Binance told customers on October 29 that their funds were safe, about an hour after billions of dollars began leaving its hot wallets. The exchange’s own reserve data complicates that message, because the drained wallets are listed among the assets backing customer balances. The promise now depends on how much Binance can replace, and how quickly.
Binance Pauses Withdrawals After Billions Leave Hot Wallets in 40 Minutes
At 20:24 UTC on October 29, a Binance hot wallet labeled Binance 14 sent 167,464 ETH and 63 other tokens, including roughly 1.6 billion USDT, to a newly created address. Two minutes later, a second wallet, Binance 16, sent 28,005.6 ETH to the same address. Unchained counted about $3.5 billion leaving Binance-labeled wallets on Ethereum alone within roughly 40 minutes. If that figure holds, the incident already exceeds the roughly $1.4 billion stolen from Bybit in February 2025, the previous record.
Estimates of the full amount diverge sharply. Arkham counted more than $5.7 billion in the attacker’s wallets, and Chainalysis said it was updating its estimate to roughly $5.9 billion. Those larger tallies include Bitcoin and Tron outflows, and some analysts caution that they may include transfers unrelated to the attack. Binance founder Changpeng Zhao, replying to an analyst’s estimate of about $1 billion in net loss after freezes, said the loss might be a bit higher. Binance has published no loss figure.
Binance Has Confirmed an Incident, Not a Loss
Binance’s first official post on X said only that the company was investigating and had not confirmed any impact on user funds. Within minutes the wording changed to “completely safe,” and spokesperson Ross O’Leary told TechCrunch that the exchange had suspended withdrawals on multiple networks after a security incident. By early Friday, co-CEO Yi He said Binance would cover “all hacking losses,” that deposits and withdrawals were temporarily suspended, and that a full post-mortem would follow.
Zhao, who no longer runs Binance but remains its largest shareholder, wrote, “It does look like a hack on Binance.” Binance did publish one number, a verified frozen total of $2.54 billion that it said could rise. Tether CEO Paolo Ardoino said his company froze more than 1.567 billion USDT, and Circle CEO Jeremy Allaire said Circle froze more than 800 million USDC in coordination with law enforcement. Binance’s co-CEO credited Ripple with a further freeze of about $200 million, and World Liberty Financial reported freezing about $27 million. Binance also warned users to ignore unofficial links and messages.
How the Attacker Took Control, So Far
On-chain data points to EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025 that lets an ordinary wallet hand control to a smart contract. At 15:59 UTC, an attacker-controlled address deployed a sweeper contract. At 20:20 UTC, Binance 14 started running that contract’s code through a delegation, and about three and a half minutes later the contract emptied the wallet. The address that triggered the sweep had been funded through the Tornado Cash mixing service.
A delegation requires a signature from the wallet’s own key, so the open question is how the attacker obtained one. Blockaid found that the attacker submitted 50 authorizations in a single transaction to match the wallet’s moving transaction counter, and only one matched. Analysts are weighing a stolen key, a deceived signer and a compromised signing system, and none has been established. EIP-7702 also cannot explain the reported Bitcoin and Tron outflows, so investigators still need to establish whether those transfers belong to the same attack.
Investigator ZachXBT and Blockaid said North Korea was likely behind the attack. No official attribution had been made as of early Friday. North Korean hackers were also blamed for the Bybit theft.
“Safe” Is a Balance-Sheet Claim
Binance publishes monthly proof-of-reserves reports that list the wallets it controls and compare their holdings with customer balances. CoinDesk found that the October 1 report includes Binance 14, which then held 89,475 ETH and 1.26 billion USDT among 37 assets. On that date, Binance held exactly enough ether to cover customers, a 100% ratio. CoinDesk estimated that roughly 204,500 ETH, about 5.6% of Binance’s ether reserves, left the exchange, which would put ether backing near 94% until Binance replaces it.
That calculation uses a four-week-old snapshot and assumes balances held steady, so treat it as an estimate rather than a measured shortfall. The estimate still changes what “user funds are safe” means. Honoring every customer balance means replacing assets that were stolen, from the Secure Asset Fund for Users or from Binance’s wider balance sheet. The fund, set up in 2018 for security emergencies, holds roughly $1 billion in bitcoin, well below the on-chain estimates, and Binance has not said whether it will draw on it.
DefiLlama data put Binance’s platform assets at roughly $144 billion before the incident, so the $5.7 billion Arkham count would equal about 4%. Wintermute CEO Evgeny Gaevoy said Binance has enough to withstand three to four times the current hit and remain largely intact. Binance’s next reserve snapshot, taken on November 1, will show whether it has replaced the missing assets.
Freezes Reached Stablecoins, Not Ether
Centralized issuers can blacklist addresses, and they did. Circle froze 823 million USDC in the main receiving wallet at 21:04 UTC, about 40 minutes after the first transfer. The attacker then moved toward assets with no issuer. Etherscan records show stolen stablecoins swapped for ether on Uniswap, and CoinDesk reported that the attacker borrowed at least 20,000 WETH, about $44 million, from lender Aave against stolen USDT. Aave temporarily froze its Ethereum V3 lending markets as a precaution and said its smart contracts were unaffected.
Freezing a token blocks it from moving; it does not return it to anyone. Ether and bitcoin have no issuer that can block a transfer. CoinDesk noted that movement through decentralized platforms alone does not show whether funds can still be recovered, so the stablecoin freezes limit the loss without settling its size.
What Exchange Counterparties Should Ask Now
Our take: the technical lesson has to wait for Binance’s post-mortem, because the company has not said which control failed. Two points already hold. A proof-of-reserves report is a snapshot, and this one showed full ether backing four weeks before the wallets were emptied. A coverage pledge is only as strong as the balance sheet behind it, so organizations that hold assets on an exchange have a fair question to ask: what would it replace, from what source, and by when?
Binance has promised a full post-mortem. Three answers will shape how this episode is judged: how the attacker obtained valid signing authority, whether the Bitcoin and Tron outflows belong to the same attack, and the net loss after freezes. Until then, “user funds are safe” stands as Binance’s commitment, and the November 1 reserve snapshot will offer the first public check on it.
The post Binance Hack: “User Funds Are Safe” Now Rests on Binance’s Own Balance Sheet appeared first on DataFLOQ.
