The Binance Hack That Could Be the Largest in Crypto History
On the afternoon of October 29, 2026, on-chain data revealed unusual movements from hot wallets linked to Binance, the world's largest cryptocurrency exchange. In a matter of minutes, more than $2.77 billion in assets — including 167,000 ETH and hundreds of millions in USDC and USDT — were transferred to unexplored addresses. Tether froze $971 million in USDT and Circle, $823 million in USDC at the destination wallet, totaling about $1.8 billion trapped. Binance founder Changpeng Zhao stated the incident "looks like a hack" and expects user funds to be "fully covered." Binance has yet to confirm any impact on customer funds. If confirmed, this would be the largest theft in the industry's history, more than tripling the previous record of $1.5 billion from Bybit in February 2025.
What happened
At 20:24 UTC on October 29, a transaction on Ethereum moved approximately 167,464 ETH — roughly $388 million at the time — from a Binance hot wallet to a new externally controlled account. The source address, 0x7C86…5CA0, had not been funded directly by Binance: it received only three deposits of about 0.1 ETH each, all from Tornado Cash, a crypto mixing service that obfuscates the origin of funds. In less than 15 minutes, that address forwarded 195,460 ETH — about $450 million — to another newly created address, while holding about $1.5 billion in tokens.
On-chain data shows the transfers totaled $3.51 billion on the Ethereum network, $1.44 billion in 18,270 Bitcoin, and $630 million on the Tron network, summing a potential total of up to $5.57 billion if all movements are confirmed as part of the same incident.
The exchange reacted by suspending withdrawals on multiple networks "as a precautionary measure," according to a statement sent to the press. "We are aware of reports of a potential security issue and are investigating actively," Binance wrote. "Our security teams are reviewing all relevant information with urgency." However, the company reiterated that "user funds are completely safe" and that it "has not confirmed any impact to user funds."
Why the architecture matters
What makes this case particularly interesting is not just the magnitude, but the attack vector. Hot wallets — those connected to the internet to process customer withdrawals — have been the target of many attacks throughout crypto's history. What distinguishes this incident is that the transaction was triggered by a wallet funded exclusively through Tornado Cash. This suggests a compromise of digital signatures rather than a simple private key theft, which would imply a more sophisticated attack on the exchange's transaction approval process.
Exchanges like Binance use multi-signature (multisig) wallets for hot wallets: multiple individual keys must approve any transaction above a threshold. If someone managed to get a signing wallet to approve mass transfers without authorization, this raises questions about how Binance manages its signing keys and whether the compromise may have extended to other systems.
Binance's decision not to confirm the hack immediately, even as Changpeng Zhao had already publicly identified the incident, reflects the delicate balance between transparency and market panic. Immediate confirmation could trigger a bank run; prolonged silence feeds speculation.
What experts say
On-chain researchers like Spreek, who first flagged the transfer on X, observed that the movement "COULD" be routine wallet maintenance, but "looks extremely suspicious." The transfer pattern — new address, via Tornado Cash, immediate forwarding to another untraceable address — mirrors the classic behavior of hackers trying to obfuscate fund origins before the exchange can freeze them.
The speed of the movements was remarkable. Tether and Circle were able to freeze about $1.8 billion in the destination wallet, but about $450 million in ETH had already been forwarded to a second new address, beyond the reach of stablecoin issuer freezes. Decentralized exchanges, where funds can be swapped rapidly, are the next barrier to any recovery attempt.
Historical context
If confirmed, the Binance incident will far surpass the previous record: the Bybit hack in February 2025, in which the Lazarus group (linked to North Korea) stole $1.5 billion by compromising the exchange's cold wallet. Bybit covered all losses and maintained its operations. At Binance, the most serious incident previously was in May 2019, when 7,000 BTC (then worth about $40 million) were stolen from hot wallets.
The contrast is revealing: in 2025, the attack on Bybit compromised a cold wallet (offline storage, much more secure). In 2026, the attack on Binance compromised hot wallets with a more sophisticated vector. The evolution of attack techniques follows the evolution of defenses — when one layer is strengthened, criminals look for vulnerabilities elsewhere.
Market impact
The news triggered a broad selloff in the crypto market. Bitcoin fell below $78,900, Ether dropped 4%, and BNB — the native token of Binance itself — plunged 7%, with a 6% drop in a single hour. About $620 million in leveraged positions were liquidated within one hour, 97% of them long positions. The volatility shows how sensitive the market still is to any news related to exchanges.
Traditional market response also deserves note: spot Bitcoin ETFs recorded $442.67 million in net inflows on Thursday, the week prior, showing a return of institutional demand even amid the turmoil. This suggests institutional investors are willing to buy the dip, while short-term traders react to panic.
The question that remains
In an industry that claims to be built on transparency — publicly verifiable blockchains, auditable wallets, immutable contracts — a single point of failure can compromise billions. The question that arises is not whether the next crisis will come, but when. And the answer depends less on technology than on governance: who controls the keys, who approves transactions, and what happens when trust is the real currency.
Sources: TechCrunch, Decrypt, Cyber Kendra
✓ Independent sources cross-checked and verified before publishing
