On October 29, 2026, billions of dollars in crypto assets began moving out of wallets associated with Binance.

The world's largest cryptocurrency exchange temporarily suspended deposits and withdrawals. The following day, Binance estimated the incident's total impact at approximately $6.3 billion and reported that around $3 billion in affected assets had been frozen.

According to the exchange's preliminary findings, an attacker may have accessed its infrastructure through a compromised employee laptop. Binance says it has found no evidence that wallet private keys were leaked.

The company has promised to cover losses and maintains that user funds are safe. But how could an attacker initiate withdrawals worth billions of dollars? And why could users with uncompromised accounts suddenly lose the ability to withdraw their assets?

Here is what the evidence shows so far, how the attack may have worked, and what it reveals about crypto custody.

What Happened to Binance on October 29, 2026?

The first signs emerged on the evening of October 29, when blockchain analysts detected unusually large transfers from Binance hot wallets.

A hot wallet is a crypto wallet whose signing infrastructure is accessible to systems that process transactions online. Exchanges use these wallets to handle customer withdrawals and move liquidity quickly. That convenience also makes the infrastructure behind them an attractive target.

According to Blockaid's technical investigation, one of the largest transfers occurred at 20:24 UTC. Researchers identified a transaction from a wallet labeled Binance 14 involving:

• 167,464 ETH;

• approximately 1.615 billion USDT;

• around 60 other tokens.

Blockaid estimated the combined value of this transfer at roughly $2.5 billion. Over the next 12 minutes, the firm tracked additional suspicious transfers from other Binance hot wallets across several networks.

Blockaid's initial report described at least $5.5 billion in suspected outflows. Binance later estimated the incident's overall impact at approximately $6.3 billion. These figures were published at different stages and may cover different sets of transactions; they should not be treated as identical measurements.

In its October 30 security update, Binance said it had suspended deposits and withdrawals for checks, revoked affected authorization, and engaged blockchain intelligence firms and law enforcement to trace and freeze assets. It also promised to cover losses using its SAFU fund and company funds and to publish a technical post-mortem after the investigation.

How Did Attackers Gain Access to Billions of Dollars?

The suspected entry point was not a flaw in the blockchain itself.

According to Binance's preliminary investigation, the attacker may have compromised a DevOps engineer's laptop, accessed a service container, and submitted unauthorized withdrawal transactions. DevOps infrastructure supports servers, deployments, automation, containers, and access management.

But access to an employee laptop does not, by itself, explain how blockchain transactions worth billions were authorized. That connection is still under investigation.

What Did Blockaid Discover?

Blockaid identified an unusual mechanism involving EIP-7702, an Ethereum feature that lets a regular account delegate execution to smart contract code.

Normally, a crypto transfer requires a transaction authorized using the account's private key. EIP-7702 adds the ability to sign a separate authorization that makes the account execute the logic of a designated smart contract. The feature is not inherently malicious: it can support transaction batching, sponsored fees, and more flexible accounts.

The danger is delegating to a malicious contract. Depending on its code, the contract may then move assets without the owner signing each subsequent action separately.

Think of it as the difference between approving a single payment and granting someone authority to carry out future payments. The second decision has consequences beyond the initial transaction.

How Was EIP-7702 Used in the Binance Incident?

According to Blockaid, the attacker deployed a contract built to transfer assets and submitted 50 EIP-7702 authorizations signed for Binance 14, each with a different nonce.

A nonce is an account counter that helps determine which transactions or authorizations are valid and prevents certain replay scenarios. Binance 14 was processing frequent transactions, so its nonce was changing. Of the 50 authorizations, 49 did not match and one did, allowing delegation to take effect.

Minutes later, assets worth roughly $2.5 billion moved out of the account. Blockaid also observed that the delegation remained active after the first transfer, enabling a later sweep of assets deposited to the same address.

That is what made the mechanism especially dangerous: the authorization could retain its effect after the first withdrawal.

There is an important limit to this finding. Blockaid's on-chain analysis explains how signed authorizations were used, but does not conclusively establish how the attacker gained the ability to generate them. A compromised signing service, unauthorized access to key material, and a leaked copy of a private key are not the same thing.

Binance says it has found no evidence of private key leakage. The precise connection between the suspected laptop compromise and the on-chain activity remains unconfirmed.

Where Did the $6.3 Billion Go, and Can It Be Recovered?

A multibillion-dollar hack headline can make it sound as though every dollar has vanished permanently. The actual recovery picture is more complicated.

As of October 30, Binance said it and its partners had frozen approximately $3 billion in affected assets. Stablecoin freezes accounted for a substantial portion.

The issuers of USDT and USDC, Tether and Circle, have mechanisms to restrict transfers involving particular addresses holding their tokens. Reuters reported that the two companies froze approximately $2.38 billion linked to the incident.

Freezing tokens is not the same as returning them to Binance. It restricts their movement; recovery requires further steps.

Bitcoin and Ether operate differently. Their base protocols have no central token issuer that can arbitrarily freeze a standard BTC or ETH address. However, transfers can be tracked on public blockchains, and centralized services receiving suspect funds may be able to restrict their own processing of them.

Three figures should not be confused:

• $6.3 billion: Binance's preliminary estimate of the incident's total impact.

• Around $3 billion: assets Binance says had been frozen as of October 30.

• Final losses: not yet determined in a completed public investigation.

The difference between the first two numbers does not automatically mean every remaining asset is irrecoverable.

Are Binance Users' Funds Safe?

Binance says customer funds are safe and promises to cover losses through its Secure Asset Fund for Users (SAFU) and corporate funds. But a pledge to compensate losses is different from the ability to withdraw assets immediately.

During the security checks, users could see their balances but could not necessarily send funds to an external address.

When you hold 1 BTC on a centralized exchange, the platform generally records your balance in an internal ledger and controls the signing infrastructure used for blockchain withdrawals. Clicking Withdraw sends a request to the exchange, which must process and authorize the transfer.

Passwords and two-factor authentication protect your account from unauthorized logins. They do not eliminate threats to the exchange's own infrastructure.

An exchange balance is not the same as direct control of private keys. Even an account with strong security settings can become temporarily unable to withdraw because of a platform-wide incident.

Could the Same Thing Happen With a Hardware Wallet?

A hardware wallet addresses a different problem: it lets you control private keys and authorize transactions using a dedicated device, separate from the internet-connected environment that prepares transactions.

Crypto assets themselves are recorded on the blockchain, not stored inside the hardware wallet. The device safeguards the keys used to authorize transfers.

Suppose you withdraw BTC from Binance to an address controlled by your hardware wallet. Once the transfer is complete, you do not need Binance's approval to move those BTC. A withdrawal pause at the exchange would not, by itself, prevent you from using keys you control.

However, hardware wallets cannot prevent every loss. Someone with your recovery phrase may be able to access your assets, and signing a malicious transaction can have consequences even when your private keys remain offline.

Why Protecting Private Keys Is Not Enough

The Binance incident illustrates a second challenge: dangerous authorizations matter as much as secret keys. On Ethereum, token approvals, smart contract interactions, and EIP-7702 delegations can grant powers that persist beyond one transaction.

This is why reviewing what you sign matters. ERA Lens, built into the ERA Wallet device, analyzes supported transactions offline and displays readable details for the user to review before signing. Its supported coverage includes certain EIP-7702 delegation operations and warnings for dangerous or unrecognized parameters, as explained in ERA's transaction-verification guide.

That does not mean the ERA Wallet device would automatically have stopped the specific attack on Binance. The exchange's infrastructure and a user's personal signing environment are different threat models.

The relevant principle is simpler: protect the keys, and verify the permissions you grant with them.

Should You Stop Keeping Crypto on Exchanges?

Not necessarily. Exchanges are useful for buying, selling, trading, and accessing liquidity. Hardware wallets serve a different purpose: independent control of keys and transaction authorization.

For active trading, keeping some assets on an exchange may be practical. For long-term holdings, self-custody can reduce dependence on a platform's withdrawal infrastructure.

But self-custody brings responsibilities: keeping backups secure, verifying recipient addresses, and understanding the transactions you approve. Some centrally issued tokens may also remain subject to issuer-level freezes, even when you control their private keys.

For a deeper comparison, see Custodial vs. Non-Custodial Wallets: Who Really Controls Your Crypto?.

What Should Binance Users Do After the Hack?

Avoid panic and rely on official updates. Check withdrawal status through Binance's established channels, and be wary of unexpected messages offering to secure, verify, or recover your assets.

Incidents like this create opportunities for phishing. Attackers may imitate exchange support staff or direct users to fake websites.

If you decide to move funds into self-custody once withdrawals become available, first make sure you understand wallet recovery and have a secure backup. Check the destination address carefully and consider a small test transfer before sending a larger amount.

Never enter your recovery phrase into a website claiming it can verify your wallet or retrieve stolen funds.

The Biggest Lesson From the Binance Hack

The investigation is ongoing. The exact way the attacker obtained signing capabilities, and the controls that failed to prevent the unauthorized transactions, have not yet been established publicly.

But the incident already highlights a crucial distinction. With custodial storage, you depend on a platform to secure keys, run its infrastructure, and process withdrawals. With self-custody, you control the keys and take responsibility for their safety.

Neither model eliminates every risk. The important question is not which is absolutely safe, but how much your ability to access and move assets depends on someone else's systems and decisions.

Before deciding where to hold your crypto, ask yourself: If the platform I use stopped working tomorrow, could I still access and move my assets independently?

To explore self-custody with offline transaction verification, learn more about ERA Wallet. Code ERABLOG20 for 20% off.