Key Highlights
- Onchain estimates indicate that between $5.3 billion and $5.8 billion in outflows occurred across Ethereum, Bitcoin, and Tron, potentially making it the largest security incident in crypto history.
- Security analysts point to an EIP-7702 delegation transaction on Ethereum as a primary point of exploitation, while major stablecoin issuers including Tether and Circle moved quickly to freeze roughly $2.6 billion in related assets.
- Binance temporarily halted withdrawals to conduct investigations, with co-founder Yi He and former CEO Changpeng Zhao pledging that all customer losses will be fully covered by the exchange.
A massive, unprecedented security incident involving billions of dollars in suspected unauthorized cryptocurrency outflows has rocked the digital asset sector. While official and independently verified loss totals remain unconfirmed by Binance, onchain researchers have mapped out historic levels of capital movement. Early data tracked by some onchain analysts placed the suspected illicit transfers at roughly $5.57 billion across Ethereum, Bitcoin, and Tron. Blockchain analytics platform Glassnode calculated outflows near $5.3 billion, with wider industry tallies nearing $5.8 billion. While observers caution that some broader figures might inadvertently count standard exchange transfers, the Ethereum movements alone dwarf previous crypto breaches, such as the February 2025 Bybit hack that claimed approximately $1.5 billion.
Anatomy of the Attack: The EIP-7702 Mechanism and Hot Wallet Drainage
Technical assessments have zeroed in on a vulnerability linked to Ethereum’s EIP-7702 standard, an account abstraction innovation introduced during the Pectra upgrade in May 2025. Designed to permit regular wallets to authorize external smart contracts to perform actions on their behalf, the feature allegedly became an open pathway when combined with compromised signature authority. Investigators monitoring the primary “Binance 14” wallet identified a suspicious delegation transaction around 4:20 p.m. Eastern time. Web3 security firm Blockaid reported that this specific transaction contained 50 individual authorizations catering to varying nonces, one of which successfully cleared. Moments later, the wallet’s contents were drained to an outside address.
Tracing revealed that the receiving contracts and addresses were funded via the cryptocurrency privacy protocol Tornado Cash earlier in the day. Because EIP-7702 strictly mandates valid authorization signatures, investigators are examining whether the exploit was triggered by stolen private keys, social engineering of an authorized signer, or a deeper breach of Binance’s cryptographic signing infrastructure. Furthermore, the Ethereum-specific EIP-7702 exploit cannot account for corresponding outflows identified on Bitcoin and Tron networks, signaling a far wider operational breach.
Ido Ben-Natan, Co-Founder and CEO of Blockaid told Bitcoin.com News that it saw this coming. The firm’s H1 report predicted that a seven-figure exploit would occur in the second half of 2026. “The attacker effectively reprogrammed a major Binance Ethereum hot wallet so that a single operator could drain it, including any new money deposited into it, and they used that access again more than an hour later,”
Blockaid’s CEO explained.
Ben-Natan added:
“The attack was planned well in advance, with the attacker funding the operation through Tornado Cash and rehearsing the same takeover on test wallets hours before, all of it visible on-chain. Tether and Circle moved quickly to freeze roughly $2.4 billion, and we are continuing to trace the rest.”
Issuer Freezes and Countermeasures: Racing the Perpetrator
In response to the rapid siphoning of tokens, major centralized stablecoin issuers coordinated an aggressive counter-effort to quarantine the stolen loot. Tether Chief Executive Officer Paolo Ardoino announced that Tether had frozen over 1.567 billion USDT. Circle CEO Jeremy Allaire verified that his company immobilized more than 800 million USDC in conjunction with law enforcement agencies. Binance co-founder Yi He added that Ripple froze an estimated $200 million, while World Liberty Financial co-founder Zach Witkoff noted a containment of roughly $27 million in USD1. In decentralized finance ecosystems, decentralized lending platform Aave temporarily suspended its Ethereum V3 lending markets out of caution, and the Arbitrum Security Council executed an onchain transaction to freeze about $30.5 million in connected funds.
Despite these interventions, blacklisting cannot retrieve native digital assets like bitcoin (BTC) or ether (ETH), which operate without central issuer-level freeze functions. The attacker actively attempted to bypass tracking efforts by circulating ETH across decentralized exchanges, swapping between multiple assets, and using borrowed capital against collateral. While freezes accounted for approximately $2.6 billion on paper, recovery remains complex as un-freezable native tokens continue to circulate through external mixers and DeFi routing infrastructure.
Binance Halts Operations While Executives Guarantee Restitution
As market uncertainty surged, Binance suspended user withdrawals to carry out deep security reviews. The company reassured its customer base that core reserves were intact. Former Chief Executive Officer Changpeng Zhao, who stepped away from his executive role in 2023, voiced strong remarks on social media. “It does look like a hack on Binance,”
he stated on X, emphasizing his position solely as a shareholder while declaring his expectation that customer funds would be made whole. Zhao added that Binance stood ready to cover the full scope of damages, even if final loss tallies exceeded preliminary numbers.
Binance co-founder and chief customer service officer Yi He reiterated this stance directly: “User funds are safe,”
she stated at 8 p.m. Eastern time. “Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates,”
the co-founder added.
Why This Matters
The scale of the Binance security event introduces profound implications for systemic risk, infrastructure design, and custodial standards across the digital asset economy. Beyond the direct market fallout—which saw Bitcoin plunge toward $76,000, Ether lose 4.6%, BNB drop 7.7%, and roughly $1.4 billion in leveraged positions liquidated—the attack exposes crucial attack vectors in smart contract delegation standards like EIP-7702.
The swift intervention of stablecoin issuers highlights the expanding role of centralized intervention in mitigating illicit DeFi movements, yet simultaneously underscores the vulnerabilities inherent in centralized exchange hot wallets. As investigators look into potential state-sponsored culprits—including early speculation surrounding North Korean cyber syndicates—the incident will likely accelerate regulatory pressure on centralized platforms to redesign multi-signature authorization architecture and enforce stricter transaction monitoring standards.
Frequently Asked Questions
What was the exploit method used in the Binance security breach?
While the exact root cause of the initial key or signature leak remains under review, technical analysis from Blockaid confirmed that the attacker leveraged an EIP-7702 delegation transaction on Ethereum. This permitted a single unauthorized entity to reprogram a major Binance hot wallet and repeatedly sweep funds out to external destinations. The cross-chain outflows observed on Bitcoin and Tron indicate broader vulnerabilities beyond Ethereum alone.
How much money was affected, and can it be recovered?
Estimates from Glassnode and independent onchain researchers place the total value of suspicious transactions between $5.3 billion and $5.8 billion. Stablecoin issuers, including Tether and Circle, have frozen upwards of $2.6 billion in tokens. However, native cryptocurrencies such as bitcoin and ether cannot be unilaterally frozen by issuers, and those funds are actively being traded and moved through decentralized platforms.
Are user funds safe following the Binance withdrawal pause?
Both Binance co-founder Yi He and shareholder Changpeng Zhao publicly confirmed that Binance will cover all verified losses resulting from the incident. Withdrawals and deposits were suspended temporarily while the exchange’s security teams coordinate with law enforcement and complete network-wide diagnostics.
