Aave

<p><strong>Update 10:45 UTC: trail leads to North Korea, withdrawals within 48 hours.</strong> Investigators at <a href="https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history" rel="noopener noreferrer nofollow">TRM Labs</a> attribute the Binance hack with high confidence to North Korea's TraderTraitor group, and Chainalysis points to the same group; Binance has not named an attacker. According to TRM Labs, about $6.36 billion left across ten blockchains, about $2.7 billion is frozen, and the attacker holds more than 420,000 ETH and 18,270 BTC across all wallets. Binance <a href="https://x.com/binance/status/2116026356740034858" rel="noopener noreferrer nofollow">expects</a> to reopen withdrawals within 48 hours; deposits work. Everything in one place: <a href="https://cryptoticker.io/en/binance-hack-north-korea-tradertraitor/" rel="noopener noreferrer nofollow">North Korea behind the Binance hack? What we know</a>.</p>
<p><strong>Update 02:30 UTC: Binance puts the damage at $6.3 billion.</strong> In an <a href="https://www.binance.com/en/support/announcement/c5a8729a97ac486d963784d96c5642d7" rel="noopener noreferrer nofollow">official announcement</a> Binance estimates the total impact at around $6.3 billion, of which about $3 billion is frozen on-chain. According to the initial investigation, a DevOps engineer's laptop was compromised, which let the attacker access a service container and submit unauthorized withdrawal transactions. Binance says it has found no evidence of a private key leak. The exchange will cover all losses from the SAFU fund and company funds; deposits and withdrawals remain suspended, and an updated proof of reserves will follow.</p>
<p>What really happened in the Binance hack? Our analysis of the blockchain data shows: on October 29, 2026 an attacker took control of the hot wallet "Binance 14" with 50 simultaneously submitted signatures and drained about $2.7 billion within seconds. Binance confirmed the hack overnight and says it will cover all losses. According to our measurements and investigators, more than $2.83 billion is frozen, and the attacker is left mainly with 197,460 ETH. Here is what we verified ourselves, what the key voices on X say and where this is heading.</p>
<p>The minute-by-minute account is in our <a href="https://cryptoticker.io/en/crypto-crash-binance-hack-timeline-liquidations/" rel="noopener noreferrer nofollow">timeline with live ticker</a>, the news itself in our <a href="https://cryptoticker.io/en/binance-hack-hot-wallet-drained/" rel="noopener noreferrer nofollow">Binance hack report</a>.</p>
<p><strong>Advertisement, for readers in the EU:</strong> If you no longer want to keep your coins on Binance after the hack, Bitpanda compares itself with Binance, Kraken, Coinbase and Crypto.com and shows a <a href="https://bitpanda.pxf.io/c/2014360/4118381/15871" rel="noopener noreferrer nofollow">three-step guide to moving your crypto</a>. Bitpanda is licensed in the EU under MiCA. Other MiCA-licensed alternatives in the EU are <a href="https://coinbase-consumer.sjv.io/c/2014360/3849612/9251" rel="noopener noreferrer nofollow">Coinbase</a> (licensed via Luxembourg) and <a href="https://my.okx.com/en-eu/campaigns/cryptoticker-io?channelId=45934865" rel="noopener noreferrer nofollow">OKX</a> (licensed via Malta).</p>
<h2 id="hack-or-internal-transfer-the-first-debate-of-the-night">Hack or internal transfer? The first debate of the night</h2>
<p>In the first hour it was not clear there had been an attack at all. Analyst Simba considered a planned migration between Binance wallets possible: the destination was freshly created and had not moved the funds at first.</p>
<blockquote class="twitter-tweet">
 <p>BREAKING: $2.7 BILLION JUST MOVED OUT OF BINANCE IN 24 SECONDS. Everyone is screaming HACK. But the onchain evidence tells a VERY different story.</p>Simba (@Simba_crpt) <a href="https://x.com/simba_crpt/status/2115936855460130875" rel="noopener noreferrer nofollow">October 29, 2026</a>
</blockquote>
<p>The theory did not last. The address behind the attack was funded with 0.1 ETH from the mixer Tornado Cash, the wallet was bound to an outside contract, and shortly after the attacker began spreading tokens across dozens of addresses. At 00:04 UTC Binance co-founder Yi He confirmed the hack:</p>
<blockquote class="twitter-tweet">
 <p>User funds are safe. Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.</p>Yi He (@heyibinance) <a href="https://x.com/heyibinance/status/2115958049244631357" rel="noopener noreferrer nofollow">October 30, 2026</a>
</blockquote>
<h2 id="how-the-attack-worked-50-signatures-one-hit">How the attack worked: 50 signatures, one hit</h2>
<p>Security firm Blockaid found the decisive technical trick, and we verified it directly on-chain. The attack transaction is of the new type 4, which since the Pectra upgrade lets a wallet hand its control to a smart contract via EIP-7702. It contains exactly 50 such authorizations, all for the Binance 14 wallet, all pointing to the same attacker contract, for nonces 18,914,775 to 18,914,824 (<a href="https://etherscan.io/tx/0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b" rel="noopener noreferrer nofollow">transaction on Etherscan</a>).</p>
<blockquote class="twitter-tweet">
 <p>The attacker didn't know Binance 14's live nonce. So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx. Only 1 of 50 was a hit.</p>Blockaid (@blockaid_) <a href="https://x.com/blockaid_/status/2115924317888495661" rel="noopener noreferrer nofollow">October 29, 2026</a>
</blockquote>
<p>The background: such an authorization is only valid for the nonce the wallet has at the moment of inclusion. Because the hot wallet kept sending withdrawals, the attacker did not know the nonce and fired 50 authorizations at once. One landed. More important is what 50 authorizations require: each must be signed with the wallet's key. The attacker could therefore produce signatures for Binance 14. How he gained that access is for Binance's announced post-mortem to explain. The delegation has since been removed: according to our query at 01:20 UTC the wallet's code is empty again.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/binance_hack_on_chain_analyse_2_17381a30a0.webp" alt="Investigation wall with photos, red threads and coins in a dark room" width="1920" height="1080">
 <figcaption>
  AI-generated illustration
 </figcaption>
</figure>
<h2 id="where-is-the-money-our-tally-at-01-30-utc">Where is the money? Our tally at 01:30 UTC</h2>
<p>About $2.7 billion left the two Binance wallets on Ethereum, plus smaller amounts on other chains. Most of it is blocked, but not all. Binance itself now puts the total impact across all chains at around $6.3 billion, about $3 billion of it frozen; the breakdown below shows what is visible on Ethereum.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/binance_hack_wo_ist_das_geld_en_2026_10_30_70da5e79ac.webp" alt="Bar chart: where is the money from the Binance hack? Frozen about 2,830 million dollars, Ether held by the attacker 436 million, smaller tokens distributed 122 million, borrowed via Aave 45 million, other blockchains 43 million" width="1920" height="1080">
 <figcaption>
  Own chart, sources: ZachXBT, Blockscout, Ethereum node, Marc Zeller, Blockaid
 </figcaption>
</figure>
<table>
 <thead>
  <tr>
   <th>Item</th>
   <th>Amount</th>
   <th>Source</th>
  </tr>
 </thead>
 <tbody>
  <tr>
   <td>Frozen</td>
   <td>more than $2.83B, including 1,767.6M USDT, 823M USDC, 40.5M RLUSD, 27.8M USD1, 29,934 WBETH</td>
   <td>ZachXBT</td>
  </tr>
  <tr>
   <td>of which verified by us</td>
   <td>1,175.5M USDT and 823.0M USDC frozen on <a href="https://eth.blockscout.com/address/0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c" rel="noopener noreferrer nofollow">0x5227…2f8c</a></td>
   <td>own contract query</td>
  </tr>
  <tr>
   <td>Ether held by attacker</td>
   <td>197,460 ETH, about $436M, on <a href="https://eth.blockscout.com/address/0x8532FA14ACAf483729C449b8458aedDb900543D4" rel="noopener noreferrer nofollow">0x8532…43D4</a>, incl. 2,000 ETH added at 01:14 UTC</td>
   <td>Ethereum node</td>
  </tr>
  <tr>
   <td>Borrowed via Aave</td>
   <td>19,762 wETH, about $45M, against 60M USDT</td>
   <td>Marc Zeller</td>
  </tr>
  <tr>
   <td>Smaller tokens distributed</td>
   <td>at least $122M in more than 15 tokens such as LINK, AAVE, WBTC, ONDO, WLD</td>
   <td>own measurement via Blockscout</td>
  </tr>
  <tr>
   <td>Other blockchains</td>
   <td>about $19.5M on Arbitrum and $24M on Avalanche</td>
   <td>Blockaid, preliminary</td>
  </tr>
 </tbody>
</table>
<blockquote class="twitter-tweet">
 <p>Update: This brings the total frozen for the Binance exploit so far to over $2.83B</p>ZachXBT (@zachxbt) <a href="https://x.com/zachxbt/status/2115972303913935209" rel="noopener noreferrer nofollow">October 30, 2026</a>
</blockquote>
<h2 id="the-aave-trick-why-frozen-usdt-still-yielded-ether">The Aave trick: why frozen USDT still yielded Ether</h2>
<p>The attacker knew Tether could freeze. Within three minutes he supplied 60 million USDT to the lending protocol Aave and borrowed 19,762 wETH, about $45 million. Shortly after, Tether froze the address, and 46 minutes later Aave froze the affected markets. The frozen USDT now sit as collateral on Aave, the borrowed Ether are with the attacker. He will never repay them.</p>
<blockquote class="twitter-tweet">
 <p>Aave protocol will be fine. The hacker supplied 60M USDT and borrowed 19,762 wETH (~44.9M$) in 3 minutes, before Tether froze their address and before the Aave Guardian froze the Aave V3 Core reserves (46 min later).</p>Marc Zeller (@mzeller) <a href="https://x.com/mzeller/status/2115940092409770194" rel="noopener noreferrer nofollow">October 29, 2026</a>
</blockquote>
<p>Aave can absorb it, Marc Zeller of the Aave Chan Initiative explains: the position is overcollateralized and will be liquidated automatically once Ether rises about 4% to roughly $2,365. The debt equals 0.9% of the protocol's wETH reserves. A rising Ether price would, of all things, liquidate the attacker's loan.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/binance_hack_on_chain_analyse_3_b8205993fa.webp" alt="Vault room with frozen coin stacks behind glass" width="1920" height="1080">
 <figcaption>
  AI-generated illustration
 </figcaption>
</figure>
<p><strong>More on the Binance hack</strong></p>
<ul>
 <li><a href="https://cryptoticker.io/en/binance-hack-hot-wallet-drained/" rel="noopener noreferrer nofollow">Binance hack: how the hot wallet was drained</a></li>
 <li><a href="https://cryptoticker.io/en/crypto-crash-binance-hack-timeline-liquidations/" rel="noopener noreferrer nofollow">Live ticker and timeline: the crypto crash after the hack</a></li>
 <li><a href="https://cryptoticker.io/en/tether-freeze-usdt-binance-hack-how-much-frozen/" rel="noopener noreferrer nofollow">USDT frozen: what Tether and Circle really blocked</a></li>
 <li><a href="https://cryptoticker.io/en/binance-withdrawals-solana-xrp-paused-after-hack/" rel="noopener noreferrer nofollow">Binance withdrawals: which networks are paused</a></li>
 <li><a href="https://cryptoticker.io/en/is-this-the-end-how-low-can-bitcoin-fall-binance-hack/" rel="noopener noreferrer nofollow">Is this the end? Three scenarios for Bitcoin</a></li>
 <li><a href="https://cryptoticker.io/en/ethereum-crash-binance-hacker-sits-on-195k-eth/" rel="noopener noreferrer nofollow">Ethereum: the hacker sits on 195,000 ETH</a></li>
 <li><a href="https://cryptoticker.io/en/solana-crash-below-100-binance-hack-sol-80/" rel="noopener noreferrer nofollow">Solana below $100: is $80 next?</a></li>
 <li><a href="https://cryptoticker.io/en/bnb-price-crash-binance-hack-ftt-comparison/" rel="noopener noreferrer nofollow">BNB crash: another FTT moment?</a></li>
 <li><a href="https://cryptoticker.io/en/biggest-crypto-hacks-in-history-binance/" rel="noopener noreferrer nofollow">The biggest crypto hacks in history</a></li>
 <li><a href="https://cryptoticker.io/en/how-to-short-bitcoin-crash-bitget/" rel="noopener noreferrer nofollow">How to short Bitcoin in the crash</a></li>
 <li><a href="https://cryptoticker.io/en/why-is-crypto-down-crypto-crash-reason-today/" rel="noopener noreferrer nofollow">Why is crypto down today?</a></li>
</ul>
<h2 id="what-the-key-voices-on-x-are-saying">What the key voices on X are saying</h2>
<ul>
 <li><strong>Yi He, Binance:</strong> user funds safe, Binance covers all losses, deposits and withdrawals temporarily suspended, full post-mortem to follow.</li>
 <li><strong>ZachXBT, investigator:</strong> more than $2.83 billion frozen.</li>
 <li><strong>Blockaid, security firm:</strong> 50 EIP-7702 authorizations in one transaction, one hit. Verified by us on-chain.</li>
 <li><strong>Marc Zeller, Aave Chan Initiative:</strong> the attacker borrowed 19,762 wETH before the freeze, manageable for Aave.</li>
 <li><strong>Simba, analyst:</strong> initially considered an internal transfer possible, overtaken by Binance's confirmation.</li>
 <li><strong>Bala, commentator:</strong> wrote the attacker "walked away" with the Aave trick. True for $45 million, not for the billions.</li>
</ul>
<h2 id="our-conclusion-where-the-binance-hack-is-heading">Our conclusion: where the Binance hack is heading</h2>
<ul>
 <li><strong>For customers:</strong> Binance has pledged to cover all losses, and the frozen share makes that credible. The key question is when deposits and withdrawals resume. Until then: patience, and no links from messages promising refunds. Which exchanges hold a licence is shown in our <a href="https://cryptoticker.io/en/comparison/best-regulated-exchange/" rel="noopener noreferrer nofollow">comparison of regulated exchanges</a>. We track the status in <a href="https://cryptoticker.io/en/binance-withdrawals-solana-xrp-paused-after-hack/" rel="noopener noreferrer nofollow">Binance withdrawals after the hack</a>.</li>
 <li><strong>For the loot:</strong> of about $2.7 billion, more than $2.8 billion across all chains is blocked. On Ethereum the attacker is left mainly with the 197,460 ETH, the Ether from Aave and distributed smaller tokens, roughly $600 million in total. Going by Binance's figures of $6.3 billion in damage and about $3 billion frozen, however, more than $3 billion across all chains is still unaccounted for; where it sits is the open question of the coming days. He will have to launder it over days and weeks, and every move is public.</li>
 <li><strong>For Ethereum:</strong> the 197,460 ETH remain an overhang. At the same time a 4% price rise would liquidate the attacker's Aave position. What it means for the price is in <a href="https://cryptoticker.io/en/ethereum-crash-binance-hacker-sits-on-195k-eth/" rel="noopener noreferrer nofollow">Ethereum crash: the Binance hacker sits on 195,000 ETH</a>.</li>
 <li><strong>For the industry:</strong> the attack shows a new pattern. Whoever can produce signatures for a wallet needs, thanks to EIP-7702, a single transaction to sweep everything. Exchanges will have to tighten their signing systems and the approval of such delegations.</li>
</ul>
<p>We keep monitoring the addresses and will update this analysis as funds move or Binance publishes its post-mortem. This article is not investment advice.</p>

Binance Hack On-Chain Analysis: 50 Signatures, 197,460 ETH and $2.83 Billion Frozen

Table of Contents

CryptoTicker ENG

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!