Binance Hot Wallets Compromised, Exchange Pledges Full Compensation
Binance’s hot wallets were compromised early on the 30th, with the exchange and co-CEO He Yi stating they will cover all losses, ensuring user funds remain secure. While approximately $3 billion has been confirmed frozen, all deposits and withdrawals remain suspended with no estimated recovery time. This article will be updated with the latest developments.
What Happened
Beginning at 4 AM on the 30th, Binance’s hot wallets across eight blockchains saw assets moved out. On-chain tracker Dickson estimated the total value at approximately $6.28 billion. The Ethereum hot wallet, Binance 14, was emptied in a single transaction at 4:24 AM, representing the largest portion of the loss. The attackers obtained the wallet’s signature, but the method of acquisition remains unknown.
Amount Frozen
Binance announced at 08:52 AM that it had verified the freezing of approximately $3 billion. Dickson estimates that around $3.27 billion remains freely transferable, primarily in Bitcoin and Ether, assets for which there is no issuer to freeze.
Compensation and Recovery
Binance, co-CEO He Yi, and CEO Richard Teng have all assured users that their funds are safe and that Binance will bear all losses. The exchange has not announced any procedures for users to report or register claims, and any links requesting “claim registration” should be treated as scams.
Binance has not provided a timeline for the restoration of deposits and withdrawals, stating only that services will resume as soon as possible after the issue is fully resolved. Spot trading has not been halted and continues to operate normally.
Market Reaction
Bitcoin experienced a flash crash, dropping to a low of approximately $76,760. The fear index fell from 51 to 30. At 09:12 AM, Binance’s BTC/USDT was trading at $77,221, down about 4.6% in 24 hours. Ether was trading around $2,223, and BNB at $703.
The Attack Timeline
- 29th: Attackers first obtained fees from Tornado Cash, deployed a coin-sweeping contract, and practiced in a test wallet.
- 04:04 AM: Hot wallets across eight blockchains began to be drained, starting with XRP. Approximately $6.07 billion was transferred out within 55 minutes.
- 04:24 AM: The Ethereum hot wallet, Binance 14, was emptied in a single transaction.
- 04:57 AM: Hackers borrowed 19,762 ETH from Aave.
- 06:44 AM: Aave froze its V3 and V4 markets.
- 05:05 AM: Tether and Circle began freezing assets, totaling over $2.3 billion in stablecoins.
- 05:21 AM: Bitcoin experienced a flash crash, reaching a low of approximately $76,760.
- 06:15 AM: Binance suspended withdrawals.
- 08:13 AM: Binance pledged to cover all losses and suspended all deposits and withdrawals. He Yi and CZ also confirmed full compensation.
- 08:52 AM: Binance confirmed freezing approximately $3 billion, with the Arbitrum Security Council also intervening.
- 09:01 AM: Hackers sold seven altcoins, converting them into 70,480 ETH.
Frozen Assets
Binance officially stated at 08:52 AM that the total verified frozen amount was approximately $3 billion. The exchange is continuing to work with law enforcement, stablecoin issuers, and on-chain analysis firms to freeze additional assets, and will only release confirmed figures.
ZachXBT’s statistics at 09:01 AM indicated a total of over $2.83 billion frozen, itemized as follows:
- Stablecoins: Approximately 1.768 billion USDT, 823 million USDC, 40.54 million RLUSD, 27.82 million USD1, 6.19 million USDT0, 820,000 XUSD, and 216,000 USDP.
- Other Assets: 29,934 wBETH, approximately 12,574 XAUt, and 1,906.67 PAXG. Additionally, approximately 74.56 million ARB were locked and inaccessible.
The entities responsible for these freezes include:
- Tether: CEO Paolo Ardoino announced at 05:25 AM the freezing of over 1.567 billion USDT. ZachXBT’s later tally reached approximately 1.768 billion USDT.
- Circle: CEO Jeremy Allaire stated at 05:18 AM that over 800 million USDC had been frozen in cooperation with law enforcement.
- Ripple: Froze RLUSD. He Yi thanked them in a post at 06:08 AM, with ZachXBT’s figures indicating approximately 40.54 million.
- World Liberty Financial: Froze 27 million USD1 and 48 million WLFI (approximately $2 million). He Yi expressed gratitude in a post at 06:22 AM.
- Paxos: Froze 1,906.67 PAXG, confirming that Paxos itself was unaffected and its reserves for PAXG, PYUSD, and USDG remain intact. He Yi retweeted thanks at 07:09 AM.
- Arbitrum Security Council: ZachXBT reported at 08:14 AM that the Arbitrum Security Council had executed a transaction freezing approximately $30.5 million. Both CZ and He Yi retweeted their thanks.
Unrecoverable Assets
The primary unrecoverable assets are ETH. As there is no issuer for ETH on the Ethereum mainnet, no one can freeze it, leading attackers to convert potentially frozen assets into ETH. The known ETH holdings of the attackers are in three batches:
- Transferred out at 04:39 AM: 195,460 ETH.
- Borrowed from Aave: Attackers used 60 million USDT as collateral to borrow 19,762 ETH. Aave subsequently froze its V3 and V4 DAO markets at 06:44 AM, though withdrawals and repayments continued as normal.
- Exchanged for altcoins: Lookonchain reported at 09:01 AM that attackers had sold UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD, converting them into 70,480 ETH (approximately $158 million).
The combined total of these three batches is approximately 286,000 ETH. At an ETH price of $2,223 on 09:12 AM, this amounts to roughly $635 million. This is a rough estimate based on publicly available figures and does not include the at least 5,160 ETH swept from the wallet before the cancellation of orders at 08:10 AM.
Recovery Timeline and Scope
Binance has not provided a specific date for the restoration of services, stating only that it will resume “as soon as possible after the issue is fully resolved.”
The scope of the suspension has evolved:
- 06:15 AM: Binance announced it was conducting security checks and that withdrawals would resume after the issue was fully resolved.
- 07:06 AM: Binance Alpha trading was suspended, including fiat-to-crypto purchases using spot wallet funds, Alpha instant trading, and prediction market purchases.
- 08:13 AM: The suspension was expanded to include all deposits and withdrawals.
Spot trading has remained operational. As of 09:12 AM, Binance’s public API indicated that BTC/USDT spot trading was still active, and the exchange’s operational status API reported “normal.”
Precedents
In a similar incident on September 24th, Bitget’s hot wallets were compromised. Withdrawals were partially reopened four days later on September 28th, with full recovery on October 2nd, implemented in phases across different blockchains. Following the 2019 Binance hack, deposits and withdrawals were suspended for about a week. Given the significantly larger scale of the current incident, a phased reopening by Binance is anticipated.
Technical Details of the Attack
The stolen assets were not limited to Ethereum. On-chain tracker Dickson reported that the attack began at 04:04 AM with XRP, and assets from Binance’s hot wallets across eight blockchains were progressively moved out, with $6.07 billion transferred in 55 minutes, totaling approximately $6.28 billion. Ethereum accounted for the largest portion at around $3.74 billion, followed by Bitcoin at approximately $1.47 billion, with Tron, XRP, and Solana also affected.
The primary target was the hot wallet labeled “Binance 14” on Etherscan, which has processed over 31 million transactions and is one of Binance’s most frequently used hot wallets.
The attack utilized EIP-7702, a feature introduced with Ethereum’s 2025 upgrade that allows a standard wallet to delegate control to a smart contract, requiring the wallet’s private key for signature confirmation.
- Preparation: On the 28th, the attacker’s address received 0.1 ETH from the mixer Tornado Cash for transaction fees. On-chain records show the address deployed its first coin-sweeping contract at 10:28 AM on the 29th. It then conducted practice runs of EIP-7702 delegation and sweeping in two test wallets from 9:51 PM, before deploying the final contract at 11:59 PM, approximately four hours and 20 minutes before targeting Binance.
- Delegation: At 04:20:59 AM on the 30th, a transaction used EIP-7702 to delegate Binance 14 to the attacker’s contract. On-chain analyst Detective Pho noted that this transaction included 50 pre-signed delegation signatures, corresponding to the next 50 transaction serial numbers, making it difficult for Binance to immediately revoke. These signatures would have required the private key of Binance 14.
- Emptying: At 04:24:23 AM, the contract emptied Binance 14 in a single transaction, including 167,464 ETH and 63 other tokens, among which was 1.615 billion USDT. The transaction, which moved billions of dollars, incurred a fee of approximately $0.93. At 04:24:47 AM, another hot wallet, Binance 16, transferred 28,005.6 ETH to the same address. On-chain records indicate this was a standard transfer signed by Binance 16 itself, without using EIP-7702.
- Delayed Revocation: Following the emptying, the attacker’s contract remained active on Binance 14, and in the subsequent hours, it continued to sweep funds flowing into the wallet. One transaction at 07:56 AM swept approximately 2,962 ETH, bringing the total swept to at least 5,160 ETH. It was not until 08:10 AM that Binance 14 sent a transaction to revoke the delegation. Currently, no delegations are active on this wallet.
The list of stolen assets, as calculated by CryptoTicker based on Etherscan data at 05:15 AM Taipei time, includes:
- Stablecoins: 1.615 billion USDT, 780 million USDC, approximately 62.6 million RLUSD, and approximately 27.7 million USD1.
- ETH and Derivatives: Approximately 195,000 ETH (valued at $442 million), 29,934 wBETH (valued at $74.6 million), and XAUt worth $45.6 million.
- Other Tokens: UNI worth $41.2 million, ENA worth $37 million, PEPE worth $35.3 million, LINK worth $25 million, and AAVE worth $16.2 million.
Final Loss Calculation and Attribution
There are varying estimates for the total outflow: Etherscan’s main address shows approximately $2.8 billion, Walter Bloomberg reported around $2.77 billion across five chains, The Block cited Arkham at approximately $3.55 billion, Lookonchain stated over $5.8 billion, and on-chain tracker Dickson estimated a total of about $6.28 billion across eight chains. Binance has not yet released an official figure for the total loss.
The origin of the signatures remains a subject of speculation, with three main theories: the compromise of the hot wallet’s private key, manipulation of the exchange’s signing process to approve fraudulent instructions (similar to the Bybit hack in 2025), or involvement of internal personnel.
Security firm Defimon has classified this incident as “abuse of EIP-7702 delegation following private key compromise.” Furthermore, the standard transfer from Binance 16 indicates that signatures from more than just Binance 14 were utilized. None of these theories have been confirmed, and Binance has yet to provide an explanation.
Binance’s $1 billion SAFU fund has been fully converted to BTC, now holding 15,000 Bitcoin. CZ praised the move.
Bybit exchange was hacked, with an abnormal transfer of $1.47 billion in ETH. The exchange stated that withdrawals remain normal.
EIP-7702 saw its first large-scale practical failure, with QNT and ETH stolen, and the Pectra account abstraction mechanism becoming a phishing target.
South Korean exchange Upbit was hacked for $30.4 million. Its parent company, Dunamu, recently acquired by Naver, has pledged full compensation.
