Binance suspended deposits and withdrawals on Thursday after hot wallets on Ethereum were drained of what on-chain trackers estimate at $3.3 billion or more, which would make it the largest crypto theft on record. The exchange said it "will cover all losses" in a post on X , adding that deposits and withdrawals would stay suspended while it "conducts security checks, freezes funds, and works with law enforcement."
The outflows began at about 20:24 UTC on October 29, when a single transaction moved 167,464 ETH, about 1.6 billion USDT and dozens of other tokens from the hot wallet labeled Binance 14 to an outside address. Transfers from a second ETH hot wallet and a USDC hot wallet followed within minutes. Security firm Blockaid said the attacker used Ethereum's EIP-7702 feature, which lets a wallet delegate control to contract code, to hand Binance 14 to an unverified "sweeper" contract. Binance has not confirmed how the attack worked, and some analysts have pointed to North Korea, but no official attribution has been made.
Estimates of the total vary because they count different things. Roughly $2.8 billion to $3.5 billion is directly traceable to the Ethereum drain. Higher figures of $5.3 billion to $5.9 billion from Glassnode, Arkham and Chainalysis also include about 18,000 BTC and Tron outflows that have not been tied to the same attack, CoinDesk reported .
Binance's messaging shifted over the evening. Its first statement said it had "not confirmed any impact to user funds," and the post was edited twice to say "User funds are completely safe." Former CEO Changpeng Zhao, who said he no longer manages the exchange, wrote that "it does look like a hack on Binance." The exchange later put the verified total frozen at $2.54 billion. Tether CEO Paolo Ardoino said the company had frozen more than 1.567 billion USDT, and Circle CEO Jeremy Allaire said more than 800 million USDC had been frozen "in coordination with law enforcement." The roughly 195,000 stolen ETH, which no issuer can freeze, has already been moved to a second address.
Even the conservative estimate is about double the roughly $1.5 billion taken from Bybit in February 2025, which the FBI attributed to North Korea's Lazarus Group. BNB was trading near $690 on Friday, down about 9% over 24 hours, according to CoinGecko .
Hours before the Binance outflows, Polymarket put its international exchange into cancel-only mode after malicious code loaded through a third-party script drained user accounts. "One of our 3rd party providers was compromised, and we have referred this to relevant law enforcement," the company said on X , adding that "anyone who has been impacted will be made whole." Website-monitoring firm DebugBear told customers it was "impacted by an ongoing security incident" and asked them to remove its embed code. Analysis by Hudson Rock found the injected code used victims' logged-in sessions to sell their positions or transfer them out.
On-chain data puts Polymarket users' losses at about $2.6 million to $2.7 million, though the company has not disclosed a figure. Trading resumed around 19:00 UTC, Polymarket said , and analysts said its smart contracts worked as designed. No link between the two incidents has been established.
Binance has promised a full post-mortem once its investigation is complete. CoinDesk estimated the drain took about 5.6% of the exchange's ETH reserves, and Binance's next proof-of-reserves snapshot, due November 1, will show whether that gap has been filled.
