An attacker emptied several Binance hot wallets in a matter of minutes during the night of October 29, 2026, and the exchange platform estimates the impact of the hack on Binance at around $6.300 billion, according to reports. CoinDeskIt is the largest cryptocurrency theft recorded to date, and its scope grew throughout the early morning as withdrawals appeared on other blockchains.
Binance has promised to cover all losses with its own reserves and resources, has paused withdrawals while it reviews its security, and claims that some $3.000 billion has already been frozen by stablecoin issuers and other industry partners. What it has yet to explain is how the valid signatures that enabled the attack were obtained, and that answer affects any platform that holds third-party crypto assets.
For those who hold crypto assets in Bit2Me, the company has published a informative noteBit2Me's clients are not affected because it does not hold assets in custody on the platform involved, and its services are functioning normally. The company adds that it is monitoring the incident and will provide updates through its official channels. This message does not alleviate the industry's concerns, as the incident reopens the debate about how to protect the keys that handle billions of dollars.
TL;DR
- An attacker emptied Binance hot wallets on October 29, 2026; the platform estimates the impact at around $6.300 billion.
- He used 50 EIP-7702 authorizations signed with a Binance wallet, and it is still unknown how he obtained those valid signatures.
- Bit2Me reports that its customers' crypto assets are not affected and that its services are functioning normally.
- Freezing funds does not mean recovering them: Binance promises to cover losses, but its white paper will take time, and false messages are already circulating.
What happened in the Binance hack
The sequence began on Wednesday, October 28, when the attacker's address received small withdrawals from Tornado Cash, and continued on Thursday with the deployment of a sweeper contract around 16:00 PM UTC, which was tested on the attacker's own wallets. At 20:20:59 PM UTC, a single transaction with 50 authorizations arrived, directed to the hot wallet labeled as Binance 14, according to the analysis of CoinDesk.
Four minutes later, at 20:24:23 UTC, the contract withdrew approximately 167.464 ETH, about $1.600 billion worth of USDT, and dozens of other tokens from that wallet in a single transaction, for a total value of nearly $2.500 billion. The withdrawals continued with further inflows from clients to the same wallet and a second withdrawal from Hot Wallet 34, totaling 823 million USDC according to TRM Labs.
The outflows were not limited to Ethereum: on chains without EIP-7702, such as Bitcoin or Tron, funds left via standard signed transfers, and Blockchain Observatory It also counted ten other "hot wallets" across four chains that sent funds to the same address within 12 minutes.
How the attack was executed with EIP-7702
EIP-7702 is an Ethereum enhancement activated in May 2025 with the Pectra upgrade, which allows a regular wallet to execute smart contract code using a signed authorization. Anyone can submit this authorization to the network, and it remains valid until a new authorization is registered to replace or cancel it. If you want to know how these changes are approved, you can consult the Academy guide on the subject. Ethereum Improvement Proposals (EIPs).
The attacker prepared 50 authorizations signed by Binance 14, with consecutive transaction counters (nonces) between 18.914.775 and 18.914.824, because the wallet was still operating and its counter changed with each transaction. Ethereum only accepted 18.914.809, which matched the wallet's state at that moment, and that delegation pointed to the sweeper contract.
What remains unknown is how those signatures were obtained. Binance co-CEO Richard Teng has indicated that the preliminary investigation points to a compromised laptop belonging to a DevOps engineer, which allegedly granted access to a service container to launch unauthorized withdrawals, and that there is no evidence that private keys were leaked.
Binance later said it had found other points of vulnerability without detailing them, and CoinDesk reports an unconfirmed hypothesis: that the attacker induced the signing infrastructure itself to generate the authorizations.
Binance 14 revoked the delegation at 00:10:35 UTC on Friday, almost four hours after the initial authorization. Blockchain Observatory emphasizes that there was no Ethereum failure, as the signatures were valid, and that a hot wallet capable of executing code with a single signature concentrates too much power.
How much was lost and what has been frozen
The figures are still fluctuating, and each source uses different methods, so it's best to read them as ranges rather than a definitive figure. Binance estimates the impact at around $6.300 billion spread across multiple blockchains, while on-chain estimates cited by Blockchain Observatory and Decrypt range from $5.600 billion to $6.400 billion.
| Concept | Figure | Source and date |
| Estimated impact by Binance | About 6.300 billion dollars | Binance, via CoinDesk, 10/30/2026 |
| External counts | Between 5.600 and 6.400 million dollars | Blockchain and Decrypt Observatory, 29-30/10/2026 |
| From an Ethereum wallet | About $2.500 billion in less than 4 minutes | CoinDesk, 30/10/2026 |
| Frozen according to Binance | About $3.000 billion ($2.540 billion on 10/29) | Binance, via CoinDesk and Blockchain Observatory |
| USDT frozen by Tether | 1.567 billion USDT | The Block, 29/10/2026 |
| USDC frozen by Circle | More than 800 million USDC | The Block, 29/10/2026 |
| Resources reserved by Binance | More than 6.340 million dollars | CoinDesk, 30/10/2026 |
Freezing is not the same as recovering, and the Blockchain Observatory analysis points out that this process can take weeks. Binance has committed over $6.340 billion of corporate resources to restore balances, of which $5.000 billion is already in the affected tokens, and will also use its SAFU emergency fund, which holds approximately $1.000 billion in Bitcoin.
Two on-chain analysis firms, Chainalysis and TRM Labs, have attributed the attack with high confidence to a North Korean hacking group, according to CoinDesk. This is a third-party attribution: Binance has not yet published the technical report that should clarify the full path of the attack.
Why your crypto assets in Bit2Me are not affected
Bit2Me published a statement on October 30th explaining that the incident does not affect its clients' crypto assets, as the company does not hold them on the platform involved. Its services are operating normally, which you can verify on the status page, while the team monitors the incident and the market to provide updates through official channels.
The company adds a nuance worth reading in full: no one can promise absolute security. Being authorized doesn't mean a platform can't be robbed or that the value of its assets is protected; rather, it means the platform has obligations before and after an incident and is liable to its clients in the cases defined by MiCA.
What does MiCA require of a platform that holds crypto assets
In the European Union, the MiCA (Markets in Crypto-Assets) regulation sets specific rules for those who hold third-party crypto assets, and BITCOINFORME, SL (Bit2Me) is authorized by the CNMV (Spanish National Securities Market Commission) as a provider of crypto asset services, including custody. According to the company's statement, this oversight translates into three obligations.
- Segregation: customer assets are kept separate from the company's assets and, if the company goes into administration, they are removed from its assets.
- Liability: If the custodian loses a client's assets due to an incident attributable to him, he is liable to the client up to the market value of what was lost at that time.
- Custody policy: The provider must minimize the risk of loss due to fraud or negligence, including cyber threats.
In addition, there is DORA, the European regulation on digital operational resilience, which mandates managing technological risk and testing response plans, as well as reporting serious incidents to the supervisor. Bit2Me states that its certifications and security policies are public, independently audited, and can be consulted in its Trust Center.
How to protect yourself from fraudulent messages after the incident
After an incident of this magnitude, messages often appear impersonating legitimate platforms in order to steal credentials or funds, as Bit2Me warns in its statement. The useful rule is to treat any unexpected communication with suspicion, even if it appears to be from a company you know.
- Never share passwords or verification codes, and especially not yours. seed phrase.
- Don't click on links you weren't expecting to receive.
- Do not respond to suspicious messages: contact Bit2Me only through its official channels.
- If you've already responded to one, open a support case as soon as possible.
- Activate two-factor authentication (2FA) if you don't already have it.
These measures apply to any platform, not just Bit2Me, and should be applied even if you have never had funds on Binance, because fraudulent messages are sent en masse to anyone who appears on a list.
Current status of the Binance incident in October 2026
This summary reflects data published up to the afternoon of October 30, 2026, by Binance, CoinDesk, and The Block, and the information is still changing. Direct consultation of each platform's official channels will always be more reliable than any figures in this text.
| Subject: | Situation | Source |
| Binance withdrawals | Paused during security checks; Binance indicated they could resume in 48 hours | CoinDesk, 30/10/2026 |
| Loss coverage | More than $6.340 billion reserved | CoinDesk, 30/10/2026 |
| Cause of the attack | Unconfirmed: laptop compromised and other breach points not detailed | CoinDesk, 30/10/2026 |
| Technical report | Promised upon closing the investigation, no date set | The Block, 29/10/2026 |
| Attribution | Chainalysis and TRM Labs point to a North Korean hacking group | CoinDesk, 30/10/2026 |
| Bit2Me | Services are operating normally and customers' crypto assets are unaffected. | Bit2Me, 30/10/2026 |
What the Binance hack leaves for the rest of the industry
The Binance hack has shown that the vulnerability was a signature, not an Ethereum flaw: according to Blockchain Observatory, EIP-7702 was designed for user convenience, but in a hot wallet, it became an unsupervised persistent permission. The promise to cover losses resolves the situation for Binance customers, but leaves open the question of how custody keys are protected on other platforms.
We'll have to wait for Binance's white paper to learn how the signatures were obtained and whether the same custody design exists on other platforms. Meanwhile, for those who store crypto assets on a regulated platform, the key question is how their custody is separated from the company's funds and who is responsible if something goes wrong.
Legal Notice
Important noticeThis article is for educational and informational purposes only. The content does not constitute financial, legal, or tax advice. Cryptocurrencies are high-risk assets and their value can fluctuate significantly. Consult a qualified professional before making any acquisition or participation decisions.
BITCOINFORME, SL, which operates as Bit2Me, is a crypto asset service provider authorized and regulated by the CNMV in accordance with Article 59 of MiCA.
Frequently asked questions about the Binance hack
What happened in the Binance hack?
An attacker drained several Binance hot wallets on the night of October 29, 2026, using EIP-7702 authorizations signed with a Binance wallet. Binance estimates the impact at approximately $6.300 billion.
How much money has been lost?
Binance estimates the impact at around $6.300 billion, while external estimates range from $5.600 billion to $6.400 billion. These figures may change when the white paper is published.
How did the attacker manage to empty the wallets?
He prepared 50 authorizations with consecutive numbers, and the network accepted the one that matched the portfolio's status. How he obtained the valid signatures remains unclear.
What is EIP-7702?
It's an Ethereum enhancement, activated in May 2025 with Pectra, that allows a regular wallet to execute smart contract code using a signed authorization. That authorization remains valid until it is replaced or revoked.
Are my crypto assets affected in Bit2Me?
According to the company's press release, no, because Bit2Me does not store them on the platform in question. Their services are functioning normally, and you can check the status page.
What is a hot wallet and why is it a weak point?
It's an internet-connected wallet that a platform uses to move funds quickly. Because it's always available, a failure in the signatures or the system that generates them can leave large amounts exposed.
What will happen to Binance users?
Binance has promised to cover all losses with its reserves and corporate resources. Withdrawals are paused during security checks, and the platform indicated they could resume in about 45-48 hours.
What is the difference between freezing and recovering funds?
Freezing stablecoins prevents issuers from moving the designated assets, but it doesn't return the funds to their owner. Recovering them can take weeks and depends on the issuers and the authorities.
How do I recognize a fraudulent message after such an incident?
Be wary of any unexpected messages that ask for passwords, verification codes, or your seed phrase, or that include links you weren't expecting. Only contact the platform through its official channels.
What obligations does a regulated platform have if it loses customer crypto assets?
In the European Union, MiCA requires the segregation of client assets from the company's assets and liability for losses attributable to the custodian. Furthermore, DORA mandates the management of technological risk and the reporting of serious incidents to the supervisor.
