.png){kind=logo}
Quick overview
This is some text inside of a div block.
The Binance hack of October 29, 2026 is, on Binance's own estimate, the largest crypto theft reported to date. Binance estimates the total impact at around $6.3B, with around $3B frozen on-chain so far, and has committed to covering all user losses. Scorechain's investigators are tracing the outflows across 10 blockchains, from the first transfer on the XRP Ledger to the Ethereum sweep minutes later. The investigation is ongoing and figures will change.
This analysis sets out what is known so far: how the attack unfolded, where the funds sit, what compliance teams should do now, and what remains unconfirmed. All on-chain figures are a snapshot as of 04:50 UTC on October 30, 2026.
An attacker submitted unauthorised withdrawals from Binance hot wallets across 10 blockchains, starting at about 20:05 UTC. Binance's initial investigation points to a compromised DevOps engineer's laptop that gave the attacker access to a service container. Binance reports no evidence of a wallet private key leak and has promised a full technical post-mortem.
Attribution is unconfirmed. Binance says it is working with law enforcement to identify those responsible. Some security researchers have publicly suggested a state-linked group, but neither Binance nor any law enforcement agency has confirmed this.
Binance estimates the total impact at around $6.3B, which would make this the largest crypto theft reported to date. Public on-chain reporting puts the largest outflows on Ethereum (about $3.74B), Bitcoin (about $1.47B), Tron (about $628M), the XRP Ledger (about $296M), and Solana (about $96M), with smaller amounts on several other networks. Figures vary slightly between sources depending on when assets are priced.
The drain ran across chains in a tight sequence, which points to a prepared operation. Times below are UTC on October 29, 2026, from Scorechain on-chain data and public reporting.
A hot wallet is an exchange wallet whose keys are kept online so it can process customer withdrawals quickly. That convenience is also its exposure: anyone who can get the exchange's systems to sign a transaction can move its funds.
On Ethereum, the attacker used EIP-7702. This standard lets an ordinary wallet delegate its behaviour to smart contract code through a signed authorisation. Once the Binance 14 wallet was delegated to the attacker's contract, a single call could sweep its entire balance, tokens included.
The authorisations carry valid signatures for Binance 14. That fits Binance's account of unauthorised transactions submitted through a compromised internal service, rather than a stolen private key. On the other nine chains, funds left through ordinary signed transfers within the same half hour. Binance's post-mortem should confirm the full attack path.
The Binance hack funds landed in a small number of new addresses within minutes. Stablecoins have since been largely frozen by their issuers, while native assets (BTC, ETH, XRP, and SOL) remain outside issuer control. Based on public on-chain reporting:
Only issuer-controlled tokens such as USDT and USDC can be frozen, and those freezes account for most of the value now immobilised. Binance puts the verified frozen total at around $3B, close to half of the estimated impact. Tether's CEO Paolo Ardoino confirmed a freeze of more than 1.5B USDT, and Circle's CEO Jeremy Allaire confirmed more than 800M USDC frozen in coordination with law enforcement. Smaller freezes on the RLUSD and USD1 stablecoins have also been reported.
Public reporting indicates the attacker tried to convert part of the USDT and smaller token holdings before blacklisting took effect, including through decentralised exchanges. Any wallet that bought or received these funds now carries exposure to the hack.
The unfrozen native assets are the ones to watch. Their next movements, towards exchanges, swap services, or bridges, will determine how much of the stolen value can still be recovered.
Binance has suffered two major security incidents before October 2026: the May 2019 hot wallet theft of 7,074 BTC and the October 2022 exploit of the BNB Chain cross-chain bridge. The 2026 Binance hack is larger than both combined by an order of magnitude, and it is the first to hit Binance hot wallets across many chains at once.
The next 48 to 72 hours carry the highest risk, because the unfrozen BTC, ETH, XRP, and SOL are likely to start moving towards cash-out points. Virtual asset service providers (VASPs), crypto asset service providers (CASPs), and banks with crypto exposure should act now rather than wait for the post-mortem.
The incident is also a reminder for any VASP or CASP holding client assets: hot wallet balances, signing services, and the internal systems that can submit transactions deserve the same scrutiny as the keys themselves.
Scorechain's investigators are following the Binance hack outflows across chains with the same Digital Asset Intelligence that Scorechain clients use for transaction monitoring and investigations. We will publish further findings in this post as the investigation progresses.
If you need to check your platform's exposure to the Binance hack, or want to see how Scorechain traces stolen funds across chains, book a demo with our team.
Yes. Binance confirmed a security incident on October 29, 2026, in which an attacker submitted unauthorised withdrawals from its hot wallets across 10 blockchains. Binance estimates the impact at around $6.3B, reports around $3B frozen on-chain, and says it will cover all user losses from its SAFU fund and company funds.
No person or group has been officially identified. Binance says it is working with law enforcement to identify those responsible. Some researchers have suggested a state-linked group, but this has not been confirmed by Binance or any authority, and the root cause is still under investigation.
Around $6.3B, according to Binance. Public on-chain reporting shows the largest outflows on Ethereum (about $3.74B), Bitcoin (about $1.47B), Tron (about $628M), the XRP Ledger (about $296M), and Solana (about $96M). Around $3B has been frozen so far, mostly stablecoins.
Binance has faced three major incidents: a 7,074 BTC hot wallet theft in May 2019, an exploit of the BNB Chain cross-chain bridge worth about $570M in October 2022, and the October 2026 hot wallet drain of around $6.3B. The 2022 incident hit the bridge rather than exchange wallets.
Most large exchange hacks target hot wallets, the online wallets that process withdrawals. Attackers compromise keys, signing services, or internal systems that can submit transactions, then move funds to new addresses before freezes take effect. In the Binance hack, Binance points to a compromised internal device, with an EIP-7702 delegation used on Ethereum.
Investigators follow stolen funds on-chain from the victim's wallets to the receiving addresses, then hop by hop as they split, swap, or bridge. Blockchain analytics platforms cluster related addresses, label known services, and flag exposure, so compliance teams can screen deposits against the stolen funds even several hops later.
Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. Deposits operate normally, and Binance expects withdrawals to resume within 48 hours of its latest update. Check official Binance channels for current status.
