Binance hot wallets drained of up to $6 billion on October 29
Security & Exploits ·
An exploit using the EIP-7702 delegation standard let an attacker siphon billions from Binance hot wallets across several blockchains before issuers began freezing the funds.
Binance suffered a large-scale breach on October 29, with losses estimated at $5.8 billion to $6 billion pulled from hot wallets spanning multiple chains, according to a timeline posted on X. The attack began at 20:20 UTC when the intruder exploited EIP-7702 to redirect Binance hot wallet 14 toward malicious code, opening the door to a rapid sequence of withdrawals.
Within minutes, the attacker moved 167,464 ETH along with 63 other tokens — including 1.615 billion USDT — in one transaction at 20:24 UTC, then pulled an additional 28,005 ETH from hot wallet 16 a minute later. By 20:41 UTC, $780 million in USDC had been taken from hot wallet 34, with a further $43 million following shortly after. At 20:57 UTC, the attacker deposited $60 million USDT into Aave and borrowed close to 19,762 ETH against it, a step that extended the exploit into decentralized finance markets.
Stablecoin issuers moved to contain the damage starting at 21:01 UTC, with Tether, Circle and others freezing portions of the stolen assets, per the same timeline. Binance subsequently revoked the malicious delegation and briefly halted withdrawals to run security checks. Roughly $3 billion of the stolen funds has been frozen so far, while the remainder is still being traced.
The episode is corroborated by related reports describing Binance shifting funds from wallets considered potentially compromised into cold storage, and a separate tally putting total outflows at $6.26 billion moved to attacker-controlled addresses across nine chains, including Ethereum, Bitcoin and Solana. Three distinct sources have covered aspects of the incident.
Binance has said customer funds remain safe and that affected users will be reimbursed in full. Still unresolved is the exact final loss figure, how much of the roughly $3 billion already frozen can be recovered, and how the remaining unfrozen funds — now dispersed across chains and partly routed through Aave — will be tracked or clawed back.