Binance hack: what we know & what teams should do now

On October 29, 2026, starting at 20:20 UTC, wallets that Crystal attributes to Binance sent billions of dollars in crypto assets out on Bitcoin, Ethereum, and other chains in the Binance hack. Binance said on X that its teams are “aware of reports of a potential security issue and are actively investigating”, and in an updated post that “User funds are completely safe.”

In a later post at 22:15 UTC, Binance said its team was “conducting security checks” and that “Withdrawals will resume as soon as the security issue is fully resolved.” At 02:25 UTC on October 30, Binance published its preliminary findings: a possibly compromised laptop of a DevOps engineer gave access to a service container, from which the unauthorized withdrawals were made; Binance found no evidence that a private key leaked, puts the impact at about $6.3B, says about $3B has been frozen, and will cover all losses.

Crystal has labeled the receiving cluster as a potential Binance thief, in the stolen-coins category, and our analysts are following the onward flow as reports come in from industry partners. This article sets out what Crystal data shows so far, what it does not show yet, and what compliance teams at exchanges, payment firms, and banks should do in the next 48 hours, including how Crystal customers can raise their alerting in Crystal Expert today.

We will update this article as verified information comes in.

Key points

• Crystal’s graph traces $5.14 billion leaving wallets attributed to Binance in 97 transactions: $2.64B on Ethereum and Arbitrum, $1.48B on Bitcoin, $628M on Tron, and $396M on Solana and XRP.

• On Ethereum, the attacker installed an EIP-7702 delegation on a Binance hot wallet with one of fifty pre-signed authorizations, a pattern that points to compromised signing access rather than a stolen key. Binance’s preliminary findings, with no evidence of a private key leak, point the same way.

• Tether and Circle have frozen large stablecoin balances and Binance puts the frozen total at about $3B, but part of the funds has already moved on to wallets that partners have reported, and 60M USDT went into Aave to borrow ETH that no issuer can freeze.

• Industry partners are reporting downstream wallets as they find them, so alerts may show “victim report” labels. Review the fund flow behind every such alert before deciding.

• Attribution will change over the next 48 hours. Recheck recent deposits, not just new ones.

• Crystal customers can add a custom group for services used in previous large attacks and alert on it in Crystal Expert.

What is confirmed comes from the companies involved:

A delegation is installed only if the wallet’s own private key signs the authorization. The sender, 0x7C86, only paid the gas and broadcast the transaction. So the attacker either held the key to Binance 14 or had access to the signing infrastructure, such as an HSM or an MPC signer, that produced the signature.

Fifty signatures point to signing access, not a stolen key. The delegation transaction did not carry one authorization. It carried fifty, signed over consecutive nonces, and only one of them was valid. A type-0x04 transaction skips any authorization whose nonce does not match the wallet’s current nonce, so the other 49 cost nothing but gas. The attacker apparently could not know the hot wallet’s live nonce and covered a range instead. Binance 14 has more than 31 million transactions, so its nonce moves by the minute, and fifty slots buy a window of a few minutes at most.

Anyone holding the key would have signed one authorization with the correct nonce seconds before sending it, or skipped EIP-7702 and sent ordinary transfers. Pre-signing fifty variants fits someone who could use the signer once, under conditions they did not control. The four hours between deploying the sweeper (15:59 UTC) and installing the delegation (20:20 UTC) fit the same picture: the signatures were already in hand.

The explanation most consistent with the on-chain data is therefore a compromised signing path rather than a leaked key: an HSM proxy, an MPC node, or a signing service that signed fifty arbitrary hashes, either because it signs blind or because its checks did not recognize an EIP-7702 authorization as something that can move funds. Binance’s preliminary findings, published at 02:25 UTC on October 30, fit this reading: a possibly compromised DevOps engineer’s laptop gave access to a service container from which the unauthorized withdrawals were made, and Binance found no evidence of a private key leak. A service container that can ask the wallet’s signer for signatures is the kind of signing path the fifty authorizations describe: usable once, without the key.

EIP-7702 exists only on Ethereum and other EVM networks, so it explains the Ethereum legs. How the Bitcoin outflows, which began in the same minute, and the Tron, Solana, and XRP outflows were authorized is not yet known. For custodians and exchanges, the lesson is about signing policy: a signer that does not decode what it signs can hand over a wallet without moving a single coin itself.

Crystal labels the receiving cluster on Ethereum as a potential Binance thief, in the stolen-coins category, with a risk score of 100. As of 22:30 UTC on October 29, Crystal data shows:

• $5.14B left wallets attributed to Binance in 97 transactions on Ethereum, Arbitrum, Bitcoin, Tron, Solana, and XRP by 22:30 UTC (the split by network is in the key points above). Binance’s preliminary figure for the impact is about $6.3B; the difference is what the graph had not yet traced at that time.

• Bitcoin came first. 18,270.2 BTC left a Binance wallet at 20:20 UTC in 11 transactions, four minutes before the Ethereum transfers. Two onward transfers of 1,000 BTC each followed.

• One Ethereum transaction carried $2.40B. At 20:24:23 UTC a single transaction moved 53 different assets to the labeled cluster, including 1.615B USDT ($1.61B), 167,464 ETH ($391M), RLUSD, and tokenized gold (XAUT). Nine more transfers followed within 24 seconds, among them 28,005.6 ETH ($65.4M), and four more on Arbitrum ($32.2M) by 20:34 UTC.

• Tron, Solana, and XRP legs. On Tron, 612.7M USDT and 46.4M TRX went to an address the graph marks as banned, and 300M USDT has moved on from there. On Solana and XRP, 970,522 SOL and 233.5M XRP went to an address partners have reported.

• The stablecoin freezes are visible on-chain. Crystal tags the cluster’s Ethereum address as banned by the token contract, which is consistent with Tether’s freeze.

• Part of the funds has moved on, some of it into assets no issuer can freeze. The graph shows onward transfers from the cluster to wallets that partners have reported, among them 190M USDT, and further hops between reported wallets, among them 130M USDT. At 21:35 UTC, 57,891.8 ETH ($130.8M) moved from one reported wallet to another. Between 20:58 and 21:01 UTC, 60M USDT from the cluster was deposited into Aave as collateral and 19,762 WETH was borrowed against it: USDT can be frozen by its issuer; the borrowed ETH cannot.

Above: Outflows from wallets Crystal attributes to Binance, by network, as traced in the Crystal graph at 22:30 UTC, October 29, 2026. Source: Crystal Intelligence.

Above: The outflows from Binance in the Crystal graph, by network, with the onward hops to reported wallets. Screenshot from Crystal Expert, October 29, 2026. 

One point matters for anyone screening against this data. Binance itself remains a licensed exchange with a low risk score in Crystal, and the graph links only the transfers above to this event, not ordinary withdrawals from Binance.

The label tells you that a partner has reported the wallet. It does not tell you the role your customer played. A deposit that touches a reported wallet may come from the laundering path, from a service the funds passed through, or from a user who received a small amount further downstream. Review the fund flow for every such alert before you freeze, reject, or file: open the transfer in the graph, follow it back to the labeled cluster, and record the path you relied on.

Large thefts follow a familiar pattern: the proceeds are swapped into assets that are harder to freeze (the Aave leg above, USDT in and borrowed ETH out, is this incident’s first example), moved across chains, and broken into smaller amounts before they reach a service that pays out. Every step creates exposure for whoever sits next in line. We recommend that compliance teams:

1. Review large incoming transactions from bridges, instant swap services, and mixing services. These are the services the funds need next.

2. Watch account behavior. Flag large volumes and sudden changes in a customer’s activity, especially new accounts and dormant accounts that wake up.

3. Look out for rapid deposits and withdrawals, where funds arrive and leave again within minutes.

4. Recheck funds continually. Attribution will change over the next 48 hours as more wallets are reported. A deposit that screened clean this morning can carry exposure by tomorrow.

5. Review the fund flow behind every “victim report” alert, as set out above, and keep the evidence with your decision.

A quick setup guide in Crystal Expert:

1. Create a custom group that contains the services listed above.

2. Include the group in your monitoring rule, with the alert grade set to high or severe. A custom group raises the alert grade; it does not change the risk score, which the risk score profile sets per entity type.

3. Turn on recheck notifications for changed or increased risk, so transfers already in your monitoring alert again when attribution updates.

4. Investigate each alert in the graph before you decide, and keep the path with your case notes.

Detailed configuration advice is in the product documentation on custom entity groups, and your Crystal account manager can help you set it up.

This is what decision intelligence for digital assets means on a day like this one. Decision intelligence for digital assets is the discipline of putting verified evidence in front of every decision an organization makes about digital assets. Here, that evidence is the label on the cluster, the reported wallets, and the path that connects them to a deposit in front of you. Crystal surfaces; humans decide.

Binance’s preliminary figure for the impact is about $6.3B, with about $3B frozen. Crystal’s graph, as of 22:30 UTC on October 29, traces $5.14B in 97 transactions: $2.64B on Ethereum and Arbitrum, $1.48B on Bitcoin, $628M on Tron, and $396M on Solana and XRP; the gap is what the graph had not yet traced at that time. Tether and Circle have frozen part of the stablecoins involved.

No. Binance remains a licensed exchange with a low risk score, and Crystal data does not link ordinary Binance withdrawals to this event. The risk sits with the labeled cluster and the wallets downstream of it.

It means an industry partner has reported a wallet in connection with the incident. Review the fund flow before acting, because the alert alone does not show your customer’s role.

We do not recommend a blanket block. Raise the alert grade for them, alert on large or unusual volumes, and review those transfers by hand for the next few days.