{"id":"CMP-202610-binance-hot-wallets-drained-of-about-3-3-5-6b-in-a-suspected","kind":"campaign","aliases":[],"related":[],"title":"Binance hot wallets drained of about $3.3-5.6B in a suspected hack; Binance investigating, vector unknown","description":null,"summary":"On 29 Oct 2026, starting about 20:24 UTC, billions in crypto left Binance hot wallets on Ethereum, Bitcoin and Tron within minutes. The 'Binance 14' hot wallet sent about $2.53B across 64 tokens, a second wallet sent $174.4M 24 seconds later, and a third sent 780M USDC to the same Ethereum address (about $3.48B in all). Arkham tracks 55 addresses under the entity 'binance-hacker-1029' holding about $5.78B (USDT, BTC, ETH, USDC). That figure is what the wallets hold, not a confirmed stolen amount. Etherscan labels the receiving address 'Binance Hot Wallet Exploiter 2'. If confirmed, this is the largest crypto theft on record. Tether has frozen more than 1.567B USDT and Circle more than $800M USDC, over $2.3B in total, and Circle is working with law enforcement. The wallet that started the transfers was funded through Tornado Cash. Binance says it is investigating a 'potential security issue' and that user funds are safe, but has not confirmed the transfers were unauthorized, how it happened, or the total. Changpeng Zhao calls it a hack. How the attackers got in, and whether customer accounts or API keys are affected, is unknown. It happened about the same time as the Polymarket breach, but no link has been shown. Binance warns customers to watch for scams and unofficial links.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-29T21:50:17+00:00","products":[{"name":"Binance","fixed":[],"affected":"Binance exchange hot wallets, 29 Oct 2026","ecosystem":"saas"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"If your organisation holds funds on Binance or uses Binance API keys, look for withdrawals, transfers or API activity you did not approve from 29 Oct 2026. Watch for funds received from the Arkham-labelled entity 'Binance-hacker-1029' (no specific addresses confirmed in our sources).","fix":"Pause automated withdrawals and trading bots that use Binance if you can. Rotate Binance API keys and restrict them to IP allowlists, with withdrawal permission off. Check balances and transaction history, and follow Binance's official status channel for confirmation, the attack vector and reimbursement steps.","status":"open","published_at":null,"first_seen_at":"2026-10-29T21:50:17+00:00","triaged_at":"2026-10-29T21:50:17+00:00","updated_at":"2026-10-29T23:11:19+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202610':19A '-3':28A '-5':29A '-5.6':8A '-6':30A '1.567':161B '1029':39A,115B '14':70B '174.4':84B '2':145B '2.3':171B '2.53':75B '20':51B '2026':48B '24':52B,86B '29':46B '3':27A '3.3':7A '3.48':101B '5.78':118B '55':107B '64':78B '780m':93B '800m':168B 'a':34A 'about':26A 'account':236B 'across':77B 'address':99B,108B,140B 'affect':241B 'amount':135B 'api':238B 'arkham':105B 'attack':230B 'b':9A,32A,76B,102B,119B,162B,172B 'b-in-a-suspected':31A 'billion':54B 'binanc':1A,14A,58B,69B,113B,141B,193B,260B 'binance':21A,37A,40A 'binance-hack':112B 'binance-hacker':36A 'binance-hot-wallets-drained-of-about':20A 'bitcoin':63B 'breach':253B 'btc':121B 'call':224B 'campaign':41B 'cash':192B 'changpeng':222B 'circl':165B,176B 'cmp':18A 'confirm':133B,147B,211B 'crypto':56B,152B 'custom':235B,262B 'drain':4A 'drained':24A 'earli':43B 'early-warn':42B 'enforc':181B 'entiti':111B 'eth':122B 'ethereum':62B,98B 'etherscan':136B 'exploit':144B 'figur':125B 'frozen':158B 'fund':189B,205B 'got':231B 'hack':13A,227B 'hacker':38A,114B 'happen':218B,245B 'hold':116B,130B 'hot':2A,22A,59B,71B,142B 'in':33A 'investig':15A,197B 'issu':201B 'key':239B 'label':137B 'largest':151B 'later':88B 'law':180B 'left':57B 'link':256B,269B 'm':85B 'minut':67B 'oct':47B 'of':25A 'polymarket':252B 'potenti':199B 'receiv':139B 'record':155B 'safe':207B 'say':194B 'scam':266B 'second':81B,87B 'secur':200B 'sent':73B,83B,92B 'shown':259B 'start':49B,185B 'stolen':134B 'suspect':12A 'suspected':35A 'tether':156B 'theft':153B 'third':91B 'time':249B 'token':79B 'tornado':191B 'total':174B,221B 'track':106B 'transfer':187B,213B 'tron':65B 'unauthor':215B 'unknown':17A,243B 'unoffici':268B 'usdc':94B,123B,169B 'usdt':120B,163B 'user':204B 'utc':53B 'vector':16A 'wallet':3A,60B,72B,82B,129B,143B,183B 'wallets':23A 'warn':44B,261B 'watch':264B 'whether':234B 'within':66B 'work':178B 'zhao':223B","nicknames":["Binance-hacker-1029"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-binance-hot-wallets-drained-of-about-3-3-5-6b-in-a-suspected","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-29T21:50:17+00:00","fetched_at":"2026-10-29T21:50:17+00:00","note":null},{"source":"analyst","external_id":"CMP-202610-binance-hot-wallets-drained-of-about-3-3-5-6b-in-a-suspected:1113","url":null,"severity":null,"published_at":"2026-10-29T23:11:19+00:00","modified_at":"2026-10-29T23:11:19+00:00","first_seen_at":"2026-10-29T23:11:19+00:00","fetched_at":"2026-10-29T23:11:19+00:00","note":"BleepingComputer: Binance spokesperson statement; Tether/Circle freezes now >$2.3B; Arkham tracks 55 addresses at ~$5.78B; Etherscan label 'Binance Hot Wallet Exploiter 2'"}],"documents":[{"id":19518,"url":"https://news.ycombinator.com/item?id=50296272","title":"Over $5B drained from Binance in apparent hack","kind":"post","source":"hackernews","publisher":null,"text":"Over $5B drained from Binance in apparent hack\nhttp://twitter.com/emmettgallic/status/2115916025774723210\n\n9 points, 0 comments on Hacker News","published_at":"2026-10-29T21:24:59+00:00","relation":"describes","confidence":null,"note":null},{"id":19521,"url":"https://news.ycombinator.com/item?id=50296470","title":"Binance-hacker-1029 – $5.6B stolen from Binance","kind":"post","source":"hackernews","publisher":null,"text":"Binance-hacker-1029 – $5.6B stolen from Binance\nhttps://arkm.com/explorer/entity/21a94755-f604-45e5-9501-6542e23005e8\n\n3 points, 0 comments on Hacker News","published_at":"2026-10-29T21:38:59+00:00","relation":"describes","confidence":null,"note":null},{"id":19396,"url":"https://x.com/vxunderground/status/2115914258890281091","title":"@vxunderground: Cryptocurrency nerds now believe Binance has been compromised. The Binance compr","kind":"post","source":"x","publisher":null,"text":"Cryptocurrency nerds now believe Binance has been compromised. The Binance compromise appears to have occurred at approx. the same time as the Polymarket compromise.\n\nHowever, details are still fuzzy as we are currently witnessing this massive crypto theft in real time.\n\nThe https://t.co/oqluRJXsNb\n\nlikes 1692 reposts 179","published_at":"2026-10-29T21:10:45+00:00","relation":"describes","confidence":null,"note":null},{"id":19523,"url":"https://decrypt.co/382191/binance-suspected-hack-5-billion-tether-circle-freeze-crypto","title":"Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 Billion (Decrypt)","kind":"other","source":"analyst","publisher":null,"text":"On 29 Oct 2026 at least $5.57B left Binance-linked wallets on Ethereum, Bitcoin and Tron (on-chain tally). Binance: aware of a 'potential security issue', actively investigating, 'We have not confirmed any impact to user funds.' Tether froze 975.1M USDT and Circle froze 823M USDC in the main receiving wallet (~$1.8B). FinanceFeeds: about $3.3B left two Binance hot wallets on Ethereum within ~20 minutes starting about 20:24 UTC (ETH, stablecoins, 60+ tokens); Etherscan and Changpeng Zhao describe it as a likely hack; CZ says user funds are safe and expects them to be covered. vc.ru: the initiating wallet was funded only through Tornado Cash. Arkham labels the receiving entity 'Binance-hacker-1029'. Attack vector unknown.","published_at":"2026-10-29T21:36:24+00:00","relation":"describes","confidence":null,"note":null},{"id":19655,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3mz2cgez2zc2a","title":"@campuscodi.risky.biz: A major Binance hack is taking place right now\n\nThe stolen total has been growin","kind":"post","source":"bluesky","publisher":null,"text":"A major Binance hack is taking place right now\n\nThe stolen total has been growing each 30minutes from $2b to $3.3b... and has now reached $5.5 billion\n\ndecrypt.co/382191/binan...\nhttps://decrypt.co/382191/binance-suspected-hack-5-billion-tether-circle-freeze-crypto\n\nlikes 9 reposts 4","published_at":"2026-10-29T22:21:08+00:00","relation":"discussion","confidence":null,"note":null},{"id":19645,"url":"https://x.com/vxunderground/status/2115929082617573875","title":"@vxunderground: > be me\n> check news\n> \"wow that's crazy I should tell the little peopl","kind":"post","source":"x","publisher":null,"text":"> be me\n> check news\n> \"wow that's crazy I should tell the little people living inside of my computer\"\n> make post\n> step away\n> come back\n> it gets worse\n\nIf my memory serves me correctly, the largest cryptocurrency heist in history was ByBit, at $1.5B.\n\nChat, we're witnessing https://t.co/ViLF4IjDYF\n\nlikes 769 reposts 55","published_at":"2026-10-29T22:09:40+00:00","relation":"discussion","confidence":null,"note":null},{"id":19641,"url":"https://x.com/vxunderground/status/2115927274981646403","title":"@vxunderground: As chaos and mass confusion sweeps through the cryptocurrency and \"prediction ma","kind":"post","source":"x","publisher":null,"text":"As chaos and mass confusion sweeps through the cryptocurrency and \"prediction market\" space, it has been confirmed Tether was able to freeze over $1.5 billion in crypto, preventing a catastrophic theft of money.\n\nHowever, cryptocurrency block chain schizos estimate the total https://t.co/mRNmEGQazA\n\nlikes 423 reposts 38","published_at":"2026-10-29T22:02:29+00:00","relation":"discussion","confidence":null,"note":null},{"id":19819,"url":"https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/","title":"Binance probes potential $5.8 billion crypto-theft hack (BleepingComputer)","kind":"other","source":"blog","publisher":null,"text":"Binance spokesperson: aware of reports of a potential security issue, investigating, says user funds are completely safe. Tether froze >1.567B USDT, Circle >800M USDC (>2.3B total). Binance 14 hot wallet sent ~2.53B across 64 tokens, +174.4M from a second wallet 24s later, then 780M USDC from a third wallet (~3.48B). Arkham tracks 55 addresses under 'binance-hacker-1029' holding ~5.78B (USDT 1.77B, BTC 1.44B, ETH 876M, USDC 823M) - holdings, not confirmed stolen amount. Etherscan labels receiver 'Binance Hot Wallet Exploiter 2'. Vector unconfirmed.","published_at":"2026-10-29T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":19778,"url":"https://x.com/BleepinComputer/status/2115938136500941158","title":"@BleepinComputer: Binance probes potential $5.8 billion crypto-theft hack\nhttps://t.co/05rMu2Fanf\n","kind":"post","source":"x","publisher":null,"text":"Binance probes potential $5.8 billion crypto-theft hack\nhttps://t.co/05rMu2Fanf\n\nhttps://t.co/05rMu2Fanf\n\nlikes 24 reposts 8","published_at":"2026-10-29T22:45:38+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}