Binance halted all withdrawals on the evening of Oct. 29 after an attack on the exchange's reserve wallets that the company itself put at $2.54 billion.
The exchange announced the halt at 6:22 p.m. New York time; the intrusion itself was already underway by about 4:30 p.m. Arkham Intelligence put the losses above $5.8 billion by 8 p.m., and Chainalysis estimated $5.9 billion. That is more than double Binance's own figure.
The attacker used Ethereum's EIP-7702 feature, which lets a wallet temporarily hand its authority to another address, and stacked 50 such authorizations into one transfer order aimed at the Binance 14 wallet, listed in Binance's Oct. 1 proof of reserves; one of them matched the account's required nonce.
Roughly 195,460 ETH, worth about $442 million, drained from the Binance 14 and Binance 16 wallets and moved to a separate address, CoinDesk reported. “It seems to be… a compromise of signing infrastructure. We don't think a key was leaked,” said Blockaid co-founder and CEO Ido Ben-Natan.
Binance co-CEO Yi He said customer funds were safe, and co-founder Changpeng Zhao said the goal is for users to end up “fully recovered.” The exchange's ether reserves fell to about 94% of customer holdings from 100% before the attack.
The selloff spread across the market: bitcoin fell 4.5% to $76,664, ether dropped 5.2% to $2,190, Binance's own BNB token slid 7.1% to $698.65 and XRP lost 7% to $1.21 by late Thursday, The Block reported.
Traders had $1.55 billion in positions liquidated across 246,482 accounts within 24 hours. BNB's decline was “quite modest for possibly the largest exchange theft ever,” said Rick Maeda, head of markets at Laevitas.
Tether froze $1.567 billion in stolen USDT, its CEO Paolo Ardoino said; another $823 million in USDC was frozen, according to Zhao; and Ripple froze about $200 million. Binance confirmed roughly $3 billion frozen in total.
By sophistication, the attack resembles past activity linked to North Korean hackers, and on a technical level it draws comparison to the February 2025 hack of Bybit, in which attackers compromised a multisig Safe wallet. Binance hasn't disclosed exactly how the breach happened, and Arkham CEO Miguel Morel said there isn't enough information yet to tell whether a key was stolen or the signing infrastructure was compromised.
