Binance investigates suspected crypto hack of up to $5.8B; about $3B frozen, EIP-7702 delegation seen before transfers
Binance is investigating a suspected hack after billions of dollars moved out of exchange-associated wallets on October 29, 2026. Outside estimates of the suspicious transfers range from $3.3 billion (Blockaid) to $5.8 billion (Coinbase's Conor Grogan). If the upper figure were confirmed as stolen, it would be the largest publicly reported crypto theft, above the roughly $1.5 billion Bybit theft of February 2025. Binance has not confirmed the amount stolen. It says user funds are "completely safe" and that about $3 billion has been verified as frozen. No attacker has been publicly identified.
Detalhes técnicos
- Blockaid reported about $3.3B in suspicious outflows across Ethereum, Arbitrum and Avalanche. The estimates come from different stages of the investigation and should not be summed or read as Binance's final loss.
- Investigators found a signed EIP-7702 authorization 3m24s before the first Ethereum transaction. A Binance-labeled wallet then moved 167,464 ETH plus 63 tokens, including 1.615B USDT.
- Phylax Systems founder Odysseas Lamtzidi said the delegation could let smart-contract code execute through the wallet and authorize further transfers.
- How the signature was obtained is unknown. Reporting has not established whether signing credentials or a signing system were compromised, or whether someone was tricked into approving a malicious request. Use of EIP-7702 does not itself indicate a flaw in Ethereum.
- Circle froze more than 800M USDC tied to the incident, in coordination with law enforcement.
- The initial compromise may predate the first recorded transfer.
- The article notes that Bitget reported a hack about a month earlier, with suspected Lazarus Group involvement. It draws no link to the Binance incident.
- Freezing blocks token transfers but does not mean funds have been returned or define the final recovery.
- Binance.US said it was unaffected.
- CZ, who no longer manages Binance, said the activity looked like a hack.
Remediação
- Binance is working with law enforcement, token issuers and blockchain intelligence firms to trace and freeze more assets.
- Customers are told to rely on official Binance announcements and to beware of unofficial links, messages and requests for account information.
Linha do tempo
-
Binance investigates suspected crypto hack of up to $5.8B; about $3B frozen, EIP-7702 delegation seen before transfers
ler a análise desta fonte ocultar
Binance is investigating a suspected hack after billions of dollars moved out of exchange-associated wallets on October 29, 2026. Outside estimates of the suspicious transfers range from $3.3 billion (Blockaid) to $5.8 billion (Coinbase's Conor Grogan). If the upper figure were confirmed as stolen, it would be the largest publicly reported crypto theft, above the roughly $1.5 billion Bybit theft of February 2025. Binance has not confirmed the amount stolen. It says user funds are "completely safe" and that about $3 billion has been verified as frozen. No attacker has been publicly identified.
Technical Details
- Blockaid reported about $3.3B in suspicious outflows across Ethereum, Arbitrum and Avalanche. The estimates come from different stages of the investigation and should not be summed or read as Binance's final loss.
- Investigators found a signed EIP-7702 authorization 3m24s before the first Ethereum transaction. A Binance-labeled wallet then moved 167,464 ETH plus 63 tokens, including 1.615B USDT.
- Phylax Systems founder Odysseas Lamtzidi said the delegation could let smart-contract code execute through the wallet and authorize further transfers.
- How the signature was obtained is unknown. Reporting has not established whether signing credentials or a signing system were compromised, or whether someone was tricked into approving a malicious request. Use of EIP-7702 does not itself indicate a flaw in Ethereum.
- Circle froze more than 800M USDC tied to the incident, in coordination with law enforcement.
- The initial compromise may predate the first recorded transfer.
- The article notes that Bitget reported a hack about a month earlier, with suspected Lazarus Group involvement. It draws no link to the Binance incident.
- Freezing blocks token transfers but does not mean funds have been returned or define the final recovery.
- Binance.US said it was unaffected.
- CZ, who no longer manages Binance, said the activity looked like a hack.
Remediation
- Binance is working with law enforcement, token issuers and blockchain intelligence firms to trace and freeze more assets.
- Customers are told to rely on official Binance announcements and to beware of unofficial links, messages and requests for account information.