Binance investigates security issue after large transfers from linked wallets

On the evening of October 29, 2026 UTC, large transfers left several wallets labeled as belonging to Binance. Based on on-chain data, Decrypt estimated that at least $5.57 billion moved from Binance-linked wallets across Ethereum, Bitcoin and Tron. This is the publication’s estimate of outflows, not a theft or final loss figure confirmed by Binance.

Binance said its teams were investigating reports of a potential security issue and stated that user funds were safe. In a personal post at 5:15 a.m. Hong Kong time on October 30, Binance founder Changpeng Zhao said it appeared to be a hack. He also wrote that he no longer managed Binance.com but, as a shareholder, expected all user funds to be fully covered.

EIP-7702 is an Ethereum account mechanism that allows an account to authorize delegated code. Lamtzidi said a stolen key or malicious authorization could enable a transfer like this, but how the signature was obtained remained unknown. This is an outside researcher’s analysis, not Binance’s final investigation, and does not establish an attacker’s identity.

CoinDesk reported that Binance 14, one of the labeled wallets, appeared in the company’s October 1 proof-of-reserves data. A proof-of-reserves report is a snapshot at a particular time and cannot on its own establish the exchange’s real-time reserves after the incident.

Binance later announced a temporary suspension of deposits and withdrawals and reported progress freezing related assets. Those measures are covered in the follow-up article. Users should check the latest updates through official Binance channels and beware of unofficial messages asking for passwords or verification codes.