The Binance hack has been confirmed, and it is the largest cryptocurrency hack in history. Blockchain investigators traced up to $5.5 billion in suspicious transfers from the exchange’s hot wallets on Thursday.
Stablecoin issuers have already intervened. Tether confirmed freezing more than $1.567 billion in USDT, while Circle blocked more than $800 million in USDC.
Ripple also reportedly froze approximately $200 million.
That brings the reported frozen amount to nearly $2.6 billion, although the total stolen remains unconfirmed.
As of writing, both Binance exchange withdrawals and Binance Alpha trading remain suspended.
The incident added pressure to an already falling crypto market. Bitcoin dropped below $79,000, while BNB fell sharply.
How Did the Binance Hack Happen?
Security researchers suspect attackers exploited an Ethereum feature called EIP-7702 to gain control of a Binance hot wallet.
1. The Attacker Gained Control of Wallet Permissions
EIP-7702 allows an ordinary Ethereum wallet to authorize a smart contract to act on its behalf.
Investigators found that Binance’s wallet appeared to have delegated control to an unverified contract. How the attacker obtained the required authorization remains unknown.
2. The Attacker Tried 50 Authorizations
Researchers say the attacker submitted 50 signed authorizations with different transaction sequence numbers, known as nonces.
Binance’s wallet was processing transactions continuously. Only the authorization matching its current sequence number succeeded.
That allowed the malicious contract to become active.
3. The Contract Began Draining Funds
The contract reportedly contained functions designed to withdraw ETH and other tokens.
Within minutes, approximately 167,464 ETH and 1.615 billion USDT were transferred from Binance 14, alongside dozens of other cryptocurrencies.
Funds subsequently moved through this receiving address.
4. The Threat Could Continue
Researchers warned that the malicious delegation could remain active until replaced or revoked.
That means newly deposited funds could also be exposed if the affected wallet continued operating under attacker-controlled code.
Binance has not published a technical explanation confirming this attack mechanism.
What Should Binance Users Do Right Now?
Hot wallets are internet-connected exchange wallets used to process customer transactions. Their exposure does not automatically mean individual customer accounts have been compromised.
Users should take the following precautions:
- Check official Binance updates. Monitor withdrawal availability through the Binance app or website.
- Avoid suspicious links. Ignore messages offering hack compensation, emergency withdrawals or account recovery.
- Enable two-factor authentication. Prefer an authenticator app or security key.
- Verify withdrawal addresses. Check the entire address before transferring funds. Address-poisoning scams can place lookalike addresses in transaction histories.
- Never share recovery phrases or private keys. Binance support will not need them.
Binance says user funds remain safe. The final extent of the suspected breach, including any customer losses, is still under investigation.
