Binance investigates suspected hot wallet breach and transfers

Binance is investigating a suspected breach of its hot wallets that allegedly enabled billions of dollars of unauthorised transfers. The incident began on the evening of 29 October 2026, with the primary Binance 14 hot wallet moving 167,464 ETH and 1.615 billion USDT at 20:24 UTC, followed by further tranches totalling 28,005 ETH and 780 million USDC within minutes.

Independent blockchain observers attributed the activity to anomalous delegation mechanics linked to EIP-7702 account abstraction, with researchers noting that an authorised signature from a Binance wallet at 20:20 UTC allowed a malicious contract to assume control over a large treasury. Although analysts describe the pattern as ongoing, Binance has not formally confirmed theft or full private-key compromise.

In the days that followed, on-chain activity persisted and prompted rapid action from stablecoin issuers. Tether (Paolo Ardoino) confirmed freezing 1.567 billion USDT tied to the illicit addresses, while Circle (Jeremy Allaire) announced blacklisting 800 million USDC in coordination with law enforcement. These steps rely on smart contract controls that halt token movements, though native Ethereum and other decentralised tokens remain beyond unilateral recovery.

Market fallout was swift: Bitcoin dipped toward levels below 79,000 USD and Ethereum retraced, with Binance’s own token (BNB) falling by around 9% at the height of the panic. Binance stated that customer balances remain fully protected, and Binance[.]US reported zero exposure to its domestic infrastructure. Forensic investigations continue to assess whether insider compromise or cryptographic forgery contributed to the event.