Binance hacked: $3.5 billion stolen, and how to keep your own keys

On 29 October 2026, about $3.5 billion in crypto left a Binance hot wallet A wallet connected to the internet: app, software or extension. Handy day to day, but more exposed to attacks. Hot, cold or hardware?, “Binance 14”, for addresses controlled by an unknown party. That is Arkham’s estimate as reported by The Block ($3.55 billion), and my own count on the blockchain lands in the same range: about $3.75 billion at 23:45 UTC prices. Adding bitcoin and Tron outflows that the Ethereum attack does not explain yet, Arkham counts more than $5.7 billion on the hacker’s addresses and Chainalysis puts the total at $5.9 billion, according to CoinDesk unconfirmed. On the addresses Arkham attributes to the hacker, there would be about 18,270 BTC, $1.44 billion that has not moved yet, 400,000 to 467,000 ETH depending on the snapshot time, 1.77 billion USDT and 823 million USDC, the latter two largely frozen unconfirmed. Arkham stresses that this is the value held on those addresses, not a confirmed amount stolen. Binance has published no figure.

The sequence, in UTC, from the blockchain and CryptoTicker’s timeline:

Each fact carries a label: confirmed = seen on the blockchain or officially stated by the party concerned; unconfirmed = estimate, analysis or second-hand report, to be taken with care.

What Binance says. Its first post, at 21:16, said it had “not confirmed any impact to user funds”. It was edited twice in thirteen minutes, FinanceFeeds notes, ending with: “User funds are completely safe.” A spokesperson told TechCrunch that Binance “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.” CZ, who no longer runs Binance, says that, as a shareholder, CZ expects all user funds to be fully covered. Around 00:00 UTC, Binance co-CEO Yi He went further: “Binance will cover all hacking losses” confirmed. That is a public commitment, but with no amount or timeline, and Binance has not said whether it will draw on its SAFU emergency fund, about $1 billion held in bitcoin. Yi He also thanked Ripple, which froze about $200 million of RLUSD, its stablecoin, according to Decrypt. During the night, Binance reported $2.54 billion in verified frozen assets, across all coins, then $3 billion at 00:52 UTC confirmed, and suspended deposits too, promising a full post-mortem “once the investigation is complete”, according to Cointelegraph’s live coverage.

Withdrawals. At 22:32 UTC, according to Binance, withdrawals in BTC, ETH and USDT on Ethereum and Tron were going through. Those on Solana, XRP, and stablecoins on Solana, Optimism, Avalanche, NEAR and Polygon were paused for “wallet maintenance”. Since 00:07 UTC, Binance has suspended all deposits and all withdrawals during its security checks, with no restart date.

The market. BNB, Binance’s token, fell as much as 6% in half an hour, and about $628 million of leveraged positions were liquidated within an hour, according to CoinGlass. At 01:19 UTC, bitcoin was around $76,900, down 4.9% over 24 hours, and BNB around $693, down 8%, according to Cointelegraph.

Who is the hacker? Nobody knows officially. Investigator ZachXBT and the security firm Blockaid suspect North Korea, according to CoinDesk, with no published evidence so far unconfirmed. For comparison: after the $1.46 billion Bybit theft in February 2025, the FBI pointed to North Korea.

Since the Pectra upgrade of May 2025, Ethereum lets an ordinary address hand its rules over to a program, a “smart contract”. That is EIP-7702. It is useful for paying fees differently or bundling operations, with one safeguard: the delegation must be signed with the address’s private key The secret that proves some bitcoin belongs to you and lets you spend it. Your wallet keeps it; the recovery phrase can rebuild it..

At 20:20, the hacker’s transaction carries exactly that: 50 delegations signed with Binance 14’s key, one for each of its next 50 transaction numbers. The wallet is very busy, so the point was clearly to make sure one signature would match, however many transactions went through in between. One did. From then on, Binance 14 obeys the hacker’s contract, and only the hacker’s starting address can call it. The call at 20:24 empties the wallet in one go.

Earlier that afternoon, the same starting address had run exactly this routine, a delegation and then a call to the same function, on three other addresses. It looks very much like dress rehearsals.

The real question: who signed? The hack does not come from a flaw in Ethereum or in EIP-7702: it needed Binance’s signature. Three theories are going around, none proven:

• the private key of this hot wallet was stolen;
• Binance’s signing system was tricked into signing these delegations, as at Bybit in 2025, where the attacker changed what the signers saw;
• someone on the inside helped.

For Ido Ben-Natan, head of the security firm Blockaid, it looks more like the second one: “a compromise of signing infrastructure. We don’t think a key was leaked.” unconfirmed That is a first take, not a conclusion.

One thing stands out on the blockchain: around 23:00 UTC, Binance 14 itself sent its last tokens to another Binance wallet. So Binance still had control of the address. But a key cannot be taken back: someone else may have used it too.

And the delegation stayed live for almost four hours. At 23:55 UTC, a 2,962 ETH deposit, about $6.7 million, reaches Binance 14 from a Binance deposit address: one minute later, the hacker sends it to their second address. At 00:10 UTC, Binance finally signs a new EIP-7702 transaction that clears the delegation: Binance 14 is an ordinary wallet again, and the hacker’s contract no longer has any hold on it.

On an exchange, you do not have bitcoin: you have a line in its database, a promise to give them back. The real bitcoin sit on the exchange’s addresses, with those of millions of other customers, and its keys control them. If those keys leak, if the exchange shuts down or blocks withdrawals, you wait.

Binance is not the first, and it can absorb the hit: DefiLlama counts about $144 billion on its known addresses, and the theft is about 2.4% of that. In May 2019, when it lost 7,000 bitcoin to hackers, it covered everything from its emergency fund, SAFU. Others were not so lucky:

• Mt. Gox, 2014: the biggest exchange of its day shuts down; customers wait ten years for the first repayments.
• FTX, 2022: withdrawals blocked, then bankruptcy; customers were repaid years later, in dollars, at November 2022 prices.
• Bybit, 2025: $1.46 billion stolen, the exchange survives and covers its customers.

This hack also shows the other side of freezing. Tether, Circle and Ripple could lock more than $2 billion at the hacker’s address because USDT, USDC and RLUSD have a “freeze” button in their issuer’s hands. The same button exists for you. Bitcoin has none: nobody can freeze or seize bitcoin whose keys only you hold. The flip side is that only you are responsible for them: your 24 backup words are the money.

For a miner, it is even simpler: on a non-custodial Said of a service that never holds your bitcoin: the reward goes straight to your address. solo pool A server that machines connect to. A regular pool shares the earnings, a solo pool does not. Solo or pool?, the reward goes straight from the blockchain to your address, never through an account. That is how FindMyBlock, the solo pool I run works. And to choose the right kind of wallet: hot, cold or hardware wallet.

Right now it is not possible: since 00:07 UTC, Binance has suspended all withdrawals. Use the time to get everything ready, calmly, and withdraw as soon as they reopen, starting with a small amount. Allow a quarter of an hour, plus the confirmation time.

1. Choose a wallet whose keys you hold. For an amount that matters, a hardware wallet A small device that holds the keys and signs transactions without ever showing them to the computer. Always check on its screen what you approve. bought from the manufacturer, not second-hand (the tampered Ledger case shows why). For a small amount, a well-known Bitcoin wallet app on your phone.
2. Write your 24 words down on paper, in order, when the wallet is created. Never as a photo, never in a file, never in a message. Whoever has these words has your bitcoin.
3. Create a receiving address in the wallet. A Bitcoin address starts with bc1, 3 or 1. On a hardware wallet, check it on the device’s screen, not just on the computer.
4. In Binance, open the BTC withdrawal and choose the “BTC” (Bitcoin) network. The other networks on offer, such as BEP20, send a token on another blockchain, which your Bitcoin wallet will not see.
5. Paste the address and check all of it, not just the beginning and the end. Malware can swap a copied address, and the address poisoning seen above relies precisely on addresses that look alike.
6. Send a small amount first. Follow it on mempool.space with the transaction ID Binance gives you, wait until it shows in your wallet with at least one confirmation, then send the rest. Binance charges a fixed fee per withdrawal: a test costs one extra withdrawal, the price of peace of mind.
7. If you keep an account, turn on the withdrawal address whitelist and two-factor authentication with an app or a security key, not SMS.

Same idea for ETH or stablecoins: a compatible wallet, the right network, a test first. And the golden rule once your bitcoin is home: nobody ever needs your 24 words, not Binance, not your wallet’s maker, not any “support”.

General information, not investment advice. Check the withdrawal status on Binance’s official channels before any operation.

Binance said it in its first post: beware of unofficial links, messages and requests for account information. Every famous hack is followed by a wave of scams that use it as bait. Expect:

• fake refunds: “Claim your compensation”, with a link to a fake Binance site that asks for your login or your 24 words;
• fake migrations: “Your funds must be moved to a secure wallet”, with an address supplied by the scammer;
• fake support that contacts you first, on Telegram, X or WhatsApp, to “help”;
• fake tokens that land in your wallet on their own, with a site to visit to “claim” them.

The defence fits in one sentence: act only from the app or the site you typed yourself, and never give out your 24 words. For the other classic traps: the 5 beginner mistakes to avoid.