Binance estimated that about $6.3 billion in user funds were affected by an October 29, 2026, security incident. Blockaid’s on-chain analysis describes a roughly $2.5 billion sweep from one Ethereum hot wallet. But the available figures do not add up to a complete account of what moved, what was recovered, or what Binance ultimately lost.
- Binance’s reported estimate: About $6.3 billion affected; the calculation’s scope has not been fully explained.
- Blockaid’s technical account: A persistent Ethereum wallet delegation preceded a sweep valued at about $2.5 billion.
- Recovery: The public information cited here does not provide a reconciled total of frozen, returned, or reimbursed funds.
- What remains unknown: How the attacker obtained the authorization and how the reported figures fit together.
What happened on October 29?
The Washington Post reported Binance’s estimate that approximately $6.3 billion in user funds had been affected. That is Binance’s reported incident figure, not a verified measure of the exchange’s final financial loss. Public information does not fully define what Binance counted as “affected” or explain how it arrived at the total.
Blockaid, a blockchain security firm, traced a major sequence involving Binance 14, an Ethereum hot wallet used to handle transactions. According to its analysis, an attacker-controlled address sent a transaction at 20:20:59 UTC containing 50 signed EIP-7702 authorization records. One matched Binance 14’s current nonce, the account’s sequence number, and activated a delegation to code controlled by the attacker. Blockaid says the other 49 did not match.
EIP-7702 lets a conventional Ethereum wallet account run code through an authorization. A delegation can stay active until it is replaced or cleared. While active, calls to the account can run the delegated code. The code cannot act autonomously without a transaction.
Blockaid says that at 20:24:23 UTC, the attacker called a sweeper contract and transferred 167, 464 ETH, 1.615 billion USDT, and about 60 other tokens from Binance 14. The firm valued the basket at roughly $2.5 billion at the time. It says the attacker submitted multiple authorization records because the wallet was processing withdrawals, making its current nonce difficult to predict.
Where did the funds go?
Blockaid’s account goes beyond the initial Binance 14 sweep. It describes later transfers involving Binance 16 and other hot wallets, with activity on Optimism, Arbitrum, and Avalanche. According to the firm, the transfers from those other hot wallets were ordinary transactions signed by their respective wallets’ keys, rather than actions carried out through Binance 14’s EIP-7702 delegation.
Blockaid also reports that the delegation remained active and was used in later transfers involving 780 million USDC and another 43 million USDC from a Circle smart account. It says Binance 14 was swept again afterward, including 200 million USDT and other tokens deposited after the initial sweep. These details describe movements identified by Blockaid, but they do not provide a complete, independently reconciled map of the $6.3 billion estimate.
Blockaid’s roughly $2.5 billion valuation and Binance’s reported $6.3 billion affected-funds estimate should not be treated as evidence of a second theft. Nor is this a simple discrepancy that can be resolved by adding amounts together. The figures cover different reported scopes, and the available information does not explain exactly how Binance calculated the broader total.
What does the on-chain evidence establish?
Blockchain records show transactions, addresses, and contract activity. On their own, they cannot reveal how an attacker gained access to an exchange’s internal systems or obtained the ability to submit an authorization. Blockaid’s technical analysis helps explain how assets moved from Binance 14, but it does not establish the full path from any internal compromise to every transaction in the incident.
That distinction matters when discussing private keys. An authorization recorded on-chain does not, by itself, prove that a wallet’s private key was stolen. And even if there is no evidence of a key leak, that would not explain how other transactions were signed or rule out a compromise of systems involved in signing. A complete technical account would need to connect the on-chain activity to the exchange’s internal processes.
Blockaid’s findings do not mean EIP-7702 itself caused the incident or is inherently unsafe. The mechanism can support wallet features such as transaction batching and sponsored fees. The risk described here is narrower: an unauthorized delegation that stays active can give malicious code continuing access when the account is called.
Frozen, recovered, and reimbursed are different
A frozen asset is one whose movement has been restricted. Recovery means an asset has been returned or placed in a recovery arrangement. Reimbursement means customers have been made whole, whether or not the original assets have been recovered. These are separate outcomes, and a transfer trace alone does not prove that any of them occurred.
Some stablecoin issuers can freeze their own tokens. They do not have the same authority over native assets such as ETH or BTC, and their control does not automatically follow tokens exchanged for other assets. The reporting cited here does not establish a reconciled total of funds frozen, returned, placed in recovery custody, or used to reimburse customers.
Binance’s reported affected-funds estimate is not a final loss figure. A proper accounting would separate the gross amount affected from assets actually recovered, customer reimbursements, and any resulting net loss. Until those figures are published and reconciled, a single headline number cannot show where every dollar went.
Key questions and answers
-
How much did Binance say was affected?
Binance’s reported estimate was about $6.3 billion in user funds. The available information does not establish its full methodology or the final financial impact.
-
What did Blockaid trace from Binance 14?
Blockaid valued the initial sweep from the Ethereum hot wallet at roughly $2.5 billion and described additional transfers afterward. Its account does not reconcile the full incident total.
-
Does a freeze mean the funds have been recovered?
No. A freeze restricts movement. Recovery requires a return or another confirmed recovery arrangement, and neither automatically means customers have been reimbursed.
-
Does the EIP-7702 authorization prove a private key was stolen?
No. Blockaid’s analysis describes an authorization and delegation but does not establish how the attacker obtained the ability to submit it.
-
Is Binance’s final loss known?
No. The available information does not provide a reconciled accounting of recovered assets, customer reimbursements, and the resulting net loss.
The central unanswered questions are how the authorization for Binance 14 was obtained and how that event connects to the other reported wallet activity. Until Binance publishes a technical account and a dated reconciliation of affected, frozen, recovered, and reimbursed funds, the $6.3 billion figure remains an estimate, not a complete ledger of the breach.
