If you run an exchange, a custodian, a payments company, or any team that holds a hot wallet, the part of the Binance incident that matters is not the price. It is how the attack worked.

Information as of October 30, 2026. Figures are still moving, and Binance has not published an official loss figure or root cause. Below, confirmed facts, on-chain data and my own judgment are kept separate.

1. What is confirmed, and what is still rumor

Item	Status	Notes
Did it happen?	✅ Confirmed	Yi He: “Binance will cover all hacking losses.” CZ: “It does look like a hack on Binance.”
Frozen funds	✅ Verified by Binance	$2.54B, and Binance says it may rise
Total outflow	⚠️ Disputed	About $5.8B left Binance-labeled wallets: $3.53B on Ethereum, $1.45B on Bitcoin, $0.63B on Tron (ChainCatcher tally). Glassnode estimates about $5.3B. Outflow is not the same as theft
Net loss after freezes	⚠️ Estimate	About $1B (DefiLlama) to $3.43B (on-chain analyst Ember)
Who did it?	❌ Unconfirmed	Only analyst 0xQuit has personally suggested Lazarus. No official attribution
Root cause	❌ Not disclosed	Binance has not explained it. Reported possibilities include a leaked key or a manipulated signing system, none confirmed

The theft very likely exceeds Bybit’s roughly $1.5B in 2025, making it the largest crypto theft on record. Whether it is $3B or more than $5B, nobody can say yet.

2. 3 minutes 24 seconds: one authorization emptied a whole wallet

On-chain timeline (UTC, October 29):

• Oct 28: the attacker address received 0.1 ETH from Tornado Cash for gas, a day ahead
• Oct 29 afternoon: a sweeper contract was deployed, callable only by that Tornado-funded address
• 20:20:59: an EIP-7702 authorization delegated hot wallet “Binance 14” to the attacker’s contract. It was signed with Binance 14’s own key, and 50 authorizations were signed at once to cover every likely nonce so one would land (Blockaid’s analysis)
• 20:24:23: one transaction moved 167,464 ETH and 63 tokens, for a fee of about $0.93
• Next ~40 minutes: Binance 16, Hot Wallet 34 and others were drained, across at least 9 chains
• ~21:01: Tether began freezing

My take: the risk ceiling of a hot wallet has moved

Before, even an attacker with signing power had to move funds one transfer at a time. Every transfer went through the exchange’s controls: limits, velocity checks, whitelists. Each one was a chance to get caught.

EIP-7702 removes that premise. One authorization turns the whole wallet into a shell for the attacker’s contract. The transaction that actually moves the money is sent from the attacker’s own address and never touches Binance’s withdrawal system. Binance’s risk engine watches what its wallets send. This time the wallet sent nothing.

Worse, Binance’s deposit sweeping kept running. About 1.5 hours in, a Coinbase executive observed user deposits still flowing into the compromised hot wallets and being drained. The automation became the attacker’s armored truck.

I call this risk-ceiling migration: a hot wallet’s maximum loss moved from “one transfer’s limit” to “the entire balance.”

7702 itself has no bug. The problem is that exchange signing policies review transactions, not authorizations, a new kind of thing to sign. Every custodian using plain EVM addresses as hot wallets has the same exposure.

Signing 50 authorizations at once also means the attacker could make that key sign in bulk. This was more than one tricked signature. Whether it was a leaked key, a compromised signing system or something else will have to wait for Binance’s post-mortem.

3. Where the money went: what could be frozen was; the rest is the problem

Freezable stablecoins and issuer-controlled assets, about $2.5B:

Issuer	Frozen
Tether	1.567B USDT
Circle	~800M USDC
Ripple	~$200M (RLUSD etc., per Yi He)
World Liberty	27M USD1, plus ~48M WLFI
Arbitrum Security Council	~$30.5M
Paxos	1,906 PAXG

What cannot be frozen: about 195,000 ETH plus wBETH; 18,270 BTC (about $1.44B, per Ember, still unmoved); and altcoins such as PEPE, UNI, LINK and ENA, being dumped on DEXs.

The attacker’s playbook was clear. Swap some USDT into ETH before the freeze, sell altcoins on Uniswap, then post USDT as collateral on Aave to borrow about 20,000 WETH. One goal: turn freezable assets into unfreezable ones. Aave then paused new deposits and borrows on its V3/V4 markets.

My take: 18,270 BTC is a sword hanging over the market

ETH and altcoins are being processed. The BTC has not moved. The attacker is patient and has mature BTC laundering routes. If this is Lazarus (unconfirmed), Bybit suggests the selling will stretch over weeks or months, via THORChain, OTC desks and mixers.

For months, about $1.44B of potential BTC supply will hang over the market, with unpredictable timing. That matters more than the drop on the night.

4. Tether became the fastest “lender of last resort”

About 40 minutes into the attack, Tether started freezing. It froze $1.567B on its own, roughly 60% of everything frozen.

My take: the censorable assets turned out to be the insurance

Here is the reversal. Freezable stablecoins were the safest assets in the hot wallets, and most of them got frozen. The “decentralized” ETH and BTC were the biggest losses.

Three consequences:

1. Exchanges cannot change what sits in hot wallets: if users withdraw ETH, the hot wallet has to hold ETH. What they can change is how much each hot wallet holds and how it signs, splitting native assets across more, smaller wallets with timelocks and limits.
2. Regulators will use this as evidence that “freezable” is a feature, not a bug. Stablecoin frameworks like the GENIUS Act just got a live-fire endorsement.
3. Attackers will adapt: go after ETH and BTC first, or swap faster before freezes. DeFi protocols like Aave and Uniswap will be pushed into acting as compliance checkpoints. Aave’s market freeze this time is the precedent.

Those forty minutes said more about Tether’s quasi-central-bank role in crypto than any ad could.

5. Solvency: Binance can pay; the risk is elsewhere

Metric	Figure
Binance custody assets (DefiLlama)	~$144B
SAFU fund	~$1B (in BTC)
Net loss estimate	$1B to $3.4B
Net loss as share of custody assets	~0.7% to 2.4%
Official pledge	Yi He: “Binance will cover all hacking losses”

Wintermute’s CEO says Binance could absorb 3 to 4 times the current loss.

Binance has no solvency crisis. SAFU alone does not cover it, but Binance’s own capital does. This is not FTX: FTX misused customer assets; Binance had its own money stolen by outsiders.

The real risk is how long deposits and withdrawals stay paused. Markets can accept “we got robbed.” They cannot accept “you can’t withdraw.” The longer the pause, the more a security incident slides into a trust crisis. Binance’s latest word on October 30: all deposits and withdrawals are suspended until the security issue is fully resolved, with no timeline.

6. Short-term impact (1 to 7 days)

On the night: BTC about -3%, briefly below $79,000; ETH about -4%; BNB about -7%; AAVE -8%, because of the attacker’s borrowing and Aave’s market freeze.

BNB fell more than twice as much as BTC. The market is pricing a Binance-specific risk.

Four things to watch: when deposits and withdrawals fully resume; Binance’s net outflows, especially stablecoin reserves; BNB versus BTC; and whether the 18,270 BTC moves.

7. Longer-term impact

Custody security standards get rewritten. Plain-address hot wallets with no monitoring of 7702 authorizations will be phased out. Custodians will move to smart-contract wallets with timelocks and limits, MPC signing, and signing policies that explicitly block authorization-type signatures. EIP-7702, introduced in the Pectra upgrade, takes a reputational hit even though it has no bug.

This is not just a Binance problem. Bybit lost about $1.5B in February 2025. Bitget lost about $387M in September 2026 through a zero-day in a third-party security product. On the same day as this incident, Polymarket paused trading after a third-party vendor breach. The common thread: attackers go around smart contracts and hit signing flows, internal credentials and the third-party supply chain. Rivals will struggle to market themselves as “safer.”

Regulators will follow. Binance has been under compliance oversight since its 2023 plea settlement, and this will sharpen scrutiny of its internal controls. Jurisdictions may push mandatory custody standards, such as hot/cold ratios and signing-process audits. If attribution points to North Korea, this becomes a national-security and sanctions-enforcement matter.

8. Who benefits

Beneficiary	Logic	Upside
Tether / Circle	Freeze capability proven live; the “compliant stablecoin” story gets stronger	⭐⭐⭐ Biggest winner
On-chain security firms (Blockaid, Chainalysis, etc.)	Exchange security budgets will jump	⭐⭐⭐
MPC and smart-contract wallet providers (Fireblocks, Safe, etc.)	Exchanges must re-architect hot wallets	⭐⭐
Hardware wallets and self-custody	“Not your keys, not your coins” validated again	⭐⭐
DEXs and on-chain trading	Short-term diversion during the pause	⭐
Rival exchanges	Can catch some outflows, but share the same risk; Bitget was just hit	⭐

9. What the market may be getting wrong

The market reads this as a Binance solvency story. It is really a story about the industry’s signing infrastructure.

Binance can pay. On its balance sheet this is a large operating loss. What actually broke is an industry assumption: that limits and risk controls cap a hot wallet’s loss to a fraction at a time. EIP-7702 made “one authorization, whole wallet gone” real.

Every custodian using plain EVM addresses as hot wallets should review its signing policy today. If they don’t, the next victim may not be Binance, but the method will be identical.

And one more irony. Crypto sells decentralization and censorship resistance. What actually saved the most money here were two centralized companies pressing freeze buttons within 40 minutes.

The safest stolen assets were the most centralized ones.

The three-sentence summary

1. What happened: the attacker signed an EIP-7702 authorization with Binance’s own hot-wallet key and emptied several hot wallets within minutes. $3B to $5.8B flowed out; about $2.5B in stablecoins is frozen.
2. How big: Binance will not go under, but this is very likely the largest crypto theft ever. The 18,270 unmoved BTC is a months-long overhang, and the industry’s hot-wallet security architecture needs a rebuild.
3. What to watch: when deposits and withdrawals fully resume, what the post-mortem says failed, when the 18,270 BTC moves, and attribution.

If you run an institution’s hot wallets: does your signing policy review authorizations?

---

Sources (plus on-chain data from Etherscan, Arkham and DefiLlama):

• CoinDesk – Potential multi-billion Binance hack hitting crypto markets
• The Block – Binance investigating hack as suspicious outflows reach up to $5.8 billion
• TechCrunch – Binance pauses withdrawals
• Bitcoin.com News – Inside the $5.8B Binance Hack: What’s Confirmed and What Isn’t
• 吴说区块链 – 币安遭黑客攻击
• 链捕手 – 复盘币安 56 亿被盗案全过程
• abmedia – 幣安疑遭駭，凍結 25.4 億美元
• CryptoTicker – $2.8B Drained via EIP-7702
• Odaily – 黑客尚未转移比特币
• Odaily – 何一：币安将承担全部损失
• Gizmodo – Binance Likely Lost at Least $1.7 Billion
• BlockWeeks – 币安热钱包疑遭攻击；Polymarket 同日被入侵

Disclaimer: Based on public reports and on-chain data as of 2026-10-30. Figures are still changing, and attribution and root cause are not officially confirmed. Sections marked “My take” are the author’s opinion and not investment advice.

#Binance #CryptoSecurity #Stablecoins