bear all losses caused by the hack. Deposits and withdrawals are temporarily suspended; the team is conducting security checks, freezing funds, and cooperating with law enforcement. A full post-mortem report will be published after the investigation concludes."
Binance Official Latest Announcement
On October 30, Binance further disclosed preliminary investigation results:
The incident may involve the laptop of a DevOps engineer being compromised.
Attackers may have used this to access a service container and submit unauthorized withdrawal transactions.
No evidence of wallet private key leakage has been found so far.
The total impact of the incident is preliminarily estimated at approximately $6.3 billion.
In collaboration with blockchain partners, approximately $3 billion in related assets has been frozen on-chain.
Binance also committed to covering all losses through the SAFU fund and the company's own funds.
CZ (Changpeng Zhao)
Clearly stated "It does look like a hack on Binance," user funds are safe; thanked Tether and Circle for the rapid freeze; although no longer managing Binance.com, as a shareholder expects all user funds to be fully covered.
Overall, Binance's most definitive official stance at present is: bearing all losses, ensuring user fund safety, and publishing a complete technical retrospective after the investigation is completed.
04 Fund Flows and Freezing Status According to data previously disclosed by on-chain analytics firms and researchers including Arkham, Chainalysis, Decrypt, and Conor Grogan, estimates of the fund scale involved in this incident are concentrated in the $5.57 billion to $5.9 billion range.
Third-party analysis valuations of different on-chain assets are approximately as follows:
Ethereum: Approximately $3.5 billion.
Bitcoin: Approximately $1.44 billion to $1.49 billion, corresponding to approximately 18,270 BTC.
Tron: Approximately $620 million to $630 million.
Other chains: Tens of millions of dollars combined.
According to Binance's latest announcement on October 30, the total impact of the incident is preliminarily estimated at approximately $6.3 billion, with approximately $3 billion in related assets currently frozen on-chain.
Binance stated it will continue to work with blockchain partners and law enforcement agencies to trace related funds, and will cover all losses through the SAFU fund and the company's own funds.
05 Public Information on Attack Methods
According to Binance's latest announcement, preliminary investigations indicate that the incident may involve the laptop of a DevOps engineer being compromised. Attackers used this to access a service container and submit unauthorized withdrawal transactions.
Notably, Binance stated that no evidence of wallet private key leakage has been found so far. This means attackers may not have directly stolen private keys, but rather abused related transaction permissions by compromising the internal operations environment.
Meanwhile, third-party on-chain analysis indicates that the EIP-7702 mechanism may have been used during the attack, executing large-scale fund transfers through delegation authorization and smart contracts.
EIP-7702 is an Ethereum account feature that allows regular wallets to delegate smart contract code execution, but the mechanism itself is not a security vulnerability.
Currently, Binance has not published a complete technical report, and the specific connection between the DevOps device compromise and EIP-7702 operations remains to be confirmed; the final attack path is subject to official investigation results.
06 Market Impact and Aftermath
After the incident, Bitcoin, Ethereum, BNB, and others saw significant declines, with large-scale liquidations in the futures market across the network in a short period. Binance has fully suspended deposits and withdrawals for security checks and stated it will publish a complete post-mortem report.
Binance.US explicitly stated it was not affected.
Multiple institutions in the industry (Coinbase, stablecoin issuers, security firms, etc.) quickly collaborated to freeze assets, demonstrating the critical role of centralized issuers in responding to such incidents.
The incident is still under investigation; final loss figures, attack paths, and liability determinations are subject to official releases. (Information as of October 30, 2026)
