--- id: "CMP-202610-binance-hot-wallets-drained-of-about-3-3-5-6b-in-a-suspected" kind: "campaign" aliases: [] title: "Binance hot wallets drained of about $3.3-5.6B in a suspected hack; Binance investigating, vector unknown" severity: "high" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Binance", "fixed": [], "affected": "Binance exchange hot wallets, 29 Oct 2026", "ecosystem": "saas"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-10-29T21:50:17+00:00" updated_at: "2026-10-29T23:11:19+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T21:50:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T23:11:19+00:00"}] --- # Binance hot wallets drained of about $3.3-5.6B in a suspected hack; Binance investigating, vector unknown On 29 Oct 2026, starting about 20:24 UTC, billions in crypto left Binance hot wallets on Ethereum, Bitcoin and Tron within minutes. The 'Binance 14' hot wallet sent about $2.53B across 64 tokens, a second wallet sent $174.4M 24 seconds later, and a third sent 780M USDC to the same Ethereum address (about $3.48B in all). Arkham tracks 55 addresses under the entity 'binance-hacker-1029' holding about $5.78B (USDT, BTC, ETH, USDC). That figure is what the wallets hold, not a confirmed stolen amount. Etherscan labels the receiving address 'Binance Hot Wallet Exploiter 2'. If confirmed, this is the largest crypto theft on record. Tether has frozen more than 1.567B USDT and Circle more than $800M USDC, over $2.3B in total, and Circle is working with law enforcement. The wallet that started the transfers was funded through Tornado Cash. Binance says it is investigating a 'potential security issue' and that user funds are safe, but has not confirmed the transfers were unauthorized, how it happened, or the total. Changpeng Zhao calls it a hack. How the attackers got in, and whether customer accounts or API keys are affected, is unknown. It happened about the same time as the Polymarket breach, but no link has been shown. Binance warns customers to watch for scams and unofficial links. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - saas:Binance affected Binance exchange hot wallets, 29 Oct 2026 fixed ? ## How to check If your organisation holds funds on Binance or uses Binance API keys, look for withdrawals, transfers or API activity you did not approve from 29 Oct 2026. Watch for funds received from the Arkham-labelled entity 'Binance-hacker-1029' (no specific addresses confirmed in our sources). ## Fix Pause automated withdrawals and trading bots that use Binance if you can. Rotate Binance API keys and restrict them to IP allowlists, with withdrawal permission off. Check balances and transaction history, and follow Binance's official status channel for confirmation, the attack vector and reimbursement steps. ## Timeline - 2026-10-29T21:50:17+00:00 analyst - 2026-10-29T23:11:19+00:00 analyst — BleepingComputer: Binance spokesperson statement; Tether/Circle freezes now >$2.3B; Arkham tracks 55 addresses at ~$5.78B; Etherscan label 'Binance Hot Wallet Exploiter 2' ## Documents - [describes] Binance-hacker-1029 – $5.6B stolen from Binance https://news.ycombinator.com/item?id=50296470 - [describes] @vxunderground: Cryptocurrency nerds now believe Binance has been compromised. The Binance compr https://x.com/vxunderground/status/2115914258890281091 - [describes] Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 Billion (Decrypt) https://decrypt.co/382191/binance-suspected-hack-5-billion-tether-circle-freeze-crypto - [describes] Over $5B drained from Binance in apparent hack https://news.ycombinator.com/item?id=50296272 - [describes] Binance probes potential $5.8 billion crypto-theft hack (BleepingComputer) https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/ - [discussion] @campuscodi.risky.biz: A major Binance hack is taking place right now The stolen total has been growin https://bsky.app/profile/campuscodi.risky.biz/post/3mz2cgez2zc2a - [discussion] @vxunderground: > be me > check news > "wow that's crazy I should tell the little peopl https://x.com/vxunderground/status/2115929082617573875 - [discussion] @vxunderground: As chaos and mass confusion sweeps through the cryptocurrency and "prediction ma https://x.com/vxunderground/status/2115927274981646403 - [discussion] @BleepinComputer: Binance probes potential $5.8 billion crypto-theft hack https://t.co/05rMu2Fanf https://x.com/BleepinComputer/status/2115938136500941158 --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_