Platforms · Software · Providers · Markets
On 30 October 2026, Binance said it had paused deposits and withdrawals after estimating the impact of a security incident at around $6.3 billion. The exchange said it would meet losses from its SAFU fund and company funds, and maintained that user funds are safe.
Binance's preliminary account points to a DevOps engineer's laptop as the possible entry point. The company said access from the laptop reached a service container that was then used to send unauthorised withdrawal transactions. It reported no evidence that a wallet private key had been exposed, but has not explained how the transactions were approved.
What the chain evidence indicates
Blockaid's analysis centres on a single Ethereum type-4 transaction. It contained 50 EIP-7702 authorisations directed at a hot wallet identified on-chain as Binance 14, according to the blockchain security firm.
EIP-7702 allows a wallet to authorise smart-contract code to act on its behalf. The authorisation applies to a particular nonce, or transaction count. As the Binance wallet continued to send transactions, Blockaid says the sender could not know which nonce would be current at inclusion.
Blockaid's account is that the transaction bundled authorisations for 50 consecutive nonce values, with one matching the live value. That permission assigned control of the wallet to an unverified sweeper contract. Blockaid said a designated operator was the only party able to use the contract, and that its address had received funding through Tornado Cash.
Minutes later, the wallet was drained of about $1.6 billion in USDT, 167,464 ETH and more than 60 other tokens. Blockaid's wider tally is at least $5.57 billion leaving Binance-linked wallets across Ethereum, Bitcoin and Tron, a different measure from Binance's estimated total impact.
How Binance is responding
Binance said roughly $3 billion had been frozen on-chain, crediting blockchain partners with helping secure the affected assets. It has withdrawn authorisation for the affected address, and says it is working with law enforcement and blockchain intelligence partners to trace the funds and seek their recovery.
The exchange has not set a time for restoring deposits and withdrawals. It said the pause would remain while security checks take place, and plans to release an updated Proof of Reserves after remediation. Binance has also committed to publishing a technical post-mortem after it has verified the findings.
The event was first reported by Finance Magnates. Blockaid CEO Ido Ben-Natan said the incident appeared to involve compromised signing infrastructure rather than a leaked key.
He called the pattern "very, very similar" to the 2025 Bybit hack. In February 2025, hackers took $1.5 billion worth of Ether from Bybit, according to the earlier report.
Blockaid's account says the signatures came from the wallet's own key, or the system that held it. The route by which they were obtained remains unknown. Binance has not confirmed how the withdrawals were authorised, and has not provided further detail on its assurance that user funds are safe.
What to watch next
For exchange and trading-platform operators, the open questions concern the boundary between endpoint access, service containers and transaction signing. Which credentials or approvals could let a service submit withdrawals, and what controls would stop an unexpected authorisation from reaching a hot wallet? Binance has not yet published enough technical detail to answer those questions.
Operations teams will also need to track the exchange's restart notice, its account of the asset freeze and the promised Proof of Reserves update. Binance has given no schedule for restoring deposits and withdrawals or releasing its post-mortem, so the scope of any integration, reconciliation or compliance work remains unclear.
