Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
Newest first. The raw hash is the SHA-256 of the stored copy exactly as fetched. The text hash is of the text extracted from it, which is what is compared between captures.
Attacks on signing infrastructure, where an attacker makes an organization’s own keys sign for them, remain the largest source of losses onchain, and at Binance’s estimate of $6.3B this is the largest theft on record, more than four times the roughly $1.5B taken from Bybit in February 2025.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Blockaid relays Binance's estimate; the 'largest theft on record' wording is Blockaid's.
Eleven Binance hot-wallet keys signed transfers to an address created minutes earlier, and one of them signed an EIP-7702 authorization that turned its wallet into standing infrastructure for the attacker.
At 20:20:59 the operator sent a [type-4 transaction](https://etherscan.io/tx/0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b) to Binance 14, [0x28C6c06298d514Db089934071355E5743bf21d60](https://etherscan.io/address/0x28C6c06298d514Db089934071355E5743bf21d60) , carrying 50 EIP-7702 authorizations signed with the Binance 14 key, one per nonce from 18,914,775 to 18,914,824, each delegating the wallet to the sweeper.
The attacker first drained Binance 14 starting 20:24 UTC in a single transaction worth about $2.5B, minutes after Binance’s own signing infrastructure, under the attacker’s control, signed an EIP-7702 authorization delegating it to an attacker-deployed sweeper.
At 20:24:23, three minutes and 24 seconds later, the operator called sweep on Binance 14 ([transaction](https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3) ), sending 167,464 ETH, 1.615B USDT, and about 60 other tokens to a collection address with no prior history, [0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c](https://etherscan.io/address/0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c) . Binance 14 was left with 1 ETH. At prices at the time, the basket was worth about $2.5B.
At 20:41:23 the operator used the still-delegated Binance 14, which owns the Circle smart account [Binance Hot Wallet 34](https://etherscan.io/address/0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055) , to [move 780M USDC](https://etherscan.io/tx/0xdc102dd89dded5a83f1008906883ffb7c81ff3b7d7965d8c7277d170b5e17481) from that account to the collection address, followed by another 43M USDC.
At 21:44 it [swept Binance 14 again](https://etherscan.io/tx/0x55ba4dabc41b468e580751373ad31acdee6f5ba398682df2c93e5a8340870556) for 200M USDT and 13 other tokens deposited since the first sweep.
About $6.3B was stolen from Binance’s hot wallets on October 29, 2026, by Binance’s own estimate, across Ethereum, Arbitrum, Avalanche, Optimism, Bitcoin, Tron, and other chains, the largest crypto theft on record.
Tether and Circle froze about $1.8B in the main collection address within 40 minutes, and with later freezes by other issuers and the Arbitrum Security Council, Binance puts the verified total frozen at about $3B.
The operator address, [0x7C8601d4645b93cea45F71e118A729332e6B5CA0](https://etherscan.io/address/0x7C8601d4645b93cea45F71e118A729332e6B5CA0) , was funded through three Tornado Cash withdrawals starting October 28.