
Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 Billion
Decrypt reports that at least $5.57 billion left Binance-linked hot wallets on Ethereum, Bitcoin and Tron on 29 October 2026, which would be the largest crypto hack on record. On-chain analysts point to an EIP-7702 delegation, installed from a Tornado Cash-funded address minutes before the first sweep. Tether and Circle froze about $1.8 billion. Binance has not confirmed the hack, and how the attacker obtained the signature is unknown.
What it is
On 29 October 2026, at least $5.57 billion left Binance-linked hot wallets across three chains, according to an on-chain tally cited by Decrypt. The split is $3.51 billion on Ethereum, $1.44 billion in 18,270 BTC and $630 million on Tron. Decrypt says this would be the largest crypto hack on record, more than triple the roughly $1.5 billion Bybit theft of February 2025. Binance had not confirmed a hack at the time of writing.
How it works
Etherscan shows the first Ethereum transaction at 20:24 UTC. A Binance-labeled wallet sent 167,464 ETH and 63 token transfers, including 1.615 billion USDT, to a brand-new address. Three minutes earlier (3m24s, per Odysseas Lamtzidi of Phylax Systems), an address funded through Tornado Cash submitted an EIP-7702 delegation for a Binance hot wallet.
EIP-7702 lets an ordinary wallet run smart-contract code. Lamtzidi says the delegation persists and the delegated code can authorize later transfers without another signature from the wallet. In his reading, the wallet itself becomes the sweeper. The page does not say how the Bitcoin and Tron outflows were done.
Preconditions / Affected
The delegation needed a valid signature from the targeted wallet, and the page says how the attacker obtained it is unknown. The affected assets are Binance hot wallets, the internet-connected wallets used for customer withdrawals. Binance says it has "not confirmed any impact to user funds."
What to do
The page gives no mitigations or detections. Its only guidance is that Binance will post verified updates through its official channels. The timing gap between a delegation transaction and the first sweep (three minutes here) is the one observable the page documents.
Caveats
- The $5.57 billion figure is an on-chain tally, not a Binance figure, and one analyst quoted says the total is likely higher.
- The 7702 account of the Ethereum sweep comes from on-chain analysts, not from Binance.
- Tether froze 975.1 million USDT and Circle froze 823 million USDC in the main receiving wallet (Circle's freeze at 21:04 UTC), about $1.8 billion in total. Circle CEO Jeremy Allaire says the freeze was coordinated with law enforcement. The analyst Wazz says the attacker is moving the remaining funds fast, and that about $800 million might still be frozen.
- Market moves reported: Bitcoin fell below $79,000, BNB dropped about 7% to roughly $699, and Monero rose about 6% to $637.
Organisations named here
- Jeremy Allaire
- Odysseas Lamtzidi
- Phylax Systems
Technologies named here
- EIP-7702
- Tornado Cash
- Ethereum
- Bitcoin
- TRON
- Tether
- Binance
- Circle
- Bybit
- Binance exchange (investigating a potential security issue; no confirmed impact to user funds)
- Binance hot wallets on Ethereum ($3.51 billion), Bitcoin ($1.44 billion in 18,270 Bitcoin) and Tron ($630 million)
- Circle address freezing
- Ethereum wallets using EIP-7702 delegation
- Etherscan
- Tether address freezing
Techniques named here
- EIP-7702 delegation abuse
- Funding through a mixer (Tornado Cash)
- Stablecoin issuer address freezing
Related in Blockchain

THORChain Exploit Report #2 — GG20 root-cause disclosure

Black Thursday revisited: MakerDAO keeper exploited for $500K
.jpg)