Binance Hot Wallets Drained of $3.3 Billion Through an EIP-7702 Delegation — CZ Says It Looks Like a Hack, Tether and Circle Freeze $1.8 Billion

At 20:24 UTC on 29 October 2026, a single transaction moved 167,464 ETH and 63 tokens — including roughly $1.6 billion in USDT — out of the wallet Etherscan labels “Binance 14”. Twenty-four seconds later a second exchange wallet, “Binance 16”, sent another 28,005 ETH to the same destination. A later call through the same delegated wallet pulled a further 780 million USDC out of “Hot Wallet 34”.

What the chain shows

The receiving address, 0x5227…2f8c, did not exist before that day. Within fifteen minutes it forwarded 195,460 ETH to yet another fresh address while still holding around $1.5 billion in tokens.

By Unchained’s own count of Ethereum transfers, the receiving address took in about $3.52 billion between 16:24 and 17:04 ET: 197,170 ETH, 1.68 billion USDT, 823 million USDC and roughly $564 million across 62 other tokens. That figure excludes Bitcoin and other chains, where reported outflows remain unverified.

The vector: EIP-7702

The mechanism was not a stolen private key in the classic sense. At 20:20 UTC an address funded only through Tornado Cash’s 0.1 ETH pool installed an EIP-7702 delegation on Binance 14, pointing it at a contract the same address had deployed hours earlier.

EIP-7702 has been live on Ethereum since the Pectra upgrade in May 2025. It lets an ordinary wallet execute a smart contract’s code, and setting a delegation requires a signature from that wallet’s key. On-chain analyst Detective Pho noted the authorising transaction carried 50 delegations at once, one for each following nonce — a structure that complicates a fast revocation.

The network fee for moving billions of dollars of assets was $0.93.

The freeze race

Tether blacklisted the receiving address at 17:01 ET, locking roughly 975 million USDT, later reported at more than 1.567 billion. Circle followed three minutes later with 823 million USDC. Tether also blacklisted seven downstream wallets, two of which held about 205 million USDT between them.

Together the two issuers immobilised somewhere between $1.8 billion and $2.4 billion in stablecoins within about an hour of the outflows being detected. The attacker’s ETH and other non-stablecoin holdings sit outside any issuer’s reach.

What Binance said, and when

The exchange’s first statement, at 17:16 ET, said its teams were “actively investigating” a “potential security issue” and had “not confirmed any impact to user funds”. Thirteen minutes later a revised statement said “user funds are completely safe”.

Changpeng Zhao, who no longer runs the exchange but remains a shareholder, posted a minute before that first statement: “It does look like a hack on Binance.” He thanked Tether and Circle for the freezes and said he expects all user funds to be fully covered.

Users have reported withdrawals stuck at processing.

Market impact

Bitcoin slid from $80,327 to $78,763 inside the hour and tested $78,000. Ether fell about 3% to $2,271. BNB took the hardest hit, down as much as 9% to $703 — the token of the exchange itself absorbing the immediate repricing.

Coinglass data put liquidations at $627.7 million in a single hour, $606.6 million of it on longs. Leveraged traders paid for the worst case before any facts were established.

Context

If this is confirmed as theft, it dwarfs the $1.5 billion Bybit hack of February 2025 and the $388 million Bitget exploit last month. The same day, prediction market Polymarket halted trading amid reports of drained user wallets.

The user-facing lesson is address hygiene: verify full recipient addresses character by character, use saved withdrawal allowlists, and never copy an address out of a transaction history.