# Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far · pwn.watch > On Oct 29 2026 at about 20:24 UTC, more than $2B in ETH and tokens left Binance hot wallets (labeled Binance 14 and Binance 16 on Etherscan) for an address created that day, according to Etherscan data reported by BeInCrypto. The transfer was triggered by a wallet funded only through Tornado Cash, and the receiving address quickly forwarded about 195,460 ETH (around $450M) to another fresh address. Binance says it is aware of reports of a potential security issue, is actively investigating and that user funds are completely safe; it has not confirmed a breach or a loss total. Founder CZ, who no longer runs Binance, said it does look like a hack and that he expects all user funds to be fully covered. Tether CEO Paolo Ardoino said Tether froze more than 1.567B USDT tied to a potential Binance exchange hack, and Circle CEO Jeremy Allaire said Circle froze more than 800M USDC in coordination with law enforcement; Binance co-founder Yi He later thanked Ripple for freezing about 200 million more. Blockaid says the attacker used an EIP-7702 authorization to turn the Binance 14 hot wallet into a sweeper contract only the attacker can drain. Binance later paused withdrawals, saying they will resume once the security issue is fully resolved, and CZ said the loss might be a bit higher than the roughly $1B left after freezes but will be covered. World Liberty Financial froze $27M in USD1 linked to the hack. Binance.US says it is a separate platform and is not affected. If confirmed, it would be the largest exchange hack on record. Binance then said the current verified total frozen is $2.54 billion and suspended Binance Alpha trading, and co-founder Yi He said Binance will cover all hacking losses, that deposits and withdrawals are temporarily suspended during security checks, and that a full post-mortem will follow; Binance's official account repeated that Binance will cover all losses and that all deposits and withdrawals are suspended. The Arbitrum Security Council moved 74,559,805 ARB and 8,425 ETH held by an exploit-linked Arbitrum One address into a frozen wallet. Binance users have nothing to patch: watch for official updates only through Binance's own channels and ignore unofficial links or requests for account details, which Binance warns are circulating. Page: https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026 · generated 2026-10-30T00:34:54.267Z ## Status - Severity: critical · status: live · patch: partial - Product: Binance (exchange hot wallets) - Started: 2026-10-29 - Affected: Binance exchange hot wallets (Binance 14 and Binance 16 on Ethereum, per Etherscan labels) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026.json - This file: https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026/llms.txt ## Updates (newest first) - 2026-10-30T00:19Z: The Arbitrum Security Council says it took emergency action to move 74,559,805 ARB and 8,425 ETH held by an Arbitrum One address connected to the Binance exploit into a frozen intermediary wallet, movable only by the Security Council or an Arbitrum DAO vote. (https://x.com/arbitrum/status/2115961730920841644) - 2026-10-30T00:17Z: On-chain investigator ZachXBT says the attacker is likely North Korea's Lazarus Group; Binance has not confirmed any attribution. (https://x.com/zachxbt/status/2115961279454269522) - 2026-10-30T00:13Z: Binance's official account says Binance will cover all losses, that all deposits and withdrawals are temporarily suspended while it runs security checks, freezes funds and works with law enforcement, and that a full post-mortem will follow. (https://x.com/binance/status/2115960292115124558) - 2026-10-30T00:04Z: Binance co-founder Yi He says Binance will cover all hacking losses, that deposits and withdrawals are temporarily suspended during security checks, and that a full post-mortem will follow the investigation. (https://x.com/heyibinance/status/2115958049244631357) - 2026-10-29T23:22Z: Binance says the current verified total frozen is $2.54 billion, correcting lower figures such as $1.8 billion, and that it may grow as it works with law enforcement, issuers and blockchain intelligence firms. (https://x.com/binance/status/2115947325617299903) - 2026-10-29T23:06Z: Binance temporarily suspends Binance Alpha trading as part of its security measures, saying trading will resume once the security issue is resolved. (https://x.com/binance/status/2115943482204574108) - 2026-10-29T22:45Z: BleepingComputer reports that Arkham Intelligence is tracking 55 addresses under an entity labeled binance-hacker-1029 holding about $5.78B (about $1.77B USDT, $1.44B BTC, $876M ETH and $823M USDC), a holdings figure rather than a confirmed amount stolen. Etherscan labels the first receiving address Binance Hot Wallet Exploiter 2. Binance has not confirmed whether the transfers were unauthorized, how it happened or the total loss. (https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/) - 2026-10-29T22:23Z: Replying to an estimate that the loss after the Tether and Circle freezes is about $1B, CZ says the loss might be a bit higher than that but will be covered. (https://x.com/cz_binance/status/2115932500006756686) - 2026-10-29T22:15Z: Binance says its team is conducting security checks and withdrawals will resume as soon as the security issue is fully resolved; user funds remain safe. USD1 (World Liberty Financial) says it froze $27M in USD1 associated with the Binance hack. (https://x.com/binance/status/2115930656589119995) - 2026-10-29T22:08Z: Binance co-founder Yi He thanks Ripple for freezing about 200 million and repeats that user funds are safe. (https://x.com/heyibinance/status/2115928691045982577) - 2026-10-29T21:50Z: Blockaid says the hot wallet labeled Binance 14 was upgraded through an EIP-7702 authorization to an unverified sweeper contract that only the attacker's operator address can drain, so funds sent to that wallet keep getting swept. The attacker sprayed 50 authorizations for different nonces in one transaction, and one landed. (https://x.com/blockaid_/status/2115924317888495661) - 2026-10-29T21:49Z: The Block reports about $3.55B in incoming transfers to the receiving wallet, with nearly $900M moved on to other wallets, and Blockaid says it is investigating about $3.3B in suspicious outflows from Binance hot wallets across Ethereum, Arbitrum and Avalanche. Binance still has not publicly confirmed a breach. (https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171) - 2026-10-29T21:41Z: Binance.US says it is a separate, independent platform, is not affected by the reported Binance.com security incident, and that its customer funds and services are operating normally. (https://x.com/BinanceUS/status/2115922119972491559) - 2026-10-29T21:29Z: Binance updates its statement to say user funds are completely safe and warns users not to trust unofficial links, messages or requests for account information. (https://x.com/binance/status/2115918888429133902) - 2026-10-29T21:25Z: Tether CEO Paolo Ardoino says Tether froze more than 1.567B USDT related to a potential Binance exchange hack. (https://x.com/paoloardoino/status/2115918000373346709) - 2026-10-29T21:18Z: Circle CEO Jeremy Allaire says Circle, in coordination with law enforcement, froze more than 800M USDC associated with the incident. (https://x.com/jerallaire/status/2115916207463481846) - 2026-10-29T21:15Z: Binance says its teams are aware of reports of a potential security issue and are actively investigating, and will post updates through official channels. CZ says it does look like a hack on Binance and thanks Tether and Circle for freezing funds. (https://x.com/binance/status/2115915483832832425) - 2026-10-29T20:24Z: One transaction moves 167,464 ETH (about $388M) and 63 tokens, including roughly $1.6B in USDT, out of the hot wallet labeled Binance 14 to a brand-new address; Binance 16 sends another 28,005 ETH 24 seconds later. The transfer is triggered by a wallet funded only through Tornado Cash. (https://beincrypto.com/is-binance-being-hacked-customer-funds/) - 2026-10-29: Within 15 minutes the receiving address forwards 195,460 ETH (about $450M) to another fresh address while still holding about $1.5B in tokens. (https://beincrypto.com/is-binance-being-hacked-customer-funds/) ## Fix brief # Security brief: Binance says it will cover all hacking losses after billions leave its hot wallets; $2.54B frozen so far Source: https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026 · status: live · severity: critical · updated Oct 30, 2026, 00:33 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is On Oct 29 2026 at about 20:24 UTC, more than $2B in ETH and tokens left Binance hot wallets (labeled Binance 14 and Binance 16 on Etherscan) for an address created that day, according to Etherscan data reported by BeInCrypto. The transfer was triggered by a wallet funded only through Tornado Cash, and the receiving address quickly forwarded about 195,460 ETH (around $450M) to another fresh address. Binance says it is aware of reports of a potential security issue, is actively investigating and that user funds are completely safe; it has not confirmed a breach or a loss total. Founder CZ, who no longer runs Binance, said it does look like a hack and that he expects all user funds to be fully covered. Tether CEO Paolo Ardoino said Tether froze more than 1.567B USDT tied to a potential Binance exchange hack, and Circle CEO Jeremy Allaire said Circle froze more than 800M USDC in coordination with law enforcement; Binance co-founder Yi He later thanked Ripple for freezing about 200 million more. Blockaid says the attacker used an EIP-7702 authorization to turn the Binance 14 hot wallet into a sweeper contract only the attacker can drain. Binance later paused withdrawals, saying they will resume once the security issue is fully resolved, and CZ said the loss might be a bit higher than the roughly $1B left after freezes but will be covered. World Liberty Financial froze $27M in USD1 linked to the hack. Binance.US says it is a separate platform and is not affected. If confirmed, it would be the largest exchange hack on record. Binance then said the current verified total frozen is $2.54 billion and suspended Binance Alpha trading, and co-founder Yi He said Binance will cover all hacking losses, that deposits and withdrawals are temporarily suspended during security checks, and that a full post-mortem will follow; Binance's official account repeated that Binance will cover all losses and that all deposits and withdrawals are suspended. The Arbitrum Security Council moved 74,559,805 ARB and 8,425 ETH held by an exploit-linked Arbitrum One address into a frozen wallet. Binance users have nothing to patch: watch for official updates only through Binance's own channels and ignore unofficial links or requests for account details, which Binance warns are circulating. Severity detail: Deposits and withdrawals suspended; more than $2B moved out of Binance hot wallets per Etherscan data; Binance says $2.54B is frozen so far and co-founder Yi He says Binance will cover all hacking losses; no official loss total yet - Product: Binance (exchange hot wallets) ## Affected versions - Binance exchange hot wallets (Binance 14 and Binance 16 on Ethereum, per Etherscan labels) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Binance official (Oct 30 00:13Z) says it will cover all losses, deposits+withdrawals suspended; Arbitrum Security Council froze 74.56M ARB + 8,425 ETH (00:19Z). Yi He (Oct 30 00:04Z) says Binance will cover all hacking losses and promises a post-mortem; Binance says verified total frozen is $2.54B (23:22Z). No official loss total or root cause yet; it says user funds are safe. Loss figures on X range from $2B to $5.6B (an Arkham entity is labeled Binance-hacker-1029) and are unverified; only cite BeInCrypto's Etherscan figures and the issuers' own freeze amounts. Tether first froze about $971M (per CZ), later more than 1.567B USDT per Ardoino. ZachXBT (00:17Z) says likely Lazarus Group, unconfirmed attribution. Re-check Binance's official channels for confirmation, root cause (key compromise was suggested by Tree News, unconfirmed), loss total and reimbursement; set patchStatus to patched once Binance confirms the wallets are secured. ## Latest updates - Oct 30, 2026: Binance co-founder Yi He says Binance will cover all hacking losses, that deposits and withdrawals are temporarily suspended during security checks, and that a full post-mortem will follow the investigation. - Oct 30, 2026: Binance's official account says Binance will cover all losses, that all deposits and withdrawals are temporarily suspended while it runs security checks, freezes funds and works with law enforcement, and that a full post-mortem will follow. - Oct 30, 2026: The Arbitrum Security Council says it took emergency action to move 74,559,805 ARB and 8,425 ETH held by an Arbitrum One address connected to the Binance exploit into a frozen intermediary wallet, movable only by the Security Council or an Arbitrum DAO vote. - Oct 30, 2026: On-chain investigator ZachXBT says the attacker is likely North Korea's Lazarus Group; Binance has not confirmed any attribution. - Oct 29, 2026: One transaction moves 167,464 ETH (about $388M) and 63 tokens, including roughly $1.6B in USDT, out of the hot wallet labeled Binance 14 to a brand-new address; Binance 16 sends another 28,005 ETH 24 seconds later. The transfer is triggered by a wallet funded only through Tornado Cash. - Oct 29, 2026: Within 15 minutes the receiving address forwards 195,460 ETH (about $450M) to another fresh address while still holding about $1.5B in tokens. - Oct 29, 2026: Binance says its teams are aware of reports of a potential security issue and are actively investigating, and will post updates through official channels. CZ says it does look like a hack on Binance and thanks Tether and Circle for freezing funds. - Oct 29, 2026: Circle CEO Jeremy Allaire says Circle, in coordination with law enforcement, froze more than 800M USDC associated with the incident. ## Advisories - [Binance: Binance will cover all losses; deposits and withdrawals temporarily suspended](https://x.com/binance/status/2115960292115124558) (Binance) - [Arbitrum Security Council moves exploit-linked ARB and ETH to a frozen wallet](https://x.com/arbitrum/status/2115961730920841644) (Arbitrum) - [Yi He: Binance will cover all hacking losses; deposits and withdrawals suspended](https://x.com/heyibinance/status/2115958049244631357) (Binance) - [Binance statement on reports of a potential security issue](https://x.com/binance/status/2115918888429133902) (Binance) ## Write-ups & news - [Binance probes potential $5.8 billion crypto-theft hack](https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/) - [Binance investigating hack as suspicious outflows reach up to $5.8 billion](https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171) - [Is Binance Being Hacked? $2 Billion Outflow Puts Customer Funds in Question](https://beincrypto.com/is-binance-being-hacked-customer-funds/) - [Tether freezes $971M USDT linked to suspected Binance hack](https://cryptobriefing.com/tether-freezes-971m-usdt-binance-hack/) - [Over $5B drained from Binance in apparent hack](https://news.ycombinator.com/item?id=50296272) --- Machine-readable: https://pwn.watch/i/binance-hot-wallet-outflow-suspected-hack-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.