Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

The Binance Hack

An independent record of the October 2026 Binance hack

Attack reconstruction: Withdrawal transactions

Back to the overview · Previous stage: Internal movement · Next stage: Per-chain draining

The claims placed under one stage of the attack, each with its source. The quote, the capture time and the hash of the stored copy are on the statement page that each line links to. Which stage a claim sits under is chosen by keywords in its one-line summary, so it is a reading aid and not a finding.

35 approved claims under this stage.

Withdrawal transactions

The transactions by which funds are said to have left the exchange wallets, and how each is said to have been authorised.

  1. Reported root cause

    Blockaid said that eleven Binance hot-wallet keys signed transfers to an address created minutes earlier, and one signed an EIP-7702 authorization.

    blockaid.io. Original Statement 89 Captured .

  2. Reported amount

    Hacken wrote that on the evening of 29 October 2026 an attacker emptied Binance hot wallets on 10 blockchains.

    Hacken. Original Statement 914 Captured .

  3. Official amount

    Binance said in its Security Incident Update #2 that at around 20:05 UTC on 2026-10-29 its hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.

    Timeline row: Binance said its hot wallets were compromised at around 20:05 UTC, a loss of about $6.3B

    Binance, Binance. Original Statement 167 Captured .

  4. Reported amount

    Halborn's table put the loss on Solana at 970,500 SOL, about 96 million dollars, through plain signed transfers.

    Halborn. Original Statement 985 Captured .

  5. Reported root cause

    TRM said the operator submitted a single Ethereum transaction at 20:20 UTC containing 50 authorizations signed by a Binance hot wallet, each pointing to a sweeper contract.

    TRM Labs, TRM Labs. Original Statement 141 Captured .

  6. Reported amount

    Chainalysis said funds began leaving Binance hot wallets around 4:20 p.m. ET on October 29, 2026, and that unauthorized transfers totaled approximately $6.4 billion.

    Timeline row: Chainalysis said funds began leaving Binance hot wallets (stated as around 4:20 p.m. ET)

    Chainalysis, Chainalysis. Original Statement 189 Captured .

  7. Reported amount

    Halborn's table put the loss on Ethereum at about 3.79 billion dollars, made up of 200,630 ETH and 185 tokens, through EIP-7702 delegation on Binance 14 and nine plain signed transfers from Binance 16.

    Halborn. Original Statement 981 Captured .

  8. Reported root cause

    Blockaid said that at 20:20:59 UTC on October 29 the operator sent a transaction to the wallet it calls Binance 14 carrying 50 EIP-7702 authorizations signed with that wallet's key, each delegating the wallet to the sweeper.

    Timeline row: Blockaid said the operator sent a transaction carrying 50 EIP-7702 authorizations to a Binance Ethereum hot wallet

    blockaid.io. Original Statement 106 Captured .

  9. Reported amount

    Halborn's table put the loss on Tron at 612.7 million USDT and 46.4 million TRX, about 628 million dollars, through plain signed transfers from a hot wallet.

    Halborn. Original Statement 983 Captured .

  10. Reported amount

    Hacken said that at 20:24 UTC, one transaction moved about $2.53B out of a single Ethereum wallet.

    Timeline row: Hacken said one Ethereum transaction moved about $2.53B out of a single Binance wallet

    Hacken. Original Statement 18 Captured .

  11. Reported amount

    Blockaid said that at 20:24:23 UTC on October 29 the operator called sweep on Binance 14, sending 167,464 ETH, 1.615B USDT and about 60 other tokens to a collection address with no prior history, a basket it valued at about $2.5B.

    blockaid.io. Original Statement 107 Captured .

  12. Reported amount

    Halborn said the operator called Binance 14 at 20:24:23, 3 minutes 24 seconds after the delegation, in block 26,300,770.

    Halborn. Original Statement 760 Captured .

  13. Reported amount

    Blockaid said that at 20:41:23 UTC the operator used the still-delegated Binance 14 to move 780M USDC from a Circle smart account to the collection address, followed by another 43M USDC.

    Timeline row: Blockaid said 780M USDC was moved from a Circle smart account linked to Binance

    blockaid.io. Original Statement 108 Captured .

  14. Reported amount

    Blockaid said that at 21:44 UTC the operator swept Binance 14 again for 200M USDT and 13 other tokens deposited since the first sweep.

    Timeline row: Blockaid said the operator swept the still-delegated Binance wallet again for 200M USDT and 13 other tokens

    blockaid.io. Original Statement 109 Captured .

  15. Reported amount

    Cointelegraph quoted Cynthia Lummis as saying that hackers stole more than $6 billion from Binance in less than 4 hours, the biggest heist in history.

    Cynthia Lummis, Cointelegraph. Original Statement 398 Captured .

  16. Reported recovery

    Hacken said the chain confirms Binance 14 signed a new authorization at 00:10:35 UTC on 30 October that reset its delegation, 3 hours 46 minutes after the sweep.

    Timeline row: Hacken said Binance signed a new authorization resetting the delegation on its Ethereum wallet

    Hacken. Original Statement 110 Captured .

  17. Reported recovery

    Halborn said the delegation was cleared at 00:10:35 on 30 October, three hours and fifty minutes after it was installed.

    Halborn. Original Statement 763 Captured .

  18. Reported root cause

    Cointelegraph reported that Blockaid CEO Ido Ben-Natan said attackers could have stolen the funds without EIP-7702.

    Ido Ben-Natan, Cointelegraph. Original Statement 352 Captured .

  19. Reported root cause

    Cointelegraph quoted Ido Ben-Natan as saying the 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have.

    Ido Ben-Natan, Cointelegraph. Original Statement 353 Captured .

  20. Reported root cause

    Cointelegraph reported that Ethereum community member VEER said EIP-7702 gave attackers a handy sweep button on Ethereum.

    Cointelegraph. Original Statement 354 Captured .

  21. Reported root cause

    Cointelegraph reported that Ambire CEO Ivo Georgiev said EIP-7702 made little difference because the hackers already had the ability to authorize transactions.

    Ivo Georgiev, Cointelegraph. Original Statement 355 Captured .

No time stated

  1. No time stated
    Reported amount

    TRM stated that an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes.

    TRM Labs, npr.org. Original Statement 46 Captured .

  2. No time stated
    Reported amount

    TRM said an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains on October 29, 2026, most of it in about 20 minutes starting at 20:05 UTC.

    TRM Labs, TRM Labs. Original Statement 136 Captured .

  3. No time stated
    Reported amount

    TRM said that three minutes and 24 seconds after the delegation the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address, moving 167,464 ETH and 63 tokens including 1.615 billion USDT in one transaction.

    TRM Labs, TRM Labs. Original Statement 142 Captured .

  4. No time stated
    Reported amount

    Elliptic said the attacker drained Binance hot wallets across 11 blockchains over a few hours.

    Elliptic, Elliptic. Original Statement 309 Captured .

  5. No time stated
    Reported root cause

    Hacken said that at Binance the delegation stayed in place for 3 hours 46 minutes after the sweep and later deposits were swept again.

    Hacken. Original Statement 317 Captured .

  6. No time stated
    Reported root cause

    Blockaid said the delegation was visible on-chain for three minutes and 24 seconds before the sweep.

    blockaid.io. Original Statement 327 Captured .

  7. No time stated
    Reported root cause

    Blockaid said its transaction security engine classified the delegation transaction as malicious because an EOA was being upgraded through EIP-7702 to an untrusted address.

    blockaid.io. Original Statement 329 Captured .

  8. No time stated
    Reported amount

    WIRED reported, citing TRM Labs, that the majority of the stolen crypto was taken in around 20 minutes on 29 October.

    WIRED. Original Statement 332 Captured .

  9. No time stated
    Reported root cause

    TRM Labs said that on the nine chains other than Ethereum, Binance wallets sent funds to the attacker through ordinary signed transfers.

    TRM Labs, TRM Labs. Original Statement 458 Captured .

  10. No time stated
    Reported root cause

    Ivo Georgiev, co-founder and CEO of Ambire, warned that exchange engineers might overlook the need to revoke a malicious EIP-7702 delegation after regaining control of their systems.

    Ivo Georgiev, Cointelegraph. Original Statement 466 Captured .

  11. No time stated
    Reported root cause

    Halborn said, as its own inference, that fifty pre-signed authorizations suggest someone who could get the key to sign digests but could not control when, how fast or how many times.

    Halborn. Original Statement 756 Captured .

  12. No time stated
    Reported amount

    Halborn said a second Ethereum hot wallet, Binance 16, signed nine ordinary transfers to the attacker worth about $174 million with no delegation involved.

    Halborn. Original Statement 761 Captured .

  13. No time stated
    Reported root cause

    Blockaid said that within 12 minutes after the initial drain, 10 more Binance hot wallets on four chains sent funds to the same address, and the attacker then drained a Binance-owned smart account through the still-delegated wallet.

    Blockaid. Original Statement 960 Captured .

  14. No time stated
    Reported amount

    Blockaid said that twenty-four seconds after the sweep, Binance 16 sent 28,005.6 ETH, 55.7M USDT, 25.9M RLUSD, 84.5 WBTC and five other tokens to the same address.

    Blockaid. Original Statement 965 Captured .