Binance Suffers Record $6.3 Billion Security Breach, With $3 Billion in Assets Frozen

​

Binance has confirmed a major security breach affecting an estimated $6.3 billion in cryptocurrency assets, potentially making it the largest hack in the history of the digital asset industry. The exchange said approximately $3 billion in affected assets has been frozen on-chain, while preliminary findings point to a compromised employee laptop rather than a direct wallet private key leak.

The incident, which unfolded on October 29, 2026 (UTC), involved unauthorized transactions across several Binance-linked hot wallets and multiple blockchain networks, including Ethereum, Bitcoin and Tron.

According to Binance, the exchange has temporarily suspended deposits and withdrawals as a precaution while security investigations continue. It has also pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and company funds, emphasizing that customer assets remain safe.

How the Attack Unfolded

Blockchain security firm Blockaid identified a sophisticated attack centered on an Ethereum hot wallet labeled "Binance 14."

According to the firm's investigation, the attackers began preparing for the operation on October 28, funding their operational wallets through Tornado Cash, deploying a malicious smart contract and testing the mechanism on controlled addresses.

The main Ethereum attack began at approximately 20:20 UTC on October 29, when the attacker submitted a transaction containing 50 EIP-7702 authorizations targeting Binance 14.

EIP-7702 is an Ethereum mechanism that allows an externally owned account to delegate certain execution capabilities to smart contract code.

Because Binance 14 was an active hot wallet with a continuously changing transaction nonce, the attacker submitted authorizations covering 50 consecutive nonce values. One matched the wallet's current nonce, allowing the malicious delegation to take effect.

Minutes later, approximately 167,464 ETH, 1.615 billion USDT and more than 60 other tokens were transferred out of Binance 14 in a single transaction.

Additional unauthorized transfers followed from other Binance-linked wallets, with blockchain investigators identifying substantial outflows across multiple networks.

Binance's Preliminary Investigation Points to Compromised Laptop

In an official security update​ published on October 30, Binance said its initial investigation suggests that a laptop belonging to a DevOps engineer may have been compromised.

The attacker may have used that access to enter a service container and submit unauthorized withdrawal transactions.

Binance emphasized that it has found no evidence of wallet private keys being leaked.

However, Blockaid's analysis showed that the EIP-7702 authorizations were signed using Binance 14's wallet credentials, raising questions about how the attacker gained access to the exchange's transaction authorization infrastructure.

The available evidence does not establish whether an insider was involved, and the precise mechanism behind the unauthorized signatures remains under investigation.

Around $3 Billion Frozen as Recovery Efforts Continue

Binance estimates the overall impact of the security incident at approximately $6.3 billion, while Blockaid initially tracked at least $5.5 billion in outflows from Binance-linked wallets.

Stablecoin issuers Tether and Circle moved to restrict transfers involving assets linked to the attack, freezing more than $1.5 billion in USDT and approximately $823 million in USDC, respectively.

Binance subsequently reported that roughly $3 billion in affected assets had been frozen on-chain through cooperation with blockchain partners.

The exchange has also taken several immediate measures, including revoking the affected wallet authorization, temporarily suspending deposits and withdrawals, and working with law enforcement and blockchain intelligence firms to trace the stolen funds.

Binance said it will cover all losses using SAFU and corporate funds. An updated Proof of Reserves report will be published once remediation is complete.

Potentially the Largest Crypto Hack on Record

If the estimated $6.3 billion impact is confirmed, the incident would significantly surpass the approximately $1.5 billion Bybit hack in February 2025, previously regarded as the largest cryptocurrency theft on record.

The incident has renewed concerns about the security of centralized cryptocurrency exchanges, particularly the infrastructure used to authorize transactions and manage hot wallets.

Unlike traditional private key theft, the Binance case highlights the possibility that attackers could compromise internal systems and exploit legitimate authorization mechanisms to move assets without directly extracting private keys.

The final financial impact will depend on asset recovery, the effectiveness of the freezes and Binance's ability to replenish affected reserves.

Binance has not yet released a complete technical post-mortem or a confirmed timeline for fully restoring deposit and withdrawal services.

The exchange said it will provide further updates once its investigation is complete and urged users to rely on official Binance channels for verified information.