{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far · updates",
  "home_page_url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026",
  "feed_url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026/feed.json",
  "description": "On Oct 29 2026 at about 20:24 UTC, more than $2B in ETH and tokens left Binance hot wallets (labeled Binance 14 and Binance 16 on Etherscan) for an address created that day, according to Etherscan data reported by BeInCrypto. The transfer was triggered by a wallet funded only through Tornado Cash, and the receiving address quickly forwarded about 195,460 ETH (around $450M) to another fresh address. Binance says it is aware of reports of a potential security issue, is actively investigating and that user funds are completely safe; it has not confirmed a breach or a loss total. Founder CZ, who no longer runs Binance, said it does look like a hack and that he expects all user funds to be fully covered. Tether CEO Paolo Ardoino said Tether froze more than 1.567B USDT tied to a potential Binance exchange hack, and Circle CEO Jeremy Allaire said Circle froze more than 800M USDC in coordination with law enforcement; Binance co-founder Yi He later thanked Ripple for freezing about 200 million more. Blockaid says the attacker used an EIP-7702 authorization to turn the Binance 14 hot wallet into a sweeper contract only the attacker can drain. Binance later paused withdrawals, saying they will resume once the security issue is fully resolved, and CZ said the loss might be a bit higher than the roughly $1B left after freezes but will be covered. World Liberty Financial froze $27M in USD1 linked to the hack. Binance.US says it is a separate platform and is not affected. If confirmed, it would be the largest exchange hack on record. Binance then said the current verified total frozen is $2.54 billion and suspended Binance Alpha trading, and co-founder Yi He said Binance will cover all hacking losses, that deposits and withdrawals are temporarily suspended during security checks, and that a full post-mortem will follow; Binance's official account repeated that Binance will cover all losses and that all deposits and withdrawals are suspended. The Arbitrum Security Council moved 74,559,805 ARB and 8,425 ETH held by an exploit-linked Arbitrum One address into a frozen wallet. Binance users have nothing to patch: watch for official updates only through Binance's own channels and ignore unofficial links or requests for account details, which Binance warns are circulating.",
  "language": "en",
  "_pwn": {
    "slug": "binance-hot-wallet-outflow-suspected-hack-oct-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-30-be6a553e",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-30-be6a553e",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: The Arbitrum Security Council says it took emergency action to move 74,559,805 ARB and 8,425 ETH held by an Arbitrum One address connected to the Binance exploit into a frozen intermediary wallet, movable only by the Security Council or an Arbitrum DAO vote.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: The Arbitrum Security Council says it took emergency action to move 74,559,805 ARB and 8,425 ETH held by an Arbitrum One address connected to the Binance exploit into a frozen intermediary wallet, movable only by the Security Council or an Arbitrum DAO vote.\n\nSource: https://x.com/arbitrum/status/2115961730920841644",
      "date_published": "2026-10-30T00:19:00.000Z",
      "external_url": "https://x.com/arbitrum/status/2115961730920841644",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-30-a08c0c6b",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-30-a08c0c6b",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: On-chain investigator ZachXBT says the attacker is likely North Korea's Lazarus Group; Binance has not confirmed any attribution.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: On-chain investigator ZachXBT says the attacker is likely North Korea's Lazarus Group; Binance has not confirmed any attribution.\n\nSource: https://x.com/zachxbt/status/2115961279454269522",
      "date_published": "2026-10-30T00:17:00.000Z",
      "external_url": "https://x.com/zachxbt/status/2115961279454269522",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-30-a622d8e1",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-30-a622d8e1",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance's official account says Binance will cover all losses, that all deposits and withdrawals are temporarily suspended while it runs security checks, freezes funds and works with law enforcement, and that a full post-mortem will follow.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance's official account says Binance will cover all losses, that all deposits and withdrawals are temporarily suspended while it runs security checks, freezes funds and works with law enforcement, and that a full post-mortem will follow.\n\nSource: https://x.com/binance/status/2115960292115124558",
      "date_published": "2026-10-30T00:13:00.000Z",
      "external_url": "https://x.com/binance/status/2115960292115124558",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-30-e660f3af",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-30-e660f3af",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance co-founder Yi He says Binance will cover all hacking losses, that deposits and withdrawals are temporarily suspended during security checks, and that a full post-mortem will follow the investigation.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance co-founder Yi He says Binance will cover all hacking losses, that deposits and withdrawals are temporarily suspended during security checks, and that a full post-mortem will follow the investigation.\n\nSource: https://x.com/heyibinance/status/2115958049244631357",
      "date_published": "2026-10-30T00:04:00.000Z",
      "external_url": "https://x.com/heyibinance/status/2115958049244631357",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-dc7fd226",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-dc7fd226",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance says the current verified total frozen is $2.54 billion, correcting lower figures such as $1.8 billion, and that it may grow as it works with law enforcement, issuers and blockchain intelligence firms.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance says the current verified total frozen is $2.54 billion, correcting lower figures such as $1.8 billion, and that it may grow as it works with law enforcement, issuers and blockchain intelligence firms.\n\nSource: https://x.com/binance/status/2115947325617299903",
      "date_published": "2026-10-29T23:22:00.000Z",
      "external_url": "https://x.com/binance/status/2115947325617299903",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-2c3bdcc1",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-2c3bdcc1",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance temporarily suspends Binance Alpha trading as part of its security measures, saying trading will resume once the security issue is resolved.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance temporarily suspends Binance Alpha trading as part of its security measures, saying trading will resume once the security issue is resolved.\n\nSource: https://x.com/binance/status/2115943482204574108",
      "date_published": "2026-10-29T23:06:00.000Z",
      "external_url": "https://x.com/binance/status/2115943482204574108",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-a0647d5c",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-a0647d5c",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: BleepingComputer reports that Arkham Intelligence is tracking 55 addresses under an entity labeled binance-hacker-1029 holding about $5.78B (about $1.77B USDT, $1.44B BTC, $876M ETH and $823M USDC), a holdings figure rather than a confirmed amount stolen. Etherscan labels the first receiving address Binance Hot Wallet Exploiter 2. Binance has not confirmed whether the transfers were unauthorized, how it happened or the total loss.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: BleepingComputer reports that Arkham Intelligence is tracking 55 addresses under an entity labeled binance-hacker-1029 holding about $5.78B (about $1.77B USDT, $1.44B BTC, $876M ETH and $823M USDC), a holdings figure rather than a confirmed amount stolen. Etherscan labels the first receiving address Binance Hot Wallet Exploiter 2. Binance has not confirmed whether the transfers were unauthorized, how it happened or the total loss.\n\nSource: https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/",
      "date_published": "2026-10-29T22:45:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-9d62af1b",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-9d62af1b",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Replying to an estimate that the loss after the Tether and Circle freezes is about $1B, CZ says the loss might be a bit higher than that but will be covered.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Replying to an estimate that the loss after the Tether and Circle freezes is about $1B, CZ says the loss might be a bit higher than that but will be covered.\n\nSource: https://x.com/cz_binance/status/2115932500006756686",
      "date_published": "2026-10-29T22:23:00.000Z",
      "external_url": "https://x.com/cz_binance/status/2115932500006756686",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-1347c05e",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-1347c05e",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance says its team is conducting security checks and withdrawals will resume as soon as the security issue is fully resolved; user funds remain safe. USD1 (World Liberty Financial) says it froze $27M in USD1 associated with the Binance hack.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance says its team is conducting security checks and withdrawals will resume as soon as the security issue is fully resolved; user funds remain safe. USD1 (World Liberty Financial) says it froze $27M in USD1 associated with the Binance hack.\n\nSource: https://x.com/binance/status/2115930656589119995",
      "date_published": "2026-10-29T22:15:00.000Z",
      "external_url": "https://x.com/binance/status/2115930656589119995",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-dd466a51",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-dd466a51",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance co-founder Yi He thanks Ripple for freezing about 200 million and repeats that user funds are safe.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance co-founder Yi He thanks Ripple for freezing about 200 million and repeats that user funds are safe.\n\nSource: https://x.com/heyibinance/status/2115928691045982577",
      "date_published": "2026-10-29T22:08:00.000Z",
      "external_url": "https://x.com/heyibinance/status/2115928691045982577",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-de5864ad",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-de5864ad",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Blockaid says the hot wallet labeled Binance 14 was upgraded through an EIP-7702 authorization to an unverified sweeper contract that only the attacker's operator address can drain, so funds sent to that wallet keep getting swept. The attacker sprayed 50 authorizations for different nonces in one transaction, and one landed.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Blockaid says the hot wallet labeled Binance 14 was upgraded through an EIP-7702 authorization to an unverified sweeper contract that only the attacker's operator address can drain, so funds sent to that wallet keep getting swept. The attacker sprayed 50 authorizations for different nonces in one transaction, and one landed.\n\nSource: https://x.com/blockaid_/status/2115924317888495661",
      "date_published": "2026-10-29T21:50:00.000Z",
      "external_url": "https://x.com/blockaid_/status/2115924317888495661",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-eb6f49e2",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-eb6f49e2",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: The Block reports about $3.55B in incoming transfers to the receiving wallet, with nearly $900M moved on to other wallets, and Blockaid says it is investigating about $3.3B in suspicious outflows from Binance hot wallets across Ethereum, Arbitrum and Avalanche. Binance still has not publicly confirmed a breach.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: The Block reports about $3.55B in incoming transfers to the receiving wallet, with nearly $900M moved on to other wallets, and Blockaid says it is investigating about $3.3B in suspicious outflows from Binance hot wallets across Ethereum, Arbitrum and Avalanche. Binance still has not publicly confirmed a breach.\n\nSource: https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171",
      "date_published": "2026-10-29T21:49:00.000Z",
      "external_url": "https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-0a3ff878",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-0a3ff878",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance.US says it is a separate, independent platform, is not affected by the reported Binance.com security incident, and that its customer funds and services are operating normally.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance.US says it is a separate, independent platform, is not affected by the reported Binance.com security incident, and that its customer funds and services are operating normally.\n\nSource: https://x.com/BinanceUS/status/2115922119972491559",
      "date_published": "2026-10-29T21:41:00.000Z",
      "external_url": "https://x.com/BinanceUS/status/2115922119972491559",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-99618f62",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-99618f62",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance updates its statement to say user funds are completely safe and warns users not to trust unofficial links, messages or requests for account information.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance updates its statement to say user funds are completely safe and warns users not to trust unofficial links, messages or requests for account information.\n\nSource: https://x.com/binance/status/2115918888429133902",
      "date_published": "2026-10-29T21:29:00.000Z",
      "external_url": "https://x.com/binance/status/2115918888429133902",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-0d1d92f3",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-0d1d92f3",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Tether CEO Paolo Ardoino says Tether froze more than 1.567B USDT related to a potential Binance exchange hack.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Tether CEO Paolo Ardoino says Tether froze more than 1.567B USDT related to a potential Binance exchange hack.\n\nSource: https://x.com/paoloardoino/status/2115918000373346709",
      "date_published": "2026-10-29T21:25:00.000Z",
      "external_url": "https://x.com/paoloardoino/status/2115918000373346709",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-fd1dd8ad",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-fd1dd8ad",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Circle CEO Jeremy Allaire says Circle, in coordination with law enforcement, froze more than 800M USDC associated with the incident.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Circle CEO Jeremy Allaire says Circle, in coordination with law enforcement, froze more than 800M USDC associated with the incident.\n\nSource: https://x.com/jerallaire/status/2115916207463481846",
      "date_published": "2026-10-29T21:18:00.000Z",
      "external_url": "https://x.com/jerallaire/status/2115916207463481846",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-7e2f1598",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-7e2f1598",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance says its teams are aware of reports of a potential security issue and are actively investigating, and will post updates through official channels. CZ says it does look like a hack on Binance and thanks Tether and Circle for freezing funds.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Binance says its teams are aware of reports of a potential security issue and are actively investigating, and will post updates through official channels. CZ says it does look like a hack on Binance and thanks Tether and Circle for freezing funds.\n\nSource: https://x.com/binance/status/2115915483832832425",
      "date_published": "2026-10-29T21:15:00.000Z",
      "external_url": "https://x.com/binance/status/2115915483832832425",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-5b2cc913",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-5b2cc913",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: One transaction moves 167,464 ETH (about $388M) and 63 tokens, including roughly $1.6B in USDT, out of the hot wallet labeled Binance 14 to a brand-new address; Binance 16 sends another 28,005 ETH 24 seconds later. The transfer is triggered by a wallet funded only through Tornado Cash.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: One transaction moves 167,464 ETH (about $388M) and 63 tokens, including roughly $1.6B in USDT, out of the hot wallet labeled Binance 14 to a brand-new address; Binance 16 sends another 28,005 ETH 24 seconds later. The transfer is triggered by a wallet funded only through Tornado Cash.\n\nSource: https://beincrypto.com/is-binance-being-hacked-customer-funds/",
      "date_published": "2026-10-29T20:24:00.000Z",
      "external_url": "https://beincrypto.com/is-binance-being-hacked-customer-funds/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-e7d5c0d2",
      "url": "https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026#2026-10-29-e7d5c0d2",
      "title": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Within 15 minutes the receiving address forwards 195,460 ETH (about $450M) to another fresh address while still holding about $1.5B in tokens.",
      "content_text": "Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far: Within 15 minutes the receiving address forwards 195,460 ETH (about $450M) to another fresh address while still holding about $1.5B in tokens.\n\nSource: https://beincrypto.com/is-binance-being-hacked-customer-funds/",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://beincrypto.com/is-binance-being-hacked-customer-funds/",
      "tags": [
        "critical"
      ]
    }
  ]
}