A Binance hot wallet showed large abnormal outflows early on Oct. 30 Taipei time, prompting public comments from Changpeng Zhao and a rapid response from stablecoin issuers Tether and Circle.
Zhao, widely known as CZ, wrote on X at 05:15 that, "User funds are safe! It does look like a hack on Binance." He also thanked Tether and Circle for freezing related funds. Binance, however, had not formally confirmed a hack at that point and said it was still investigating the incident.
Binance 14 wallet moved more than $2 billion in one transaction
According to Etherscan records, a Binance hot wallet tagged "Binance 14" transferred 167,464 ETH and 63 tokens to another address at 04:24 Taipei time on Oct. 30.
The largest portion was about 1.615 billion USDT. Other assets listed in the transfer included RLUSD, XAUt, UNI, ENA, PEPE, LINK and AAVE. Based on prices shown on Etherscan, the assets moved in that single transaction were worth more than $2 billion.
On-chain researcher odysseas said the wallet was drained 3 minutes and 24 seconds after a signed EIP-7702 delegation authorization was installed. Under EIP-7702, a regular wallet address can attach smart contract code, which in this case meant the wallet effectively executed the transfers itself.
Researcher 0xQuit said the attacker first deployed the delegation contract at 23:59 Taipei time on Oct. 29, then sent the EIP-7702 authorization transaction about four hours later. The same relay address later moved 780 million USDC from Binance hot wallet 34.
Researcher spreekaway, who first raised the alert, said the entire wallet was moved into a newly created address and that the funds used to trigger the contract call came from Tornado Cash. He later added that wallets 14, 16 and 34 had shown the same pattern.
The total amount moved remains unsettled. 0xQuit estimated that assets transferred from wallet 14 were worth about $2.5 billion. The Block, citing on-chain estimates, put the total moved from Binance wallets at about $5.8 billion. Binance had not confirmed a hack or disclosed losses.
Tether and Circle froze related stablecoins
For centrally issued stablecoins such as USDT and USDC, issuers can blacklist specific addresses, preventing frozen tokens from being transferred again.
Tether CEO Paolo Ardoino said at 05:25 Taipei time that Tether had frozen more than 1.567 billion USDT linked to what he called a "potential Binance exchange hack incident," adding that protecting the industry and its partners was the company’s top priority.
Circle CEO Jeremy Allaire said at 05:18 that Circle was closely tracking a potential attack involving Binance and had worked with law enforcement to freeze more than $800 million in USDC tied to the case. He said the company would continue assisting the investigation.
CZ said users would be fully covered; Binance said the matter was still under review
In his post, Zhao wrote, "User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered."
Binance’s official account posted a statement at 05:29 saying the team was aware of reports about a potential security issue and was actively investigating. The exchange said its security team was urgently reviewing all relevant information and would provide updates through official channels once details were confirmed. It also warned users to watch for scams and avoid unofficial links, messages or requests for account information.
Binance co-founder Yi He posted the same statement at 05:17. As of 05:32 Taipei time, Binance’s official statements had not used the word "hack" and had not disclosed any loss figure.
According to CoinGecko data at that time, BNB traded at $713, down 5.5% over 24 hours, while Bitcoin was at $79,322, down 2.2%.
