Suspected Binance Hack: What Miners Should Check

A suspected Binance hack moved billions of dollars out of wallets that Etherscan labels as Binance's on October 29, 2026. Tether and Circle say they froze more than $2.3 billion in USDT and USDC. Binance says it has disabled withdrawals while its team runs security checks, and it has published no cause and no loss figure.

Read between 22:42 and 22:55 UTC on October 29. The story is developing, so each figure below carries its source and the time of the read.

Is the $5.8 billion Binance hack figure a confirmed loss?

No. Binance has published no loss figure. The $5.8 billion in headlines comes from tallies of wallets and transfers. Cointelegraph reports that Arkham shows about $5.84 billion in wallets it labels "binance-hacker-1029," which FinanceFeeds counts as 55 addresses. The Block quotes Coinbase product leader Conor Grogan putting outflows at up to $5.8 billion. Decrypt splits an on-chain count of $5.57 billion into $3.51 billion on Ethereum, 18,270 BTC ($1.44 billion) and $630 million on Tron. Trackers put Ethereum alone between about $2.5 billion and $3.55 billion. FinanceFeeds warns that totals like these can include swapped assets, older balances and coins counted twice. We checked the Ethereum part ourselves.

The Binance hack on Ethereum, transaction by transaction

We read these transactions from public Ethereum nodes between 22:42 and 22:55 UTC. Each hash opens on Etherscan, so you can repeat the check.

Time (UTC)	What the chain shows	Transaction
20:20:59	A transaction carrying 50 EIP-7702 authorizations points the wallet Etherscan labels Binance 14 at the contract 0x63e8…6fae	0xad99…298b
20:24:23	The same sender calls Binance 14, and 63 tokens move to 0x5227…2f8c, including 1,615,409,498.97 USDT	0x53bd…e2f3
20:24:47	The address Etherscan labels Binance 16 sends 28,005.6 ETH to the same recipient	0x51f2…d39f
20:38:47	The recipient forwards 195,460 ETH to 0x8532…43d4, an account with no outgoing transactions	0x551d…2c76
20:41:23	A second call to Binance 14 moves 780,000,000 USDC from 0xee7a…4055 to the recipient	0xdc10…7481

EIP-7702 lets an ordinary Ethereum account borrow a contract's code. Setting the delegation requires a signature from that account's own key. At 22:55 UTC the code of Binance 14 points at the contract 0x63e8…6fae, and all 50 authorizations in the first transaction name that contract. A valid signature from the key behind Binance 14 therefore existed by 20:21 UTC. The 28,005.6 ETH that left Binance 16 moved in a plain transfer, and a plain transfer also needs a signature from the sender's key. The chain does not show how the attacker got either signature, and Binance has not said.

At 20:32 UTC the researcher Spreek flagged the drain on X and said Tornado Cash funded the call. We did not trace that funding.

Binance, Tether and Circle statements, in order

These are the posts themselves, read from X at 22:52 UTC.

Time (UTC)	Who	What the post says
21:15	Changpeng Zhao, Binance's founder, who says he no longer manages Binance.com	Says it "does look like a hack," says user funds are safe and says he expects all of them to be covered
21:17	Yi He, Binance co-founder	Says Binance knows of reports of a potential security issue and is investigating
21:18	Jeremy Allaire, Circle CEO	Says Circle froze more than 800M USDC tied to the incident, in coordination with law enforcement
21:25	Paolo Ardoino, Tether CEO	Says Tether froze more than 1.567B USDT tied to a potential Binance exchange hack
21:29	Binance	Says user funds are "completely safe," promises updates on official channels and warns against unofficial links and requests for account information
22:08	Yi He	Thanks Ripple for freezing about 200 million
22:15	Binance	Says its team is running security checks and withdrawals will resume when Binance resolves the security issue
22:22	Yi He	Thanks World Liberty Financial for freezing $27M of USD1 and 48M WLFI, and says Binance has disabled withdrawals until its team confirms the environment is secure

Binance has published no incident report, no loss figure and no time for withdrawals to reopen.

Stablecoin freezes and native coins

USDT and USDC are tokens run by companies. Each token contract keeps a blacklist, and the issuer controls it. We read both calls on Ethereum. Tether blacklisted the recipient 0x5227…2f8c at 21:01:35 UTC, 37 minutes after the sweep, and Circle followed at 21:04:59 UTC. The address received 1,615,409,498.97 USDT in the sweep. At 22:55 UTC it holds 1,175,464,711 USDT and 823,000,000 USDC, and both balances are frozen. That is about 440 million USDT less than the sweep delivered, so that amount left before 21:01 UTC.

A freeze stops tokens from moving. As FinanceFeeds points out, it does not hand them back.

Ether has no issuer. The 195,460 ETH forwarded at 20:38:47 UTC sits at 0x8532…43d4, an account that has sent nothing (nonce 0 at 22:55 UTC). No token contract holds a blacklist for ETH, so no freeze call exists for it. The same holds for bitcoin, bitcoin cash and litecoin, the coins a miner earns. Exchanges, courts and law enforcement can act where coins reach a custodian.

Five checks on your payout address

Binance says it has disabled withdrawals. If your rig pays a Binance deposit address, the reward sits in an account that cannot send it out until Binance reopens withdrawals. Any exchange address makes the reward depend on that exchange. Work through these in order.

• Read the address your rig mines to. Open your pool dashboard or your miner's settings and copy the payout address.
• Find out who holds its key. A wallet whose recovery phrase you wrote down is yours. A deposit address you copied from an exchange belongs to the exchange. If you cannot tell which one you have, assume the exchange.
• For an exchange address, use official channels. Read the exchange's own site, app and verified X account. Binance's 21:29 UTC post tells users to distrust unofficial links, messages and requests for account information.
• Expect scams. Fake compensation forms, "unlock your withdrawal" pages and support accounts in your replies follow incidents like this one. Real support does not ask for a recovery phrase or a test deposit.
• Decide on any withdrawal yourself, on the exchange's own site. Nothing here is financial advice, and nobody can tell you when withdrawals reopen.

A NexusPool block reward pays your address

On NexusPool, the coinbase of a block your rig finds pays the whole reward to the address you connected with, inside the block itself (how that path works). The pool holds no balance for you, so no pool balance exists to drain, freeze or skim. The address you supply decides who holds the reward. An exchange deposit address puts the reward in that exchange's custody, and the pool cannot change that. Payout Preflight rebuilds the exact coinbase for your Bitcoin address before you find anything, so you can read where a reward would land. SweetHash, which builds NexusPool, says it holds none of your funds or keys.

Limits of this post

It does not say Binance customers lost money. Binance says user funds are safe. It does not say who made the transfers or how they got the signatures. It does not predict whether the frozen tokens come back, when withdrawals reopen or where prices go. NexusPool changes nothing about this incident, and a payout address you control does not protect funds you keep at an exchange.

Trust nothing. Verify your payout address before your next block.