As of: 29.10.2026, 23:55 (Zurich time). This is a developing story; figures may change.
What happened
On Thursday evening, on-chain analyst Spreek (@spreekaway) flagged large transfers out of a Binance hot wallet on Ethereum, labelled "Binance 14", to a newly created address. Per Cointelegraph, the contract call behind it was allegedly funded through Tornado Cash. The receiving address took in roughly 975 million USDT in that first wave, by on-chain data.
The number then grew quickly. Lookonchain puts the loss at more than USD 5.8 billion. Arkham tracks more than USD 5 billion leaving Binance and, per CNBC, ties nearly USD 6 billion to 55 addresses. CoinDesk, citing Arkham, says the attacker's wallets hold more than USD 5.7 billion: almost USD 1.5 billion in bitcoin, USD 900 million in ether and about USD 1.4 billion in USDT and USDC. Security firm Blockaid says it is looking into about USD 3.3 billion of suspicious outflows on Ethereum, Arbitrum and Avalanche (The Block).
Two caveats apply. These are on-chain estimates, and Binance has not confirmed a loss figure. Arkham's totals also show what the wallets hold, which is not the same as a confirmed amount stolen. Even so, every estimate is well above the roughly USD 1.5 billion taken from Bybit in February 2025, which was the largest crypto theft on record until now. CoinDesk already calls Thursday's incident "the largest crypto hack to date".
How it worked: EIP-7702, explained simply
According to early on-chain analysis, the attacker abused EIP-7702. This Ethereum feature, added in the 2025 "Pectra" upgrade, lets an ordinary wallet hand its behaviour over to a piece of smart-contract code. That makes features like batched payments possible. It also means that whoever controls the delegation, or gets a wallet to sign one, can make that wallet run code it was never meant to run, including "send everything to me".
Binance has not yet confirmed how the attack was carried out, so treat the EIP-7702 explanation as preliminary. Whether keys were compromised, a signing process was manipulated or something else went wrong is still unknown.
The response
Binance founder Changpeng Zhao (CZ) wrote at around 22:15: "User funds are safe! It does look like a hack." As a shareholder, he said, he expects "all user funds will be fully covered." Later he added: "Loss might be a bit higher than that, but will cover." He was replying to a DefiLlama founder's estimate of about USD 1 billion in net loss after the freezes, against roughly USD 144 billion in assets under custody.
At 23:15, Binance said that withdrawals will stay paused "until the security issue is fully resolved" and that "user funds remain safe". A spokesperson told TechCrunch that withdrawals were suspended on several networks as a precaution. Binance has not named anyone behind the attack.
The stablecoin freeze: a reminder of who holds the keys
The most striking part of the night was how fast the stablecoin issuers moved:
Tether: CEO Paolo Ardoino said more than 1.567 billion USDT had been frozen.
Circle: CEO Jeremy Allaire said more than 800 million USDC had been frozen, in coordination with law enforcement.
Ripple: about 200 million RLUSD frozen, according to Binance co-founder Yi He.
World Liberty Financial: USD 27 million in USD1 and 48 million WLFI tokens (about USD 2 million) frozen, per Yi He.
Lookonchain puts the USDT and USDC frozen at about USD 2.41 billion in total. That is good news for Binance. It also shows something investors sometimes forget: centralised stablecoins can be stopped by their issuer at any time, at the issuer's discretion. Tonight that power worked against a thief. In principle, it applies to every holder.
The attacker can still move bitcoin and ether that has been taken, and per Lookonchain is now selling altcoins such as PEPE, UNI and LINK on-chain for ETH. The lending protocol Aave was also drawn in: according to CoinDesk, the attacker borrowed against stolen USDT, and The Block reports that Aave then froze the affected markets.
Market reaction
The market fell, but there was no panic. According to CoinDesk, bitcoin was trading at about USD 79,000 (down around 3%, briefly below 80,000), ether at about USD 2,270 (down around 4%) and BNB at about USD 702 (down around 6.7%). AAVE fell about 8%. CNBC reports that Circle shares dropped about 5% in after-hours trading.
What it means if you are in Switzerland and use Binance
You cannot withdraw right now. Binance has given no date for when withdrawals resume.
Watch out for scams. Binance itself warns against unofficial links and messages. Fake "refund" or "recovery" offers usually appear within hours of a hack. Only trust Binance's official channels.
Counterparty risk is real. Assets held on an exchange are a claim against that exchange. Whether you are made whole depends on its balance sheet and its promises, not on any deposit protection. Swiss bank deposit insurance (esisuisse) does not cover crypto held on a foreign exchange.
What to watch next
An official confirmed loss figure and a technical post-mortem from Binance.
When withdrawals resume, and on which networks first.
Whether, and how, Binance makes good on its promise to cover losses, for example through its SAFU emergency fund.
Whether the attacker is identified. In February 2025, the FBI attributed the Bybit hack to North Korea's Lazarus Group. There is no attribution for this attack yet.
Whether frozen stablecoins can be returned, and how BTC/ETH flows run through mixers or bridges.
General information only, not investment, tax or legal advice, and not a recommendation to buy or sell any financial instrument. Figures come from the sources linked above and are preliminary. Independent; not affiliated with any exchange or authority.
Allgemeine Information, keine Anlageberatung. · Information générale, pas un conseil en placement. · Informazione generale, non consulenza in investimenti.