Key Points on the Binance Hack
On the evening of October 29, 2026 (UTC)—which was early morning on October 30 in UTC+8 regions such as Hong Kong, Taiwan, and Singapore—multiple hot wallets at Binance, the world’s largest cryptocurrency exchange, were emptied. As of 12:00 p.m. on October 30 (UTC+8), the known details are as follows:
- Extent of Losses: Binance officially estimates the total impact of the incident at approximately $6.3 billion. Previous estimates from analytics firms ranged from approximately $5.3 billion to $5.9 billion, while Chainalysis estimated the figure at $5.912 billion. Looking solely at the portion directly verifiable on the Ethereum mainnet, this already includes approximately 1.82 billion USDT, 823 million USDC, and about 173,000 ETH.
- Attack Methods: The attacker obtained 50 EIP-7702 authorizations signed with Binance hot wallet private keys, granting execution permissions for the hot wallet to a contract they had deployed, and then transferred the assets in one go. Binance’s preliminary investigation indicates that the incident may have involved a breach of a DevOps engineer’s laptop; no evidence of a wallet private key leak has been found so far.
- Freeze on Progress: Binance officials stated that they have verified the freezing of approximately $3 billion, primarily consisting of USDT frozen by Tether and USDC frozen by Circle.
- Official Handling: Binance has suspended all deposits and withdrawals and revoked authorization for the affected addresses. The company stated that it will cover all losses using the SAFU Fund and company funds, ensure the safety of user funds, and publish a technical post-incident report and an updated proof of reserves once the investigation is complete.
- Assets Still in Transit: Assets such as ETH—which cannot be frozen by any issuer—remain in the attacker’s possession, and the attacker is currently exchanging other tokens for ETH via decentralized exchanges.
This situation is still unfolding. The figures below are current as of the time of writing; please refer to Binance’s official channels for the latest updates.
Incidents involving exchange hot wallets have prompted many readers to reconsider where to store their assets. Many jurisdictions have clear requirements regarding how licensed platforms must safeguard client assets. For example, the Hong Kong Securities and Futures Commission (SFC) mandates that licensed virtual asset trading platforms must store at least 98% of client virtual assets in cold wallets. When choosing a platform, you should first check whether it is licensed in your jurisdiction and how it custodians client assets. If you wish to trade BTC or ETH through a licensed brokerage, you may consider Futu Securities (a SFC-licensed brokerage; account eligibility and tradable cryptocurrencies are subject to the platform’s terms):
What Should Binance Users Do Now?
Binance has temporarily suspended deposits and withdrawals, so users are currently unable to transfer their assets out of their accounts. The greatest risk during this time is often not the incident itself, but phishing messages that exploit the situation to scam users. Here’s what you can do at this stage:
- Rely Only on Official Channels: The latest updates are available exclusively through Binance’s official X account (@binance), in-app notifications, and the official announcements page. He Yi also reminded users in her post to rely solely on official channels.
- Do not click on the “Compensation Claim” or “Emergency Withdrawal” links: Binance has not yet announced any compensation process that requires users to apply on their own. Any link that asks you to log in, enter a verification code, or connect your wallet should be considered a phishing attempt.
- Do not provide verification codes, passwords, or private keys to anyone: Binance customer service will never proactively contact you via private message to request this information.
- Please do not deposit funds into Binance during the suspension period: The official platform has suspended deposits, and assets transferred during this time may not be credited immediately.
- Save Account Records: Take a screenshot within the app to save your current asset details and recent transaction history for future reference.
- Do not sign any “account upgrade” or authorization requests from unknown sources: The core issue in this incident is precisely the EIP-7702 authorization. If your wallet receives a request to sign a delegation or smart account upgrade, do not sign it until you have verified the source.
After completing the above steps, you can wait for Binance to announce its plans for resuming withdrawals. In her post, He Yi stated that Binance will first ensure that security scans are complete and that there are no security risks before reopening withdrawals. Once withdrawals resume, you can assess, based on your own circumstances, whether to diversify your assets by holding them on licensed platforms in your region (such as Futuhui Securities) or a self-custody wallet.
Timeline of the Binance Hack
The times listed below are primarily in UTC+8 (Hong Kong, Taiwan, Singapore, and Malaysia time), with UTC times shown alongside. The data is sourced from Ethereum on-chain transaction records and official account posts.
| UTC+8 | UTC | Event |
|---|---|---|
| 10-28 15:39 | 10-28 07:39 | The attacker's address first received approximately 0.1 ETH via Tornado Cash, followed by two additional transactions. |
| Oct. 29, 9:51 p.m.–Oct. 30, 12:47 a.m. | Oct. 29, 1:51 p.m.–4:47 p.m. | The attacker rehearsed the "delegate and transfer" process on three wallets under their control. |
| 10-29 23:59 | 10-29 15:59 | Deploy the "sweeper" contract used to empty the wallet |
| 10-30 04:20:59 | 20:20:59 | A single transaction included 50 EIP-7702 authorizations signed with the Binance 14 private key, one of which took effect. |
| 10-30 04:24:23 | 20:24:23 | Attacker Triggers Drain: 167,464 ETH, approximately 1.615 billion USDT, and over 60 different tokens were transferred out |
| 10-30 04:41:23 | 20:41:23 | 780 million USDC was transferred from Binance 14 to another wallet (Hot Wallet 34), and 43 million USDC was transferred 18 minutes later. |
| 10-30 05:15 | 21:15 | CZ posted, saying, "It looks like Binance has been hacked," raising concerns about the safety of user funds |
| 10-30 05:29 | 21:29 | Binance's First Statement: "We are investigating," and "User funds are completely safe" |
| Before 05:36 on October 30 | Before 9:36 p.m. | Tether announced that it had frozen more than 1.567 billion USDT; Circle announced that it had frozen more than 800 million USDC |
| 10-30 05:44 | 21:44 | Attackers Have Once Again Emptied Binance 14, Transferring Approximately 200 Million USDT |
| 10-30 06:33 | 22:33 | Binance Announces Suspension of Withdrawals |
| 10-30 06:39 | 22:39 | The attacker switched to a new receiving address and continued to transfer assets out of Binance 14. |
| 10-30 07:22 | 23:22 | Binance: Confirmed that $2.54 billion has been frozen |
| 10-30 07:56 | 23:56 | The attacker last transferred approximately 2,962 ETH from Binance 14. |
| 10-30 08:13 | 00:13 | Binance announced it would cover all losses and suspended both deposits and withdrawals |
| 10-30 08:14 | 00:14 | Arbitrum Security Committee Freezes Approximately $30.5 Million in Assets Belonging to Attackers |
| 10-30 08:52 | 00:52 | Binance: Has Verified the Freezing of Approximately $3 Billion |
| 10-30 09:44 | 01:44 | He Yi stated that withdrawals will only resume once the security scan is complete and it has been confirmed that there are no security risks. |
| 10-30 10:25 | 02:25 | Binance Releases Preliminary Investigation: A DevOps engineer’s laptop may have been compromised; total estimated impact is approximately $6.3 billion, with all losses to be covered by the SAFU Fund and company funds |
From the first drain to the final transfer, the attacker called Binance 14 a total of 12 times over a period of approximately three and a half hours, during which Binance had suspended withdrawals.
Amounts of Losses and Freezes: Which Ones Have Been Confirmed
Total losses: Officially estimated at approximately $6.3 billion
Binance announced at 10:25 a.m. UTC+8 on October 30 that the total estimated impact of the incident was approximately $6.3 billion. This is the first official figure for the losses; it is an estimate, and no on-chain breakdown was provided. Prior to the official announcement, estimates from various sources were as follows:
| Source of the Estimate | Numbers | Description |
|---|---|---|
| Binance Official | Approximately $6.3 billion | Estimated total impact; details are not listed by chain. |
| Chainalysis | $5.912 billion | Based on the market value at the time of the theft |
| Arkham | $5.84 billion | The total holdings of addresses designated as attacker entities do not equal confirmed losses. |
| On-Chain Statistics | $5.57 billion | Ethereum: 3.51 billion; Bitcoin: 1.44 billion (18,270 BTC); Tron: 630 million |
| Blockaid | $5.5 billion | Involving Ethereum, Arbitrum, Avalanche, Optimism, Bitcoin, and Tron |
| Glassnode | $5.3 billion |
There are discrepancies in the figures reported by various parties, due in part to differences in the time periods used for calculations, as well as the fact that some of the wallets included in the tally may not be related to the incident. To date, there are no publicly available addresses or transaction records for the Bitcoin and Tron portions, and Binance has not confirmed them either.
Ethereum Mainnet: Sections That Can Be Verified Directly
The following figures are taken from Ethereum on-chain transaction records:
| Assets | Quantity | Destination |
|---|---|---|
| USDT | Approximately 1.82 billion | Transferred from Binance in three separate transactions totaling 14 to the primary receiving address |
| USDC | 823 million | Transferred from Binance Hot Wallet 34 to the primary receiving address |
| ETH | Approximately 172,600 | Transferred from Binance 14, of which approximately 3,090 were sent to the second receiving address |
| Other Tokens | Approx. 62.6 million RLUSD, approx. 27.76 million USD1, approx. 11,400 XAUT, UNI, ENA, PEPE, LINK, AAVE, ONDO, etc. | Primary Billing Address |
Other analyses indicate that the Binance 16 wallet simultaneously transferred approximately 28,006 ETH to the same address, while hot wallets on Arbitrum, Optimism, and Avalanche also saw assets such as ARB, OP, and AVAX transferred out.
Frozen Assets
| Freezing Party | Amount | Description |
|---|---|---|
| Total Number Verified by Binance | Approximately $3 billion | Announced at 08:52 on October 30 (UTC+8); as of 07:22, the figure was $2.54 billion |
| Tether | Over 1.567 billion USDT | Tether CEO Paolo Ardoino announced |
| Circle | Over 800 million USDC | Jeremy Allaire, CEO of Circle, said the freeze was carried out in coordination with law enforcement; the primary on-chain receiving address holds 823 million USDC. |
| Ripple | He Yi pointed to about 200 million | Ripple has not disclosed specific figures |
| World Liberty Financial | 27 million USD1 and 48 million WLFI (approximately $2 million) | |
| Arbitrum Security Committee | Approximately $30.5 million | 74.6 million ARB and 8,425 ETH |
| Paxos | PAXG, quantity not disclosed |
In addition, Coinbase CEO Brian Armstrong said that Coinbase has blocked transactions destined for the affected wallets.
Assets that cannot be frozen and are still in transit
Stablecoins can be frozen by their issuers, but assets such as ETH, BTC, ARB, OP, and AVAX cannot. As of the time of writing:
- The attacker's centralized ETH address holds approximately 197,460 ETH, which, at approximately $2,200 per ETH, is worth about $435 million.
- The primary and secondary receiving addresses are still being used to exchange tokens such as LDO, ETHFI, COMP, and 1INCH for ETH via decentralized exchanges like Uniswap, 1inch, and SushiSwap. According to statistics from the on-chain analytics account Lookonchain, the attacker has exchanged UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD for approximately 70,480 ETH.
- The primary receiving address received a total of approximately 1.82 billion USDT; currently, approximately 1.175 billion USDT remains, meaning that approximately 640 million USDT had already been transferred out before the freeze, including funds deposited into the Aave lending market. The freeze figure announced by Tether exceeds this balance, indicating that funds in downstream addresses have also been frozen; however, the two figures do not yet fully match.
Attack Method: How to Empty a Hot Wallet Using EIP-7702 Authorization
What is EIP-7702?
EIP-7702 is a feature introduced with the Ethereum Pectra upgrade in May 2025. It allows a regular wallet (EOA) to sign an authorization using its private key, specifying the code of a smart contract, after which the wallet will operate according to that contract’s logic. The original intent was to enable ordinary wallets to utilize smart account features such as batch transactions and fee payment on behalf of others.
This authorization has two characteristics that are key to this attack:
- Valid only for the specified nonce: A nonce is a transaction counter for a wallet; it increments by 1 each time a transaction is sent. The authorization is only valid at the exact moment the transaction is added to the blockchain, when the nonce matches exactly.
- It will remain in effect indefinitely: A delegation does not expire automatically; to revoke it, you must use the same private key to sign another authorization pointing to a zero address. Simply changing the private key is not sufficient.
Differences in Risk Compared to Traditional Approve
Many users associate “authorization” with the “Approve” feature for tokens (authorization limits), but the scope of the two is very different:
| Project | Traditional Approve (ERC-20 Authorization) | EIP-7702 Authorization |
|---|---|---|
| Authorized Parties | A token contract that designates an address authorized to use the token | The entire wallet—point the wallet's code to a contract |
| Scope of Impact | Limited to that token, up to the authorized limit | All ETH and tokens in the wallet, including assets transferred later |
| Validity Period | Until the quota is exhausted or reset to 0 | Until a new authorization (such as one pointing to a zero address) is signed with the same private key |
| The Consequences of Abuse | Loss of the authorized allocation for that token | Control of the wallet is temporarily transferred to that contract, and assets can be repeatedly transferred out of it. |
The EIP-20 specification defines `Approve` as allowing a specified address “to make multiple withdrawals from your account, up to a specified amount,” limited to that token contract. The EIP-7702 specification, on the other hand, states that it authorizes the specified code to have “unrestricted access to the account.”
This incident perfectly illustrates that distinction: Blockaid pointed out that even after the delegation took effect, “funds transferred afterward can still be stolen.” On-chain records show that within about three and a half hours after the first drain, the attacker initiated 11 subsequent transfers via Binance 14, including assets transferred after the initial drain, without needing to obtain any new signatures during that time. In other words, once an authorization takes effect, it is sufficient to maintain continuous control over the entire hot wallet.
Design Risks and the Core of This Incident
It is important to distinguish between two things:
- The Agreement Itself: The EIP-7702 specification has been finalized. The on-chain authorization in this instance operated entirely in accordance with the specification: all 50 authorizations bore a valid signature from Binance 14, and the one that was accepted matched the nonce at that time. To date, no analysis by any party has identified a vulnerability in the EIP-7702 protocol itself.
- Design Risks: EIP-7702 has a broad scope of impact, and the specification also warns that poorly designed delegation contracts could allow malicious actors to gain “nearly complete control” over the signer’s account, and states that applications should not expect to be able to ask users to sign authorizations. In other words, the responsibility for vetting such signing requests lies with the wallet and the signing process.
- The crux of this incident: The question is how the attacker obtained the authorized signature for Binance 14. EIP-7702 makes the clearing process faster and more extensive, but the origin of the signature itself is the key to determining the cause of the incident (see below for details).
Therefore, while this incident illustrates the extent of potential losses when the signing process fails, it is not sufficient on its own to assess the merits and demerits of EIP-7702 itself.
Four Steps to an Attack
- Preparing Funds and Contracts: The attacker received approximately 0.29 ETH in transaction fees in three installments via Tornado Cash, deployed a sweeper contract that only they could call, and first ran a test on three of their own wallets.
- Obtaining Authorized Signatures: The attacker has 50 authorizations signed by Binance 14’s private key, all of which instruct “Binance 14’s code to point to the attacker’s sweeper contract.”
- Hitting the nonce: Binance 14, as a hot wallet, has been continuously sending transactions, causing the nonce to fluctuate constantly. Since the attacker did not know the nonce at the moment the transaction was added to the blockchain, they included 50 authorizations with nonces ranging from 18,914,775 to 18,914,824 in a single transaction. As a result, the nonce 18,914,809 matched, while the remaining 49 authorizations were invalid.
- Emptying the Wallet: 3 minutes and 24 seconds after the authorization took effect, the attacker called the `sweep()` function of the sweeper contract, transferring 14 ETH and over 60 different tokens from Binance in a single transaction. Since the delegation remained active, the attacker subsequently returned multiple times to transfer assets that had been newly deposited into the wallet.
Another point worth noting: Hot Wallet 34 is a proxy contract wallet; the attacker transferred 823 million USDC out of it via Binance 14, indicating that Binance 14 had operational access to this wallet. In other words, the compromise of one hot wallet had a knock-on effect on the other wallets it controlled.
Was the private key stolen, or was the signing system exploited?
Binance announced preliminary investigation findings at 10:25 a.m. UTC+8 on October 30: The incident may have involved a breach of a DevOps engineer’s laptop, which the attacker used to gain access to a service container and submit unauthorized withdrawal transactions. Binance stated that it has not yet found any evidence of a private key leak, and a full technical post-incident report will be released once the investigation is complete and the facts have been verified.
Before the official announcement, there were already two schools of thought within the industry. A public report by the blockchain security firm Blockaid stated that this was a “key compromise” (theft of a private key), but Blockaid CEO Ido Ben-Natan later indicated that the preliminary assessment leaned toward the transaction signing system having been exploited, “We do not believe the private key was compromised.” Miguel Morel, CEO of Arkham, believes the available information is insufficient to draw a conclusion.
The “blind guessing” method involving 50 consecutive nonces observed by Blockaid is the primary evidence supporting the view that “the signature system was exploited”: If an attacker directly possessed the private key in plaintext, they could theoretically read Binance’s nonce at any given moment and sign the one and only valid authorization, without needing to pre-sign 50 copies and rely on luck. Pre-signing an entire sequence of nonces suggests that the attacker could only obtain the signature through a specific signing process, and that there was a time lag between the signing and the submission of the transaction.
However, there are differing views. On-chain researcher 0xQuit initially believed that the attacker might not have had the private key but only held an authorized signature; he later revised his assessment, noting: The attacker transferred both Bitcoin and Tron assets via regular transactions, suggesting they had sufficient permissions to directly access the private key or at least sign transactions; the use of EIP-7702 was merely for convenience, and the 50 consecutive nonces were simply a precautionary measure.
Binance’s preliminary investigation findings are more in line with the views of Blockaid’s CEO: the issue stemmed from a breach of internal equipment and systems, rather than a leak of the private keys themselves. However, the official statement uses the term “possibly,” and it remains to be seen how the attackers obtained 50 EIP-7702 authorization signatures via the service container—this will be clarified in the technical post-incident report.
A Reminder for General Wallet Users
In this case, it was an exchange's hot wallet that was exploited, but the same authorization mechanism applies to all standard Ethereum wallets. The following points apply to users who manage their own wallets:
- Be wary of "account upgrade"-type signatures: If your wallet displays prompts such as "Upgrade Account," "Enable Smart Account," or "Delegate Execution," first verify that the website or app initiating the request is an official service you opened yourself. Do not sign until you have confirmed the source.
- Distinguishing Between Signature Types: An “Approve” authorization typically specifies the token name and limit; an EIP-7702 authorization, on the other hand, points to a contract address and affects the entire wallet, posing a much greater risk than “Approve.”
- Check your wallet for delegations: Open your address in a blockchain explorer. If it shows that your account has been delegated to a specific contract, or if the code starts with `0xef0100`, this means you have set up an EIP-7702 delegation.
- Clearing Unknown Delegations: According to the EIP-7702 specification, you can clear a delegation by signing an authorization pointing to a zero address using the same wallet; if the wallet provides a function to revoke delegations, you can use that directly.
Before making any transactions, you can familiarize yourself with the process using a wallet with a small amount of assets. Once you’ve confirmed that there are no unauthorized transactions in your wallet, you should only authorize the exact amount needed when using the “Approve” feature for daily transactions.
How Binance Is Handling the Situation: A Summary of Official Announcements
Binance Official Account
- UTC+8 05:29: We are aware of a potential security issue and are currently investigating it; user funds are secure.
- 06:33: Withdrawals have been suspended and will resume only after the security issue has been fully resolved.
- 07:06: Binance Alpha trading has been suspended.
- 07:22: Clarified the figure of $1.8 billion circulating in the public domain, stating that $2.54 billion has been verified as frozen.
- 08:13: The company announced that it would cover all losses, suspend both deposits and withdrawals, cooperate with law enforcement agencies, and release a full post-incident report once the investigation is complete.
- 08:52: Approximately $3 billion has been verified as frozen; investigations are continuing in collaboration with law enforcement agencies, issuers, and on-chain analytics firms.
- 10:25: Preliminary investigation results were released, indicating that the incident may have involved a breach of a DevOps engineer’s laptop; no private key leaks have been detected so far; the total estimated impact is approximately $6.3 billion, with approximately $3 billion frozen; The company will cover the full loss using the SAFU fund and corporate funds; authorization for the affected addresses has been revoked; a technical post-incident report will be published upon completion of the investigation, and an updated proof of reserves will be released once the fixes are implemented.
CZ and He Yi
CZ posted immediately, stating, “It appears that Binance has been hacked,” and noted that while he no longer manages Binance.com, as a shareholder, he expects all user funds to be fully reimbursed. He subsequently focused on reposting announcements from Tether, Circle, Ripple, World Liberty Financial, and Arbitrum regarding their asset freezes, expressing his gratitude.
He Yi's post aligns with the official statement: user funds are secure; Binance will cover the full amount of the stolen funds; security audits will be conducted and funds will be frozen during the suspension of deposits and withdrawals; and users are reminded to rely solely on official channels.
Other Organizations
- Binance.US states that it is an independent platform and that customer funds and services are operating normally.
- Bybit stated that it was not affected.
- Aave has proactively frozen the V3 and V4 markets operated by the DAO, stating that the contracts remain unaffected and positions are still fully collateralized.
- Market maker Wintermute stated that its exposure to Binance is less than 20% of its net assets, while GSR stated that its exposure is less than 5%.
Matters That Have Not Yet Been Announced
- Timeframe for Resuming Deposits and Withdrawals
- Final loss figures (currently only official estimates of approximately $6.3 billion)
- Identity of the Attacker
- What is the respective contribution of the SAFU fund and the company's funds?
- Technical Post-Event Report and Updated Proof of Reserves
Some analysts have pointed out that the drained wallets are among those listed in Binance’s proof of reserves. Binance has stated that it will publish an updated proof of reserves once the issue is resolved, at which point it will be possible to verify whether the stolen assets have been replenished.
A Comparison with Major Cryptocurrency Theft Cases in History
| Event | Time | Loss | Techniques | Causation/Consequence |
|---|---|---|---|---|
| Binance (this time) | October 2026 | Official estimates put the figure at approximately $6.3 billion | Preliminary indications suggest the incident may involve a breach of a DevOps engineer’s laptop; EIP-7702 authorization + sweeper contract | Unattributed; approximately $3 billion has been frozen, with payouts to be made from the SAFU fund and company funds |
| Bybit | February 2025 | Approximately $1.5 billion (about 400,000 ETH) | Hackers Compromised a Wallet Service Provider’s Developer Account and Tricked Signers into Approving Malicious Transactions | The U.S. Federal Bureau of Investigation (FBI) has attributed the incident to North Korea |
| Ronin Cross-Chain Bridge | March 2022 | Approximately $600 million | Obtain the validator's private key | FBI Blames North Korea's Lazarus Group |
| Poly Network | August 2021 | Approximately $610 million | Cross-Chain Contract Vulnerabilities | The attackers returned nearly all of the funds within two weeks |
| Binance | May 2019 | 7,000 BTC (approximately $40 million at the time) | API Keys and Two-Factor Authentication Credentials Stolen | Compensation from the SAFU Fund |
According to Binance’s official estimate (approximately $6.3 billion), this will be the largest theft in cryptocurrency history. Even if we consider only the stablecoins that can be directly verified on the Ethereum mainnet (approximately 1.82 billion USDT and 823 million USDC), the amount already exceeds that of the Bybit incident.
The CEO of Blockaid stated that this incident is “very similar” to the Bybit incident: neither involved a smart contract vulnerability, but rather an issue with the transaction signing process. He also noted that the methods used in the on-chain preparatory work resemble those seen in North Korea-linked attacks, but no organization has officially attributed the attack to North Korea at this time.
Unanswered Questions
- How the authorized signatures were obtained: Binance initially indicated that the incident may have involved a compromised laptop belonging to a DevOps engineer, through which the attacker submitted unauthorized withdrawal transactions via a service container; no private key compromise has been detected so far; However, how the attacker obtained 50 EIP-7702 authorization signatures through this method remains to be clarified in the technical post-incident report.
- How Bitcoin and Tron Assets Were Drained: EIP-7702 only explains the outflow from Ethereum-based chains. Officials stated that the attacker submitted unauthorized withdrawal transactions, but did not provide a breakdown by chain; approximately 18,270 BTC and approximately $630 million worth of Tron assets still lack publicly known addresses.
- Number of wallets affected: Blockaid reports that the private keys of 11 hot wallets were compromised; Binance has not responded.
- When was the delegation revoked? Binance stated that it had revoked authorization for the affected addresses, and on-chain data also shows that Binance 14 no longer holds any delegation codes; however, the exact time of revocation has not been disclosed. The delegation remained active for at least three and a half hours.
- Why the figures on frozen assets don’t match: Binance reported approximately $3 billion, while other estimates range from $2.3 billion to $2.83 billion; He Yi stated that Ripple froze approximately $200 million, but only about 88.5 million RLUSD were transferred off-chain.
- When will withdrawals resume? There is no official timeline.
Frequently Asked Questions
Binance was hacked. Is my money on Binance safe?
Binance, CZ, and He Yi have all stated that user funds are secure, and Binance has indicated that it will cover the full amount of the stolen funds using the SAFU Fund and company funds. The funds stolen were from a hot wallet managed by Binance itself, not from individual user accounts. Binance also stated that it will publish an updated proof of reserves once the issue is resolved, at which point users will be able to verify whether their assets have been restored.
When will Binance resume withdrawals?
There is no official timeline. Binance has stated that services will resume only after security issues have been fully resolved, and He Yi has also indicated that security scans will be completed and potential risks confirmed before withdrawals are reopened. Please rely solely on announcements from official Binance channels and do not trust links claiming to offer “priority withdrawals.”
What is EIP-7702? Will regular wallet users be affected?
EIP-7702 allows standard wallets to sign authorizations using private keys, after which they operate according to the logic of a specific smart contract. Currently, no analysis has identified any vulnerabilities in the EIP-7702 protocol itself; the key issue is that the attacker obtained an authorization signed by a Binance hot wallet. For ordinary users, the risk lies in being tricked into signing a malicious authorization: unlike the `Approve` command, which affects only a single token, once an EIP-7702 authorization takes effect, the entire wallet’s execution rights are handed over to the designated contract and remain in effect until actively revoked. Therefore, when receiving signature requests such as “upgrade account,” “enable smart account,” or “delegate execution,” you should first verify the source.
Can the frozen funds be recovered?
Frozen stablecoins such as USDT and USDC can no longer be transferred by the attackers. Whether and how they will be returned in the future depends on the procedures followed by the issuers, law enforcement agencies, and Binance; no details have been announced at this time. Assets such as ETH and BTC, which have no issuers, cannot be frozen, making them more difficult to recover.
What is the difference between a hot wallet and a cold wallet?
Hot wallets are constantly connected to the internet and used for daily deposits and withdrawals; they are fast but more vulnerable to attacks. Cold wallets store private keys offline, making them more secure but slower for transfers. Exchanges typically keep only a small portion of their assets in hot wallets. Regulatory authorities in some regions have specific requirements regarding this. For example, the Hong Kong Securities and Futures Commission (SFC) mandates that licensed virtual asset trading platforms must store at least 98% of their clients’ virtual assets in cold wallets.
Source of information
- Official Announcement from Binance:Security Incident Update (Preliminary Investigation Findings); Post from the official X account:Preliminary Investigation Findings、First Statement、Withdrawals Suspended、$2.54 billion frozen、Bear the full loss、Frozen approximately $3 billion
- CZ X Post:x.com/cz_binance
- He Yi X Post:Bear the full loss、Tether Freeze、Circle Freeze、Ripple Freeze、WLFI Frozen、Arrangements for Resuming Withdrawals
- Ethereum On-Chain Transactions:EIP-7702 Authorized Transactions、Clear All Transactions、780 million USDC in transactions、Attacker's Address、ETH Centralized Addresses
- Blockaid:Incident Report、nonce Analysis Post
- ZachXBT:Arbitrum Freeze
- Arkham:Binance Hacker: The Real Story
- Lookonchain:Statistics on Token Dumping by Attackers
- EIP-7702 Specifications:eips.ethereum.org
- EIP-20 (ERC-20) Specifications:eips.ethereum.org
- Blockaid:Sweeper Contract Analysis Post
- 0xQuit:A Revised Perspective on Attacker Privileges
The information in this article was verified as of 12:00 p.m. on October 30, 2026, UTC+8 (04:00 UTC on October 30). The situation is still unfolding, and the figures may be updated as official announcements are released.
Next Step
If you want to buy or sell cryptocurrency through a licensed brokerage firm, you can start by reading Futuhui Account Opening Guide, learn about the account opening process; after opening an account, if you need to withdraw your cryptocurrency to your own wallet, you can refer to Futuhui Deposit and Withdrawal Guide。
Disclaimer
The content of this article is for reference only, investors should exercise independent judgment, invest with caution and at their own risk, this article does not provide or attempt to persuade viewers to trade or invest on the basis of the content of this article is for sharing purposes only, and should not be regarded as investment advice, and does not represent the Monsterblockhk viewpoints and positions, all information and views of the specific date of the judgment of the time-limited nature. In addition, if any content in this website involves virtual asset trading platforms that have not yet obtained a license to operate virtual asset trading platforms in Hong Kong, including but not limited to text introductions, pictures, promotions, events, etc., they are only available to users outside of the Hong Kong Special Administrative Region.
According to the Hong Kong Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022, after June 1, 2023, all centralized virtual asset trading platforms operating in Hong Kong or actively promoting their services to Hong Kong investors will be licensed and regulated by the SFC, and any related unlicensed activities will be a criminal offence. For more information and details of the legislation, users may refer to the SFC website.