Binance hit by historic hack, $5.8 billion taken out and part frozen

A simple on-chain signal was enough to change the evening of October 29. At 10:32 p.m., researcher Spreek detects an anomaly on Ethereum. Four minutes earlier, a contract had just emptied a Binance wallet of 167,464 ETH. In a matter of hours, several stablecoin issuers froze $2.54 billion, while the exchange confirmed one of the largest hacks in crypto history.

An attack prepared well before the transfer

The Ledger, Coldcard and Keystone incidents had already weakened trust in crypto wallets. This time, the scenario is different: the attack does not target a cold wallet.

It all starts on October 28. One address, 0x7C86, receives 0.1 ETH from Tornado Cash, a mixer used to obfuscate the traceability of funds. This small amount is enough to cover the transaction costs.

The next afternoon, this same address deploys its own contract.

At 10:20:59 p.m., a transaction connects the Binance 14 wallet to this contract through EIP-7702a mechanism that allows a key-controlled wallet to execute contract code.

Then everything speeds up.

At 10:24:23 p.m., one transaction withdraws 167,464 ETHor approximately $388 million according to Etherscan, as well as 63 tokens, including $1.615 billion in USDT.

Twenty-four seconds later, Binance 16 sends another 28,005 ETH to this same address, which until then did not exist.

In less than a quarter of an hour, 195,460 ETH, or nearly $450 million, went to a newly created third address, while around $1.5 billion in tokens remained on the first wallet.

In total, Arkham Intelligence estimates approximately $5.84 billion in funds passed through wallets linked to the incident. This amount includes the different movements between addresses and therefore does not correspond only to the stolen assets.

Spreek Alert Changes Everything

The first warning comes neither from Binance nor from a regulator.

At 10:32 p.m., the pseudonymous on-chain researcher Spreek publishes a message on : “ Unconfirmed, but possibly massive Binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash. »

His intuition is based on a revealing detail. An exchange never funds its transaction fees via Tornado Cash. For him, this behavior immediately distinguishes a hack from a maintenance operation.

Five minutes later, he reinforces his analysis. The address that triggered the transaction comes from Tornado Cash, while the recipient wallet is now linked to movements linked to Binance.

The alerts come one after the other quickly. At 10:41 p.m., Tree News mentions a possible theft affecting hot wallets. Two minutes later, another account already estimates losses on Ethereum at more than $2.5 billion.

Odysseas Lamtzidis, founder of Phylax Systems, explains the mechanism: according to him, EIP-7702 can turn the wallet itself into a “vacuum cleaner” as soon as a signed delegation comes into play. Another developer also notes that the contract only accepts calls from the address funded by Tornado Cash.

Transmitters respond within hours

Faced with the scale of the incident, the main players in the sector intervened quickly.

Tether freezes 975.1 million USDT. At 11:04 p.m., Circle blocked 823 million USDC, a decision that its CEO Jeremy Allaire confirmed on X, in coordination with law enforcement.

Then, at 12:32 a.m., Aave temporarily suspended its v3 and v4 lending markets after a wallet linked to the hack deposited 60 million USDT there before borrowing 19,762 ETH.

Four minutes later, World Liberty Financial locks in 27 million USD1 and 2 million WLFI with the help of BitGo.

Finally, at 1:35 a.m., Binance revised its balance sheet upwards and announced 2.54 billion dollars frozen, compared to 1.8 billion mentioned previously. Shortly after, Ripple confirmed that it had blocked RLUSD, without revealing the amount involved.

An investigation still far from over

Arkham Intelligence is now tracking approximately $5.84 billion that flowed between wallets associated with the incident, although other estimates are closer to $2.4 billion.

Compared to the 693,000 bitcoins held by Binance in September, this drain represents approximately 2.64% of the platform’s reserves. So this is a compromised wallet, not a collapse of the entire exchange.

The markets reacted immediately: bitcoin fell below $79,000 (-2.6% over 24 hours), BNB fell 7% to $699, while Monero rose 6%.

The previous record dates back to the Bybit hack, estimated at $1.5 billion in February 2025. This time, a question remains: how did the attacker obtain the essential signature to activate the EIP-7702 delegation? Binance has not yet provided a response, and the investigation will have to determine whether it is a signature flaw, an operational error or deeper access to the systems.