Binance Investigates $5.57B Outflow as $1.8B Is Frozen

By Tom Whitfield

At least $5.57 billion left wallets linked to Binance across Ethereum, Bitcoin and Tron on Thursday, October 29, 2026, according to an on-chain tally. Tether froze 975.1 million USDT, and Circle, issuer of rival stablecoin USDC, froze 823 million USDC in the main receiving wallet, bringing the total frozen to about $1.8 billion.

What does Binance know?

Binance, described as the world's largest cryptocurrency exchange, has not confirmed a hack and is investigating a potential security issue. It wrote on X: “We have not confirmed any impact to user funds. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.”

The transfers came from Binance-linked hot wallets, the internet-connected wallets exchanges use to process customer withdrawals. The outflow therefore reached infrastructure used for withdrawals, although it did not establish that customer balances were compromised.

How did assets leave the linked wallets?

• $3.51 billion on Ethereum
• $1.44 billion in 18,270 Bitcoin
• $630 million on Tron

At 20:24 UTC, the first Ethereum transaction sent 167,464 ETH plus 63 token transfers to a brand-new address, according to Etherscan. One transfer carried 1.615 billion USDT, a stablecoin designed to trade at $1.

What role did EIP-7702 play?

Three minutes before that transaction, an address funded through Tornado Cash submitted a delegation for a Binance hot wallet using EIP-7702. The Ethereum feature lets an ordinary wallet execute delegated code.

Odysseas Lamtzidi, founder of Phylax Systems, wrote on X: “EIP-7702 can turn the wallet itself into the sweeper.” He said the persistent delegation could authorize later transfers without another signature from the wallet.

The method used to obtain the required signature remains unknown. The delegation sequence shows how persistent code could authorize later transfers, but it does not identify how the attacker secured that signature.

How much could the issuers still freeze?

Tether and Circle can block specific addresses from moving their tokens. Circle froze 823 million USDC in the same main receiving wallet at 21:04 UTC; Tether froze 975.1 million USDT there.

Circle CEO Jeremy Allaire posted on X that the issuer was coordinating with law enforcement and tracking a potential exploit. Wazz estimated the loss was likely higher and another $800 million could still be frozen, while warning that the attacker was moving funds quickly.

How does the outflow compare with previous hacks?

If confirmed as a hack, the $5.57 billion outflow would be the largest crypto theft on record. Binance's 2019 hack involved 7,000 BTC and about $40 million in losses. The current tally would be more than three times the roughly $1.5 billion stolen from Bybit in February 2025, the previous record.

What remains unresolved?

Bitcoin fell below $79,000, down about 2.6% over 24 hours, while BNB, Binance's own token, dropped about 7% to roughly $699. Monero, a privacy coin, gained about 6% to $637, echoing its rise of as much as 51% after a $333 million Bitcoin theft in April 2025.

For Binance, the immediate operational questions are whether wallet controls were compromised and whether customer balances were affected; it has confirmed neither. The freezes constrain identified token addresses, not the full $5.57 billion outflow, and the attacker was still moving funds quickly.

With no investigation deadline announced, the next enforcement window depends on Tether and Circle identifying additional receiving addresses before the attacker moves balances not covered by the roughly $1.8 billion already frozen.