What really happened in the Binance hack? Our analysis of the blockchain data shows: on October 29, 2026 an attacker took control of the hot wallet “Binance 14” with 50 simultaneously submitted signatures and drained about $2.7 billion within seconds. Binance confirmed the hack overnight and says it will cover all losses. According to our measurements and investigators, more than $2.83 billion is frozen, and the attacker is left mainly with 197,460 ETH. Here is what we verified ourselves, what the key voices on X say and where this is heading.
The minute-by-minute account is in our timeline with live ticker, the news itself in our Binance hack report.
Hack or internal transfer? The first debate of the night
In the first hour it was not clear there had been an attack at all. Analyst Simba considered a planned migration between Binance wallets possible: the destination was freshly created and had not moved the funds at first.
https://x.com/simba_crpt/status/2115936855460130875
The theory did not last. The address behind the attack was funded with 0.1 ETH from the mixer Tornado Cash, the wallet was bound to an outside contract, and shortly after the attacker began spreading tokens across dozens of addresses. At 00:04 UTC Binance co-founder Yi He confirmed the hack:
https://x.com/heyibinance/status/2115958049244631357
How the attack worked: 50 signatures, one hit
Security firm Blockaid found the decisive technical trick, and we verified it directly on-chain. The attack transaction is of the new type 4, which since the Pectra upgrade lets a wallet hand its control to a smart contractr the Binance 14 wallet, all pointing to the same attacker contract, for nonces 18,914,775 to 18,914,824 (transaction on Etherscan)
https://x.com/blockaid_/status/2115924317888495661
The background: such an authorization is only valid for the nonce the wallet has at the moment of inclusion. Because the hot wallet kept sending withdrawals, the attacker did not know the nonce and fired 50 authorizations at once. One landed. More important is what 50 authorizations require: each must be signed with the wallet’s key. The attacker could therefore produce signatures for Binance 14. How he gained that access is for Binance’s announced post-mortem to explain. The delegation has since been removed: according to our query at 01:20 UTC the wallet’s code is empty again.
Hold your coins yourself: hardware wallets compared
Where is the money? Our tally at 01:30 UTC
About $2.7 billion left the two Binance wallets on Ethereum, plus smaller amounts on other chains. Most of it is blocked, but not all:
| Item | Amount | Source |
|---|---|---|
| Frozen | more than $2.83B, including 1,767.6M USDT, 823M USDC, 40.5M RLUSD, 27.8M USD1, 29,934 WBETH | ZachXBT |
| of which verified by us | 1,175.5M USDT and 823.0M USDC frozen on 0x5227…2f8c | own contract query |
| Ether held by attacker | 197,460 ETH, about $436M, on 0x8532…43D4, incl. 2,000 ETH added at 01:14 UTC | Ethereum node |
| Borrowed via Aave | 19,762 wETH, about $45M, against 60M USDT | Marc Zeller |
| Smaller tokens distributed | at least $122M in more than 15 tokens such as LINK, AAVE, WBTC, ONDO, WLD | own measurement via Blockscout |
| Other blockchains | about $19.5M on Arbitrum and $24M on Avalanche | Blockaid, preliminary |
https://x.com/zachxbt/status/2115972303913935209
The Aave trick: why frozen USDT still yielded Ether
The attacker knew Tether could freeze. Within three minutes he supplied 60 million USDT to the lending protocol Aave and borrowed 19,762 wETH, about $45 million. Shortly after, Tether froze the address, and 46 minutes later Aave froze the affected markets. The frozen USDT now sit as collateral on Aave, the borrowed Ether are with the attacker. He will never repay them.
https://x.com/mzeller/status/2115940092409770194
Aave can absorb it, Marc Zeller of the Aave Chan Initiative explains: the position is overcollateralized and will be liquidated automatically once Ether rises about 4% to roughly $2,365. The debt equals 0.9% of the protocol’s wETH reserves. A rising Ether price would, of all things, liquidate the attacker’s loan.
AdvertisementRegulated crypto exchanges compared
What the key voices on X are saying
- Yi He, Binance: user funds safe, Binance covers all losses, deposits and withdrawals temporarily suspended, full post-mortem to follow.
- ZachXBT, investigator: more than $2.83 billion frozen.
- Blockaid, security firm: 50 EIP-7702 authorizations in one transaction, one hit. Verified by us on-chain.
- Marc Zeller, Aave Chan Initiative: the attacker borrowed 19,762 wETH before the freeze, manageable for Aave.
- Simba, analyst: initially considered an internal transfer possible, overtaken by Binance’s confirmation.
- Bala, commentator: wrote the attacker “walked away” with the Aave trick. True for $45 million, not for the billions.
Our conclusion: where the Binance hack is heading
- For customers: Binance has pledged to cover all losses, and the frozen share makes that credible. The key question is when deposits and withdrawals resume. Until then: patience, and no links from messages promising refunds. Which exchanges hold a licence is shown in our comparison of regulated exchanges. We track the status in Binance withdrawals after the hack.
- For the loot: of about $2.7 billion, more than $2.8 billion across all chains is blocked. The attacker is left mainly with the 197,460 ETH, the Ether from Aave and distributed smaller tokens, roughly $600 million in total. He will have to launder it over days and weeks, and every move is public.
- For Ethereum: the 197,460 ETH remain an overhang. At the same time a 4% price rise would liquidate the attacker’s Aave position. What it means for the price is in Ethereum crash: the Binance hacker sits on 195,000 ETH.
- For the industry: the attack shows a new pattern. Whoever can produce signatures for a wallet needs, thanks to EIP-7702, a single transaction to sweep everything. Exchanges will have to tighten their signing systems and the approval of such delegations.
We keep monitoring the addresses and will update this analysis as funds move or Binance publishes its post-mortem. This article is not investment advice.
FAQ: on-chain analysis of the Binance hack
The attacker submitted a transaction with 50 EIP-7702 authorizations for the Binance 14 hot wallet, one of which landed. That bound the wallet to his own contract, which swept it in one transaction. Each authorization had to be signed with the wallet’s key; how he got that access is for Binance’s post-mortem to explain.
More than $2.83 billion according to investigator ZachXBT, mostly USDT and USDC. We verified directly in the contracts that 1,175.5 million USDT and 823.0 million USDC are frozen on the attacker’s main address.
Mainly 197,460 ETH, about $436 million, plus 19,762 wETH borrowed $600 million in total
Yes, according to co-founder Yi He Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended.
