Binance Confirms Hack: Damage Estimates Range from $5.3 Billion to $6.3 Billion

Binance confirmed the breach following an incident involving internal funds. Co-founder and head of customer service Yi He stated that the exchange is aware of reports of a potential security issue and is actively investigating. Updates will be published only through official channels, and users should beware of scammers and not trust unofficial links and account data requests. Binance founder Changpeng Zhao, who stepped down as CEO in 2023, described the situation as resembling a real hack and, as a shareholder, stated that he expects full reimbursement of client funds.

Timeline

The first major transfers began on October 29 around 16:24 Eastern Time. In one transaction on the Ethereum network, approximately 167,464 ETH, 1.615 billion USDT, and dozens of other tokens were withdrawn. Within 40 minutes, an estimated $3.52 billion was received by a single recipient address. Data then emerged about movements in the Bitcoin and Tron networks.

Discrepancy in estimates

Damage figures vary among sources. Glassnode estimated the outflow at approximately $5.3 billion, with broader estimates ranging from $5.5 to $5.8 billion. On the morning of October 30, Binance estimated the damage at approximately $6.3 billion and reported that, together with partners, it had frozen about $3 billion of the withdrawn funds. The exchange has not published an independently verified loss amount, and some estimates may include transfers not related to the attack.

Two versions of the cause

According to preliminary investigation results by Binance, the attacker may have gained access to the infrastructure through a compromised DevOps engineer's laptop, penetrated an internal service, and sent unauthorized withdrawal requests. No signs of private key leakage were found. Another version is related to EIP-7702, an Ethereum feature allowing a wallet to authorize a smart contract to act on its behalf. Investigators identified a delegation transaction approximately three minutes before the transfer from Binance wallet 14, as well as a contract deployed earlier that day linked to an address funded via Tornado Cash. The exact mechanism is unconfirmed and does not explain movements in the Bitcoin and Tron networks.

Freezes

Tether froze over 1.567 billion USDT, Circle over 800 million USDC, Ripple around $200 million, World Liberty Financial $27 million in USD1 and about $2 million in WLFI. In total, the declared measures amount to about $2.6 billion, but independently they are not confirmed. Aave restricted new deposits and loans: the attacker deposited about 60 million USDT and borrowed 19,762 WETH worth $44.6 million; 175 V3 reserves in 16 networks and 117 V4 reserves in four were frozen. Loan repayments and withdrawals continued to operate. The Arbitrum Security Council moved 74.56 million ARB and 8,425 ETH to an intermediate frozen wallet.

Reaction of Binance and the market

Binance suspended deposits and withdrawals, revoked access rights from the compromised address, and contacted law enforcement. Losses are promised to be covered by SAFU and own funds, and after checks, an updated proof of reserves and technical report will be published. Bitcoin momentarily dropped below $77,000 and traded around $78,700. Ethereum fell by 2.9–4.6% to $2200, BNB by 5–7.7% to $717. The liquidation volume over 24 hours amounted to $1.4–1.5 billion. In the Tron network, attackers were buying TRX to bypass a potential block, leading to a sharp rise in the coin's price. The version of North Korean involvement is being discussed by researchers, but there is no official confirmation. Separately, on October 29, hackers stole $2.7 million from Polymarket users through a compromised third-party software provider.