On the morning of October 30, 2026, Vietnam time, the digital asset market was shocked when a series of Binance hot wallets were drained by an attacker, with the total value estimated to exceed 6.17 billion USD. This is the intrusion with the largest scale of damage ever recorded in cryptocurrency history, far surpassing the 1.5 billion USD attack targeting the Bybit exchange in early 2025.
EIP-7702 authorization mechanism exploited to drain hot wallets
On-chain data shows that the drained funds mainly originated from hot wallets labeled Binance 14, Binance 16, and Binance Hot Wallet 34. The intermediary address executing the initial transaction received gas fees through the anonymous protocol Tornado Cash. Analysis from security firms Phylax Systems and Blockaid indicates that the attacker exploited the EIP-7702 authorization mechanism on the Ethereum network. This standard allows a regular account to delegate transaction execution authority to a smart contract without signing and approving each individual order.
The sophisticated aspect was that the attacker simultaneously broadcast 50 EIP-7702 authorization signatures with consecutive nonce values from 18,914,775 to 18,914,824 within the same type 4 (type-4 transaction). Because the Binance 14 hot wallet continuously processed user deposit and withdrawal orders, a nonce value within that range matched the actual network state. Just 3 minutes and 24 seconds after the authorization contract was triggered at 20:20 UTC on October 29, 2026, an automated withdrawal function transferred 167,464 ETH along with 63 different token types, including more than 1.615 billion USDT. Subsequently, the associated wallets were further drained of 28,005 ETH and approximately 780 million USDC.
Issuers urgently freeze approximately 3 billion USD
Centralized asset issuers moved quickly to coordinate containment efforts. Tether CEO Paolo Ardoino announced that the company had successfully frozen more than 1.567 billion USDT. At the same time, Circle CEO Jeremy Allaire stated that more than 800 million USDC had been blacklisted at the request of law enforcement agencies. Previously, the exchange had signed a strategic agreement on USDC to boost liquidity for this stablecoin across the ecosystem.
Binance co-founder Yi He expressed gratitude to the Ripple team for assisting in freezing approximately 200 million USD related to the fund flows on the XRP network. The Arbitrum Security Council also executed an emergency transaction to transfer 74.56 million ARB and 8,425 ETH (worth approximately 30.5 million USD) to a temporary lock wallet. By the early morning of October 30, 2026, Binance confirmed that the total verified frozen assets had reached approximately 3 billion USD, equivalent to nearly half of the total funds illegally transferred.
Exchange halts deposits and withdrawals, pledges to safeguard all deposits
In response to the severe on-chain developments, Binance decided to suspend all global deposit and withdrawal gateways to conduct a security review, similar to measures taken during large-scale exploit incidents. Both former CEO Changpeng Zhao and Yi He spoke out to affirm that the SAFU reserve fund and the exchange’s financial strength are fully capable of safeguarding user assets. An exchange representative emphasized that Binance will take full responsibility for compensating all losses arising from this attack.
The financial market quickly reacted negatively to the shock, with Bitcoin’s price at one point falling close to the 77,000 USD mark and BNB dropping more than 8%. However, the fact that asset issuers could intervene to freeze half of the stolen funds continues to spark debates over the decentralization of stablecoins. The key question awaiting the official investigation report is whether the attacker stole private keys beforehand or if the exchange’s internal authorization system suffered a serious vulnerability.