Binance Hit by Historic Hack: $5.8 Billion Drained, Part of It Frozen

A simple on-chain signal was enough to turn the evening of October 29 upside down. At 10:32 pm, researcher Spreek detects an anomaly on Ethereum. Four minutes earlier, a contract had just emptied a Binance wallet of 167,464 ETH. In a few hours, several stablecoin issuers froze 2.54 billion dollars, while the exchange confirmed one of the biggest hacks in crypto history.

An attack prepared well before the transfer

The Ledger, Coldcard and Keystone incidents had already weakened trust in crypto wallets. This time, the scenario differs: the attack is not targeting a cold wallet.

It all starts on October 28. An address, 0x7C86, receives 0.1 ETH from Tornado Cash, a mixer used to blur fund traceability. This small amount suffices to cover transaction fees.

The next afternoon, this same address deploys its own contract.

At 10:20:59 pm, a transaction links the Binance wallet 14 to this contract via EIP-7702, a mechanism allowing a wallet controlled by a key to execute contract code.

Then everything speeds up.

At 10:24:23 pm, a transaction withdraws 167,464 ETH, about 388 million dollars according to Etherscan, as well as 63 tokens, including 1.615 billion dollars of USDT.

Twenty-four seconds later, Binance 16 sends another 28,005 ETH to this same previously nonexistent address.

In less than fifteen minutes, 195,460 ETH, nearly 450 million dollars, move to a freshly created third address, while about 1.5 billion dollars in tokens remain in the first wallet.

In total, Arkham Intelligence estimates about 5.84 billion dollars passed through the wallets linked to the incident. This amount includes various movements between addresses and therefore does not correspond solely to stolen assets.

Spreek’s alert changes everything

The first warning comes from neither Binance nor a regulator.

At 10:32 pm, the pseudonymous on-chain researcher Spreek posts a message on X: “Unconfirmed, but possibly massive Binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash.“

His intuition is based on a revealing detail. An exchange never funds its transaction fees through Tornado Cash. For him, this behavior immediately distinguishes a hack from a maintenance operation.

Five minutes later, he strengthens his analysis. The address that triggered the transaction indeed comes from Tornado Cash, while the recipient wallet now links to movements related to Binance.

Alerts follow quickly. At 10:41 pm, Tree News discusses a possible theft affecting hot wallets. Two minutes later, another account already estimates Ethereum losses at over 2.5 billion dollars.

Odysseas Lamtzidis, founder of Phylax Systems, explains the mechanism: according to him, EIP-7702 can turn the wallet itself into a “vacuum” as soon as a signed delegation comes into play. Another developer also notices that the contract only accepts calls coming from the address funded by Tornado Cash.

Issuers react in a few hours

Faced with the scale of the incident, key sector players intervene quickly.

Tether freezes 975.1 million USDT. At 11:04 pm, Circle blocks 823 million USDC, a decision confirmed by its CEO Jeremy Allaire on X, in coordination with law enforcement.

Then, at 12:32 am, Aave temporarily suspends its v3 and v4 lending markets after a wallet linked to the hack deposited 60 million USDT there before borrowing 19,762 ETH.

Four minutes later, World Liberty Financial immobilizes 27 million USD1 and 2 million WLFI with the help of BitGo.

Finally, at 1:35 am, Binance revises its count upward and announces 2.54 billion dollars frozen, against 1.8 billion mentioned earlier. Shortly after, Ripple confirms blocking RLUSD, without revealing the amount concerned.

An investigation still far from over

Arkham Intelligence now tracks about 5.84 billion dollars that circulated between wallets associated with the incident, although other estimates are closer to 2.4 billion.

Compared to the 693,000 bitcoins held by Binance in September, this drain represents about 2.64% of the platform’s reserves. Therefore, it is a compromised wallet, not a collapse of the entire exchange.

Markets reacted immediately: bitcoin fell below 79,000 dollars (-2.6% in 24 hours), BNB dropped 7% to 699 dollars, while Monero rose 6%.

The previous record dated back to the Bybit hack, estimated at 1.5 billion dollars in February 2025. This time, one question remains: how did the attacker obtain the signature necessary to activate the EIP-7702 delegation? Binance has not yet responded, and the investigation will have to determine whether it is a signature flaw, an operational error, or deeper system access.