A Binance hot wallet falls: one valid signature, eight minutes, $5.6B

Update (02:23 UTC, 30 Oct): Binance subsequently put total impact at an estimated $6.3B with about $3B frozen, and gave a root-cause direction for the first time. The $5.643B / $2.62B in this piece are the third-party accounting as of 00:30 UTC; the gap turns on gross-versus-net, address sets and snapshot timing. See Binance names a root cause.

This is a snapshot of an unfolding incident, not a conclusion. All on-chain figures, prices and freeze amounts are as of 00:30 UTC on 30 October 2026 and may have moved since. Binance has suspended withdrawals and Binance Alpha, with no timetable, no net loss figure and no reserve update. The $5.6–5.8B here is a measure of affected funds, not a realised loss.

TL;DR

• The window was tiny: drained at 20:24, first public warning at 20:32 (eight minutes), first freeze at 21:01 (37 minutes). Half an hour separated the money leaving from any means of stopping it.
• Scale: independent on-chain accounting puts it at $5.643B after removing change and internal transfers; Arkham's binance-hacker-1029 cluster of 55 addresses holds about $5.84B.
• About $2.617B frozen (Tether $1.567B, Circle $823M, Ripple $200M, USD1 $27M); Binance verified $2.54B — a difference of timestamp and address overlap.
• That 45% is not risk management. It is an accident of composition. Stablecoins can be frozen; native BTC and ETH cannot — and the attacker is converting into ETH.
• No contract was exploited. What failed was who gets to make a wallet execute code. The mechanics are in the companion piece on EIP-7702.
• BNB −10.0%, roughly twice BTC's fall, and still sliding after the official statement — the market is not absorbing the news once, it is repricing "when do withdrawals resume" continuously.

1. Timeline

This is the part worth checking line by line.

Two intervals worth remembering: eight minutes from the money leaving to anyone noticing publicly, 37 minutes to the first freeze. For an atomic transaction both are already too late — they determine how much is recoverable, not whether it could be stopped.

A communications detail: Binance's first wording was that the impact on user funds was "not yet confirmed", subsequently edited to state that user funds are completely safe. The change was screenshotted by outlets and on-chain analysts, and is one reason the market has stayed cautious about the official account.

2. On-chain evidence: how one transaction moved $2.5B

The inventory of the first drain is specific, and it is the core evidence that this was loss of wallet control rather than a contract exploit:

The calldata carries 65 addresses: one address(0) as the ETH placeholder plus 64 ERC-20 contracts, totalling roughly $2.5B. The "63 tokens" in public analysis is more likely the count of transfers that actually succeeded.

The on-chain fingerprint is unambiguous: Binance 14's code was written as 0xef0100 + 63e842b0… — the EIP-7702 delegation indicator — after which the operator address 0x7c8601d4…, funded via Tornado Cash, called sweep(address,address[]) (selector 0x8a179be4).

The caller was not the account owner, but the execution was identical to the owner acting personally — which is precisely the semantics of a 7702 delegation.

This was not improvised. On-chain records show nearly 18 hours of preparation: a test contract deployed at 02:28, delegations and sweeps rehearsed on three of the attacker's own wallets at 13:51 and 16:20, the final contract deployed at 15:59, and the real move at 20:20. Three and a half hours sat between the last rehearsal and the attack — waiting for the right moment.

The authorisation transaction carried 50 EIP-7702 authorisations with nonces in descending order, of which exactly one took effect (the other 49 returned invalid_nonce). Descending is deliberate: ascending order would have let every higher nonce take effect after the hit, advancing the account nonce fifteen times over.

And authorisation and drain were two separate transactions, 17 blocks and 3 minutes 24 seconds apart — Type-4 transactions are publicly visible in the mempool, so that was a window in which this could have been caught. The transaction-level breakdown is in the companion forensic piece.

The attack also spread along ownership: calling from Binance 14 into Hot Wallet 34 — a smart wallet owned by Binance 14 — moved a further $780–823M of USDC.

3. Scale: two measures

Two things to be clear about.

First, holdings value is not realised loss. Arkham's number includes assets not yet sold and partly frozen. Binance has published no net loss.

Second, this total cannot all be attributed to that one 7702 attack. All 50 authorisations carried chain_id 1 — and under EIP-7702 only chain_id = 0 replays across chains. Bitcoin, Tron and Solana do not have EIP-7702 at all.

So the $2.5B on Ethereum has a complete authorisation-to-execution causal chain, while the figures on other chains are balance movements that may mix independent compromises of other hot wallets, Binance's own sweeps or defensive transfers, panicked user withdrawals, or analyst mislabelling.

Multi-chain losses may well be real; attribution has to be done separately. Filing all $5.6B under "one 7702 attack" overstates the technical reach of this attack and misdirects the defensive response.

Against the historical record, every reading sets a new high:

4. Freezes: the only thing that actually worked

Binance's verified figure is $2.54B, broadly consistent with the issuers' $2.617B — a difference of timestamp and address overlap, not a contradiction.

The structural gap is clear: stablecoins can be frozen, native assets cannot.

And that 45% is itself informative: nearly half of what moved was centralised stablecoin an issuer can freeze unilaterally. A hot wallet weighted more toward native assets would have produced a completely different recoverable share from the same attack.

So 45% does not reflect risk-management capability; it reflects composition. The share is also being eroded: the attacker is selling PEPE, UNI and LINK for ETH — actively converting freezable assets into unfreezable ones.

5. The ecosystem responded faster than the exchange

• Issuers: Tether went from $971M to $1.567B; four issuers total about $2.617B.
• DeFi: Aave froze all DAO markets (V3/V4), halting new deposits and borrows while keeping withdrawals and repayments open — cutting off the attacker's route to borrow against collateral rather than freezing user assets. Restrained, and its own contracts were unaffected with positions still overcollateralised.
• Peers: Bybit and Binance.US both stated within hours that they were unaffected, heading off an industry-wide run.
• Market makers: Wintermute's Evgeny Gaevoy said publicly that Binance can absorb three to four times the current loss — while advising against depositing to Binance until the cause is known.

6. Market: pricing platform risk

The tape deserves attention: BNB wicked from $745 to $678 within the 20:00 UTC hourly candle on more than ten times normal volume; it was back at $698 by 23:58, then lost another 2% to $684 over the following half hour.

The market is not absorbing the news once. It is continuously repricing "when do withdrawals resume".

BTC and ETH falling reflects a broader risk-off move — Nasdaq futures were weak that evening on tech earnings — so the Binance incident was an accelerant rather than the sole cause.

Sentiment has not turned to panic: Fear & Greed sits at a neutral 50 and no stablecoin has depegged systemically. The market is treating this as a single platform's custody failure, not an industry credit event.

7. Disputed and unverified

Several claims in the public record need correcting or flagging, and they bear directly on the judgment:

One more misconception to clear: this was not a smart contract hack. No contract had a flaw. What was broken is who gets to make a wallet execute code.

That is also why the blast radius is so cleanly bounded — only addresses Binance itself controls were affected, while Aave, Bybit and the protocol layer were untouched.

8. Conclusion

Laid out in sequence, the shape is far clearer than the first reports suggested: the malicious delegate contract was deployed at 15:59, the drain executed at 20:24 on an authorisation signed by the hot wallet's own key, it was noticed publicly at 20:32, and issuers began freezing at 21:01.

The window in which the money was taken was minutes, and the only tool that recovered anything covers about 45%.

Three horizons:

Short term, watch the withdrawal-resumption announcement and the frozen total — they decide whether BNB's discount widens.

Medium term, watch whether Binance publishes a net loss, proof of reserves and a root cause — they decide whether this is a contained operational incident or the start of a repricing of custody.

Long term, watch whether this 7702 path forces the industry to rebuild hot wallet signing. If Binance is not the only venue holding assets in an online EOA, the same risk is industry-wide.

Bottom line. Until withdrawals resume and the loss figure lands, do not read BNB's fall as mispricing: what fell is a platform-specific risk premium, and that premium is repaired by disclosure, not by the passage of time.

For users, the practical moves remain diversifying custody, favouring self-custody, and pausing three seconds before any "batch approval" or "account upgrade" signature request — this incident began with a signature that looked entirely legitimate.

Sources

• The Block: Binance investigating suspicious outflows
• TechCrunch: Binance pauses withdrawals
• CoinDesk live coverage
• Ondology Labs: EIP-7702 attack analysis
• Threat Landscape: hot wallet and 7702 delegation
• FinanceFeeds citing Arkham: issuers freeze over $2.5B
• Binance statement
• CZ's statement
• Spreek's first warning
• 0xQuit on the asset inventory and contract deployment
• BWEnews independent accounting
• Lookonchain on the attacker's sales
• Aave's statement

Companion pieces: anatomy of the EIP-7702 attack: 18 hours of prep, one signature, one bot, the EIP-7702 signing flow, and Binance has not released the signing logs. Data as of 00:30 UTC, 30 October 2026; the incident is ongoing. Figures come from reporting and on-chain monitoring, not audited numbers; Binance has published no net loss and the root cause is not officially confirmed. Not investment advice. DYOR.