Binance wallet emptied in massive transaction

A Binance wallet, the world's largest cryptocurrency exchange platform, was emptied in a single transaction on Thursday, October 29, around 21:24 Paris time. According to estimates by Conor Grogan, a Coinbase executive, relayed by The Block, up to $5.8 billion in assets (approximately €5.2 billion) left the platform's wallets across several blockchains.

Record-breaking loss compared to past incidents

If all of it was stolen, it would be nearly four times the record set by Bybit, which lost $1.5 billion (approximately €1.3 billion) in February 2025. Changpeng Zhao, founder of Binance, was the first to mention hacking around 22:15. "This looks like a hacking incident," he wrote on X, when The Wall Street Journal already referred to what would be "the largest cryptocurrency heist in history."

French customers less affected by the breach

French customers are less exposed, as Binance cut off all its services in France on July 1, due to the lack of European approval. The targeted wallet is called "Binance 14." It is a "hot" wallet, meaning it is permanently connected to the internet to process customer withdrawals. It sent 167,464 ethers and 63 other tokens to a brand new address.

Attackers used Tornado Cash and EIP-7702

Among the assets, there was $1.6 billion in USDT (approximately €1.4 billion), the cryptocurrency of Tether, which follows the dollar's value. Public Ethereum data, visible on the Etherscan website, shows that the attacker had received its first funds the previous day via Tornado Cash, a service that mixes cryptocurrencies to hide their origin. It then connected Binance 14 to its own program using EIP-7702.

Security company investigates significant withdrawal

This Ethereum function allows a regular wallet to delegate its operations to a smart contract. The attacker then only had to empty the wallet in one go. In total, the security company Blockaid is investigating approximately $3.3 billion (about €3 billion) withdrawn from Binance wallets. The actual amount stolen is not yet known.

Major portion of stolen assets frozen

Approximately $1 billion loss out of $144 billion in deposits. A large part of the loot is however blocked. Tether and Circle issue the two main stablecoins. These two companies can freeze their tokens on a specific address, and they did so within an hour. Paolo Ardoino, CEO of Tether, announced more than $1.56 billion in frozen USDT.

Estimated loss is a small fraction of total deposits

Circle froze approximately $823 million in USDC. However, ethers cannot be frozen, as no company controls this cryptocurrency. The founder of DefiLlama, a site that tracks funds deposited on crypto platforms, made the calculation on X under the pseudonym 0xngmi. Once the USDT and USDC were frozen, the loss would be around $1 billion, or about €900 million.

Binance has emergency fund to cover losses

However, Binance holds approximately $144 billion in assets for its customers, which brings the loss to 0.69% of the total. The loss could be "a bit higher," responded Changpeng Zhao, "but it will be covered." The former CEO no longer leads Binance since 2023 and is speaking here as a shareholder.

Emergency fund contains 15,000 bitcoins

The platform, however, has an emergency fund, the SAFU (Secure Asset Fund for Users), intended to reimburse customers after a security incident. Since February, it has only contained bitcoin, 15,000 bitcoins purchased for about $1 billion. At the time of this Thursday evening, with bitcoin around $79,000, the reserve is worth nearly $1.2 billion, or approximately €1.06 billion.

Binance has used SAFU before for similar incidents

On paper, it is sufficient to cover the estimated loss by 0xngmi, but with little margin if the bill rises as Changpeng Zhao announced. Binance has already drawn from this fund. In May 2019, hackers had stolen 7,000 bitcoins, about $40 million at the time, and the platform had reimbursed its customers through the SAFU.

Binance reserves depend on bitcoin's price

Binance has also committed to replenishing the fund if its value falls below $800 million (approximately €720 million). Since the reserve is entirely in bitcoin, this threshold depends directly on the price. It would be reached if bitcoin fell below approximately $53,000 (nearly €47,500), or a third decrease from this Thursday evening.

Binance avoids using the word "hacking"

On its part, Binance only speaks of a "possible security issue" in its statement published on X. It assures that users' funds are "completely secure." However, the specialized website FinanceFeeds consulted the history of the message's edits. Binance rewrote it twice in 13 minutes.

Binance suspends withdrawals for safety

Initially, there was "no confirmed impact" on customers' funds. In the final version, these funds are "completely secure." Especially, the platform then suspended withdrawals until it ensured its systems were safe. It was Yi He, co-founder and co-CEO of Binance, who clarified this.

Binance's rivals remain unaffected

As long as withdrawals remain suspended, customers must trust Binance when it says their funds are intact. In the evening, Coinbase, the major American rival, stated that it was not affected. It also offered assistance to Binance's teams. Binance.US, the independent American branch, also assured that its services were functioning normally.

Market impact of the incident

The attack also shook the entire market. In the hour that followed, bitcoin and ether lost between 2 and 4%, and BNB, the token linked to Binance, up to 6%. Forced sales of leveraged positions reached $627.7 million (approximately €563 million). Even without an account at Binance, a cryptocurrency holder therefore saw the value of their wallet decrease this Thursday evening.

Binance warns customers of scams

What to do if your cryptocurrencies are on a Binance platform itself asks its customers to be wary of links, messages, and information requests that do not come from its official channels. Scammers always take advantage of such incidents. They send fake emails or fake SMS offering to "secure" your account. Never give your recovery phrase, the sequence of words that gives access to a wallet.

Physical wallets offer more control

No serious service will ask for it. Only use the official app or website of your platform. With a physical wallet, you keep the keys to your cryptocurrencies, and you no longer depend on the security of a platform. In this case, buy it directly from the manufacturer.

Ledger finds security issue in its reseller's product

On October 10, Ledger confirmed having found a spy implant in a wallet sold by its own authorized reseller in Southeast Asia. Five days later, the French company presented the Atom, an Android device that does not make calls or SMS. Its Founder's edition is sold for $849, or approximately €760 before taxes, and will be delivered in the summer of 2027.

Price of Atom increases after launch

The price will then go to $899 (approximately €805). Binance has not yet given the cause of the attack, the final amount of the loss, or the date of resuming withdrawals. It has not said whether it would draw from the SAFU or its treasury to cover the loss.