Hedge

Time

No one

Tornado

Ethereum

<p><strong>Update 10:45 UTC: trail leads to North Korea, withdrawals within 48 hours.</strong> Investigators at <a href="https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history" rel="noopener noreferrer nofollow">TRM Labs</a> attribute the Binance hack with high confidence to North Korea's TraderTraitor group, and Chainalysis points to the same group; Binance has not named an attacker. According to TRM Labs, about $6.36 billion left across ten blockchains, about $2.7 billion is frozen, and the attacker holds more than 420,000 ETH and 18,270 BTC across all wallets. Binance <a href="https://x.com/binance/status/2116026356740034858" rel="noopener noreferrer nofollow">expects</a> to reopen withdrawals within 48 hours; deposits work. Everything in one place: <a href="https://cryptoticker.io/en/binance-hack-north-korea-tradertraitor/" rel="noopener noreferrer nofollow">North Korea behind the Binance hack? What we know</a>.</p>
<p><strong>Update 02:30 UTC: Binance puts the damage at $6.3 billion.</strong> In an <a href="https://www.binance.com/en/support/announcement/c5a8729a97ac486d963784d96c5642d7" rel="noopener noreferrer nofollow">official announcement</a> Binance estimates the total impact at around $6.3 billion, of which about $3 billion is frozen on-chain. According to the initial investigation, a DevOps engineer's laptop was compromised, which let the attacker access a service container and submit unauthorized withdrawal transactions. Binance says it has found no evidence of a private key leak. The exchange will cover all losses from the SAFU fund and company funds; deposits and withdrawals remain suspended, and an updated proof of reserves will follow.</p>
<p><strong>Update 01:25 UTC: Binance confirms the hack.</strong> Co-founder Yi He wrote at 00:04 UTC that user funds are safe and Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while the exchange runs security checks, freezes funds and works with law enforcement. According to on-chain investigator <a href="https://x.com/zachxbt/status/2115972303913935209" rel="noopener noreferrer nofollow">ZachXBT</a>, more than $2.83 billion is now frozen. Before the freezes, the attacker had supplied 60 million USDT to Aave and borrowed 19,762 wETH, about $45 million, against it, as <a href="https://x.com/mzeller/status/2115940092409770194" rel="noopener noreferrer nofollow">Marc Zeller</a> of the Aave Chan Initiative explains.</p>
<blockquote class="twitter-tweet">
 <p>User funds are safe. Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates.</p>Yi He (@heyibinance) <a href="https://x.com/heyibinance/status/2115958049244631357" rel="noopener noreferrer nofollow">October 30, 2026</a>
</blockquote>
<p>Ethereum is under double pressure after the suspected Binance hack. On Thursday night Ether fell from $2,313 to $2,251, down 2.6% within an hour. The bigger risk is still ahead: according to Etherscan about 195,460 ETH sit on an attacker address, worth more than $440 million at 21:25 UTC. Tether and Circle have frozen most of the stolen stablecoins, but Ether cannot be frozen. If the attacker sells, the price takes the hit directly. We calculate how large that pressure really is, which levels matter now and why Ethereum itself was not hacked.</p>
<p>The full timeline of the evening is in our <a href="https://cryptoticker.io/en/crypto-crash-binance-hack-timeline-liquidations/" rel="noopener noreferrer nofollow">crypto crash timeline</a>, the wallet details in our <a href="https://cryptoticker.io/en/binance-hack-hot-wallet-drained/" rel="noopener noreferrer nofollow">Binance hack report</a>.</p>
<p><strong>Advertisement, for readers in the EU:</strong> If you no longer want to keep your coins on Binance after the hack, Bitpanda compares itself with Binance, Kraken, Coinbase and Crypto.com and shows a <a href="https://bitpanda.pxf.io/c/2014360/4118381/15871" rel="noopener noreferrer nofollow">three-step guide to moving your crypto</a>. Bitpanda is licensed in the EU under MiCA. Other MiCA-licensed alternatives in the EU are <a href="https://coinbase-consumer.sjv.io/c/2014360/3849612/9251" rel="noopener noreferrer nofollow">Coinbase</a> (licensed via Luxembourg) and <a href="https://my.okx.com/en-eu/campaigns/cryptoticker-io?channelId=45934865" rel="noopener noreferrer nofollow">OKX</a> (licensed via Malta).</p>
<h2 id="ethereum-crash-what-happened-to-the-eth-price-tonight">Ethereum crash: what happened to the ETH price tonight</h2>
<table>
 <thead>
  <tr>
   <th>Time (UTC)</th>
   <th>ETH price</th>
   <th>What happened</th>
  </tr>
 </thead>
 <tbody>
  <tr>
   <td>20:15</td>
   <td>$2,313</td>
   <td>Starting point before the outflow</td>
  </tr>
  <tr>
   <td>20:24</td>
   <td>falling</td>
   <td>167,464 ETH and 63 tokens leave the Binance wallet in one transaction</td>
  </tr>
  <tr>
   <td>20:39</td>
   <td>falling</td>
   <td>About 195,460 ETH are moved on to another address</td>
  </tr>
  <tr>
   <td>21:05</td>
   <td>$2,251</td>
   <td>Evening low, 2.6% below 20:15 UTC</td>
  </tr>
  <tr>
   <td>21:25</td>
   <td>$2,284</td>
   <td>Slight recovery after the Tether and Circle freezes</td>
  </tr>
 </tbody>
</table>
<p>Prices from <a href="https://www.coingecko.com/en/coins/ethereum" rel="noopener noreferrer nofollow">CoinGecko</a> in five-minute steps. Over 24 hours Ether was down 3.6% at 21:23 UTC according to CoinMarketCap, 4.7% over seven days, weaker than Bitcoin at 2.6%.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/ethereum_crash_binance_hacker_195000_eth_2_5243d405e0.webp" alt="Silver coins falling like rain into a dark puddle with red light reflections" width="1920" height="1080">
 <figcaption>
  AI-generated illustration
 </figcaption>
</figure>
<h2 id="the-hacker-sits-on-195-000-eth-how-big-is-the-selling-pressure">The hacker sits on 195,000 ETH: how big is the selling pressure?</h2>
<p>More than $440 million sounds like a lot. Relative to the market it is less than the first shock suggests: CoinMarketCap showed about $15 billion in Ether traded in the 24 hours to 21:23 UTC. The loot equals just under 3% of one day's volume. Selling it all at once would still move the price noticeably, because it would hit order books thinned out by the evening's liquidation wave.</p>
<p><strong>As of 22:13 UTC:</strong> the 195,460 ETH are still untouched on <a href="https://eth.blockscout.com/address/0x8532FA14ACAf483729C449b8458aedDb900543D4" rel="noopener noreferrer nofollow">0x8532…43D4</a>, Blockscout data show. The first attacker address is moving, though: since 21:22 UTC it has been sending out tokens Tether and Circle cannot freeze, including 29,934 WBETH, 7.0 million UNI and 217.5 million ENA, and funding fresh addresses with 0.5 to 1 ETH each for gas. That is how laundering usually begins.</p>
<blockquote class="twitter-tweet">
 <p>1/4 EIP-7702 can turn the wallet itself into the sweeper. A Binance-labeled wallet moved 167,464 ETH + 63 tokens, including 1.615B USDT, just 3m24s after a signed delegation was installed. This is bad.</p>odysseas.eth (@odysseas_eth) <a href="https://x.com/odysseas_eth/status/2115910280140276155" rel="noopener noreferrer nofollow">October 29, 2026</a>
</blockquote>
<p>Professional attackers therefore rarely sell in one go. After the Bybit hack in February 2025 the stolen Ether was swapped in tranches over days and bridged to other blockchains. For Ethereum this means the pressure is more likely to come as steady rain than as a cloudburst, and every move of the attacker address will make headlines in the coming days. The address was funded with 0.1 ETH from the mixer Tornado Cash, a pattern investigators know from groups that launder loot through mixers and decentralized exchanges rather than selling on a centralized exchange with identity checks.</p>
<h2 id="was-ethereum-hacked">Was Ethereum hacked?</h2>
<p>No. The blockchain worked exactly as designed. The attacker used EIP-7702, a feature live since the Pectra upgrade in May 2025 that lets a wallet hand its control to a smart contract. That requires a signature with the key of that very wallet. Whoever holds it controls the wallet, with or without EIP-7702. The weakness lies in key handling, not in the protocol. For Ethereum as a technology tonight changes nothing. For the price it does, because traders do not separate the two in the short term.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/ethereum_crash_binance_hacker_195000_eth_3_b055d75fc3.webp" alt="Fountain pen above an empty signature pad next to a hardware wallet, red warning light" width="1920" height="1080">
 <figcaption>
  AI-generated illustration
 </figcaption>
</figure>
<p><strong>More on the Binance hack</strong></p>
<ul>
 <li><a href="https://cryptoticker.io/en/binance-hack-hot-wallet-drained/" rel="noopener noreferrer nofollow">Binance hack: how the hot wallet was drained</a></li>
 <li><a href="https://cryptoticker.io/en/binance-hack-on-chain-analysis/" rel="noopener noreferrer nofollow">On-chain analysis: what the blockchain shows about the hack</a></li>
 <li><a href="https://cryptoticker.io/en/crypto-crash-binance-hack-timeline-liquidations/" rel="noopener noreferrer nofollow">Live ticker and timeline: the crypto crash after the hack</a></li>
 <li><a href="https://cryptoticker.io/en/tether-freeze-usdt-binance-hack-how-much-frozen/" rel="noopener noreferrer nofollow">USDT frozen: what Tether and Circle really blocked</a></li>
 <li><a href="https://cryptoticker.io/en/binance-withdrawals-solana-xrp-paused-after-hack/" rel="noopener noreferrer nofollow">Binance withdrawals: which networks are paused</a></li>
 <li><a href="https://cryptoticker.io/en/is-this-the-end-how-low-can-bitcoin-fall-binance-hack/" rel="noopener noreferrer nofollow">Is this the end? Three scenarios for Bitcoin</a></li>
 <li><a href="https://cryptoticker.io/en/solana-crash-below-100-binance-hack-sol-80/" rel="noopener noreferrer nofollow">Solana below $100: is $80 next?</a></li>
 <li><a href="https://cryptoticker.io/en/bnb-price-crash-binance-hack-ftt-comparison/" rel="noopener noreferrer nofollow">BNB crash: another FTT moment?</a></li>
 <li><a href="https://cryptoticker.io/en/biggest-crypto-hacks-in-history-binance/" rel="noopener noreferrer nofollow">The biggest crypto hacks in history</a></li>
 <li><a href="https://cryptoticker.io/en/how-to-short-bitcoin-crash-bitget/" rel="noopener noreferrer nofollow">How to short Bitcoin in the crash</a></li>
 <li><a href="https://cryptoticker.io/en/why-is-crypto-down-crypto-crash-reason-today/" rel="noopener noreferrer nofollow">Why is crypto down today?</a></li>
</ul>
<h2 id="how-low-can-the-ethereum-price-go">How low can the Ethereum price go?</h2>
<p>No one can seriously predict that. The levels where buyers stepped in over recent months come from the price history on CoinGecko:</p>
<table>
 <thead>
  <tr>
   <th>Level</th>
   <th>Price</th>
   <th>Distance from $2,284</th>
  </tr>
 </thead>
 <tbody>
  <tr>
   <td>Evening low, Oct 29</td>
   <td>$2,251</td>
   <td>−1.4%</td>
  </tr>
  <tr>
   <td>Round number</td>
   <td>$2,000</td>
   <td>−12.4%</td>
  </tr>
  <tr>
   <td>90-day low (Aug 2)</td>
   <td>$1,843</td>
   <td>−19.3%</td>
  </tr>
  <tr>
   <td>12-month low (Jun 26)</td>
   <td>$1,566</td>
   <td>−31.4%</td>
  </tr>
  <tr>
   <td>12-month high (Nov 3, 2025)</td>
   <td>$3,905</td>
   <td>+71.0%</td>
  </tr>
 </tbody>
</table>
<p>The $2,000 mark matters psychologically. Where analysts see Ether by year-end is collected in our <a href="https://cryptoticker.io/en/prediction/ethereum-price-prediction/" rel="noopener noreferrer nofollow">Ethereum price prediction</a>.</p>
<h2 id="what-eth-holders-can-do-now">What ETH holders can do now</h2>
<ul>
 <li><strong>Watch the attacker address.</strong> Moves of the 195,460 ETH can be followed on Etherscan. Large transfers to decentralized exchanges are the signal the market will react to.</li>
 <li><strong>Self-custody.</strong> If you hold Ether on Binance, you can withdraw it to your own wallet. Our <a href="https://cryptoticker.io/en/comparison/hardware-wallets/" rel="noopener noreferrer nofollow">hardware wallet comparison</a> shows suitable devices.</li>
 <li><strong>No signature without checking.</strong> Tonight shows how much power a single signature has. Do not confirm anything in your wallet that you did not trigger yourself.</li>
 <li><strong>Hedge instead of guessing.</strong> If you want protection against further falls, our guide <a href="https://cryptoticker.io/en/how-to-short-bitcoin-crash-bitget/" rel="noopener noreferrer nofollow">how to short Bitcoin</a> explains the options and their risks.</li>
</ul>
<p>This article is not investment advice. Crypto assets are highly volatile and you can lose your entire investment.</p>

Ethereum Crash: The Binance Hacker Sits on 195,000 ETH. Is a Sell-Off Coming?

Table of Contents

CryptoTicker ENG

Other articles published on Oct 29, 2026

Join our free newsletter for daily crypto updates!