Friday 30 October 2026
Binance halts withdrawals after a hot wallet drain that may be the largest crypto theft on record
Binance suspended deposits and withdrawals on Thursday after its Ethereum hot wallets were drained in a matter of minutes. On chain trackers put the amount directly traceable to the drain at about 2.8 billion to 3.5 billion dollars as of October 30, and Binance later put its estimated impact at about 6.3 billion dollars, with about 3 billion dollars frozen with partners. The exchange says it will cover all losses. Hours earlier, Polymarket put its international platform into cancel only mode after malicious code loaded through a third party provider drained user accounts, with losses estimated at about 2.6 million to 2.7 million dollars. No link between the two incidents has been established.
The money started moving at about 20:24 UTC on Thursday, October 29. A single transaction took 167,464 ether, about 1.6 billion dollars in USDT and dozens of other tokens out of the hot wallet labelled Binance 14 and sent them to an outside address. Transfers from a second ether hot wallet and a USDC hot wallet followed within minutes.
The estimates do not agree, and they count different things. Analysts tracing the Ethereum drain put the traceable total at roughly 2.8 billion to 3.5 billion dollars as of October 30. Higher figures from Glassnode, Arkham and Chainalysis, running from about 5.3 billion to 5.9 billion dollars, also count about 18,000 bitcoin and Tron outflows that have not been tied to the same attack. Binance itself later put the estimated impact at about 6.3 billion dollars and said about 3 billion dollars had been frozen on chain with partners. Those are the company's preliminary figures, not a final accounting.
Security firm Blockaid said the attacker used Ethereum's EIP-7702 feature, which lets a wallet delegate control to contract code, to hand Binance 14 to an unverified sweeper contract. Binance has not confirmed how the attack worked. Its preliminary account pointed to a compromised DevOps engineer's laptop. Some analysts have pointed to North Korea. No official attribution has been made.
The freeze effort moved fast. Tether chief executive Paolo Ardoino said the company had frozen more than 1.567 billion dollars in USDT, and Circle chief executive Jeremy Allaire said more than 800 million dollars in USDC had been frozen in coordination with law enforcement. Binance put the verified frozen total at 2.54 billion dollars in one update. The roughly 195,000 stolen ether cannot be frozen by any issuer, and it has already been moved to a second address.
Binance suspended deposits and withdrawals while it conducts security checks and works with law enforcement, and it said it will cover all losses from its SAFU fund and company funds. Former chief executive Changpeng Zhao, who said he no longer manages the exchange, wrote that it does look like a hack on Binance. Even the conservative estimate is about double the roughly 1.5 billion dollars taken from Bybit in February 2025, a theft the FBI attributed to North Korea's Lazarus Group. BNB traded near 690 dollars on Friday, down about 9 percent over 24 hours, as of October 30. Binance has promised a full post mortem, and its next proof of reserves snapshot is due November 1.
Hours before the Binance outflows, Polymarket put its international exchange into cancel only mode after malicious code loaded through a third party script drained user accounts. The company said one of its third party providers was compromised, that it had referred the matter to law enforcement, and that anyone affected will be made whole. On chain data puts Polymarket users' losses at about 2.6 million to 2.7 million dollars, a figure the company has not confirmed. Trading resumed around 19:00 UTC. No link between the Polymarket incident and the Binance drain has been established.
Spotted an error in this story? Email [email protected] and it will be checked against the sources.