Elon Musk

Molly

Tornado Cash

Arkham

It is 9 p.m. in New York, and I am watching what could become the worst hack crypto has ever seen.
I choose those words carefully.
Elon Musk had three words for it: "Everyday is Zeroday," <a href="https://x.com/elonmusk/status/2115935053347786773" rel="noopener noreferrer nofollow">posted</a> at 6:33 p.m. over a <a href="https://x.com/KobeissiLetter/status/2115926246916038921" rel="noopener noreferrer nofollow">report</a> of the outflows. I am with Elon on this one.
A zero-day is a security flaw that attackers exploit before the software maker knows it exists, leaving zero days to prepare a fix. Musk added no data and no explanation, but he named the disease: every day, this industry runs on code somebody has not broken yet.
<figure><img src="https://www.thestreet.com/.image/c_fit%2Ch_675%2Cw_1200/MjI3MjY4Mjg4Njg4Njk1MTgy/elon-musks-everyday-is-zeroday-post-on-the-binance-hack.png" height="675" width="1129">
 <figcaption>
 Musk's "Everyday is Zeroday" post over The Kobeissi Letter's breaking report, 6:33 p.m. ET. Screenshot: X. 
 <a href="https://x.com/elonmusk/status/2115935053347786773" rel="noopener noreferrer nofollow">X</a>
 </figcaption>
</figure>
When we<a href="https://www.thestreet.com/crypto/markets/crypto-hit-by-largest-hack-ever-as-bybit-loses-billions" rel="noopener noreferrer nofollow"> covered</a> the Bybit hack in February 2025, the $1.5 billion theft was the largest this industry had seen. Tonight's numbers break that record.
Earlier tonight I wrote our first<a href="https://www.thestreet.com/crypto/markets/binance-major-shareholder-says-user-funds-are-safe-after-reported-2-5b-hack" rel="noopener noreferrer nofollow"> story</a> at 5:52 p.m., when the biggest confirmed number was a $1.5 billion freeze by the token issuers. By 8:52 p.m., Binance<a href="https://x.com/binance/status/2115970069696217576" rel="noopener noreferrer nofollow"> said</a> the verified freeze had reached around $3 billion and repeated that user funds are safe.
The estimated theft is nearly double the freeze. At 8:26 p.m.,<a href="https://x.com/chainalysis/status/2115963516884808078" rel="noopener noreferrer nofollow"> Chainalysis</a> put it at approximately $5.912 billion at the time of the theft, nearly four times the amount stolen in the Bybit heist.
My argument tonight is that the freeze is the wrong number to watch. A frozen token cannot be moved by anyone, including the thief, so the figure that decides how bad this gets is the gap between what was taken and what was caught.
<figure><img src="https://www.thestreet.com/.image/c_fit%2Ch_675%2Cw_1200/MjI3MjY4MjYyMzgyMDIwNDk0/how-the-money-moved-blockaids-account-of-the-first-sweep-in-the-binance-hack.png" height="675" width="1200">
 <figcaption>
 Blockaid's account of the first sweep, from Tornado Cash funding to the collection address. Source data: Blockaid, Arkham Intelligence and Etherscan, Oct. 29-30, 2026. 
 <a href="https://blockaid.io/blog/binance-55b-hack-using-advanced-ai-models-blockaid-detects-the-biggest-theft-in-crypto-history" rel="noopener noreferrer nofollow">Blockaid, Arkham Intelligence and Etherscan</a>
 </figcaption>
</figure>
Researcher Molly<a href="https://www.citationneeded.news/binance-theft/" rel="noopener noreferrer nofollow"> White</a>, who has been following the wallets, estimates roughly $5.5 billion in liquid assets actually left Binance, with roughly $3 billion still under the attacker's control. She cautions that the trackers are not all measuring the same thing, since some totals count tokens already frozen by their issuers.
Even the lowest figure I have seen, roughly $3.5 billion that left Binance's Ethereum wallets alone, per<a href="https://finance.yahoo.com/markets/crypto/articles/binance-says-user-funds-completely-214417766.html" rel="noopener noreferrer nofollow"> Unchained</a>, is more than double what Bybit lost. If Chainalysis is anywhere close, this is the largest crypto theft on record, with one caveat, the final number is not settled.
What unsettles me is how familiar the method sounds. Security firm Blockaid says the attacker used EIP-7702, a new Ethereum feature that lets a wallet temporarily run another program's code, and bundled 50 delegation requests into one transaction, and one slipped through.
Its CEO, Ido Ben-Natan, told<a href="https://cointelegraph.com/news/binance-hack-may-involve-private-key-misuse-not-theft-blockaid-ceo" rel="noopener noreferrer nofollow"> CoinTelegraph</a> the method looks "very, very similar" to the Bybit attack.
<a href="https://www.linkedin.com/posts/arkhamintelligence_activity-7441454563955527680-NNG4" rel="noopener noreferrer nofollow">Arkham</a>, another blockchain intelligence firm that says it has verified 70 addresses tied to the attacker, says the method cannot be confirmed yet, and Binance has confirmed none of the mechanics.
<h2 id="was-artificial-super-intelligence-involved">Was artificial (super) intelligence involved?&nbsp;</h2>
There is no evidence of that so far. Blockaid describes a defensive use of AI: it says its models flagged the drain within two minutes of the first sweep.
<figure><img src="https://www.thestreet.com/.image/c_fit%2Ch_675%2Cw_1200/MjI3MjY4Mjk1OTM2NTE4MDMw/arkham-attackers-collection-address-holding-218b-at-933-pm-et.png" height="675" width="1200">
 <figcaption>
 Arkham shows $2.18 billion in the attacker's collection address at 9:33 p.m. ET; Blockaid says about $1.8 billion of it is stablecoins frozen by their issuers. Screenshot: Arkham Intelligence. 
 <a href="https://arkm.com/explorer/address/0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c" rel="noopener noreferrer nofollow">Arkham Intelligence</a>
 </figcaption>
</figure>
Binance has suspended all deposits and withdrawals.
The fastest defense came from Tether and Circle, the companies behind the two biggest stablecoins, which froze more than $1.5 billion and $800 million respectively within<a href="https://finance.yahoo.com/markets/crypto/articles/binance-says-user-funds-completely-214417766.html" rel="noopener noreferrer nofollow"> minutes</a>, more than $2.3 billion between them. That response limits the attacker's ability to move what was taken, not the size of what was already gone.
Binance<a href="https://financefeeds.com/binance-will-cover-all-losses-hack/" rel="noopener noreferrer nofollow"> says</a> it "will cover all losses," and founder Changpeng Zhao, who no longer runs the exchange,<a href="https://www.citationneeded.news/binance-theft/" rel="noopener noreferrer nofollow"> added</a>, "loss might be a bit higher than that, but will cover," against roughly $144 billion in customer assets.
<figure>
 <figcaption>
 The same address on Etherscan, tagged "Binance Hot Wallet Exploiter 2," funded by Binance 14 five hours earlier. Screenshot taken 9:34 p.m. ET. 
 <a href="https://etherscan.io/address/0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c" rel="noopener noreferrer nofollow">Etherscan</a>
 </figcaption>
</figure>
The first backstop is SAFU, a $1 billion emergency fund Binance<a href="https://financefeeds.com/binance-will-cover-all-losses-hack/" rel="noopener noreferrer nofollow"> converted</a> into bitcoin earlier this year. If the unrecovered amount lands anywhere near what White estimates the attacker still holds, that fund alone would not cover it, and Binance would need another funding source.
This is how one hack becomes a market problem.
Binance is not one exchange among many. It reported 323 million registered users in a July 14, 2026 release.
Its <a href="https://public.bnbstatic.com/static/files/research/half-year-2026-exchanges-institutions.pdf" rel="noopener noreferrer nofollow">share</a> of all exchange trading was about 35 percent in the second quarter, the largest of any venue. In spot trading over the first half of the year, it did about four and a half times the volume of the next-largest exchange.
If the missing billions stay missing, customers at other exchanges could start asking whether their venue's pipes are any different. Confidence, not the theft, is what gets stolen next.
Tonight is a terrible week for all exchanges out there.
From our archives: Watch our previous conversation with Binance CEO Richard Teng.
<figure>
 <figcaption>
 Binance Token Listing (2:18)
 </figcaption>
</figure>
<h2 id="give-binance-some-credit">Give Binance some credit</h2>
It deserves some tonight. Hours into what could be the industry's largest theft, the company said it will cover all losses, and Zhao added the bill "might be a bit higher than that, but will cover."
For context,&nbsp;&nbsp;<a href="https://www.bloomberg.com/news/articles/2024-07-24/mt-gox-creditors-get-crypto-repayments-after-decade-of-waiting" rel="noopener noreferrer nofollow">Mt. Gox</a>'s creditors waited a decade for partial repayment.
<a href="https://documentcentre.ey.com/api/Document/download?docId=37252&amp;language=EN" rel="noopener noreferrer nofollow">QuadrigaCX</a>'s customers waited years for a fraction of their money, valued at 2019 bankruptcy prices.
<a href="https://www.reuters.com/legal/transactional/ftx-customers-feel-short-changed-by-companys-crypto-valuations-2024-01-11/" rel="noopener noreferrer nofollow">FTX's</a> customers are being repaid in dollars locked at November 2022 prices, so the market's recovery since then happened without them.
Binance has actually done this before, covering the 7,000 bitcoin stolen in 2019, and it keeps a $1 billion emergency fund for exactly this kind of night.
<h2 id="so-what-do-you-do-with-your-crypto-now">So what do you do with your crypto now?</h2>
The honest answer is: we don't know. Every option asks you to trust someone, or to become your own security team.
Self-custody flips the risk. A hardware wallet means no exchange can lose your coins, but no one can save them either: lose access to both the wallet and its recovery phrase, and the money may be unrecoverable.
Ledger's wallets kept their keys safe through both of the company's scandals, yet a 2020 breach of its customer database still exposed the names and home addresses of some <a href="https://support.ledger.com/article/E-commerce-and-Marketing-data-breach-FAQ" rel="noopener noreferrer nofollow">272,000</a> buyers, and in December 2023 attackers slipped malicious code into its <a href="https://www.ledger.com/blog/security-incident-report" rel="noopener noreferrer nofollow">Connect Kit</a> software and drained about $600,000 from people using apps built on it.
<h2 id="there-is-hope">There is hope</h2>
Since January 2024, Americans can buy bitcoin exposure in an ordinary brokerage account through a spot ETF, next to their index funds.
The largest, BlackRock's <a href="https://www.ishares.com/us/products/333011/ishares-bitcoin-trust-etf" rel="noopener noreferrer nofollow">iShares Bitcoin Trust</a>, holds about $66 billion and charges 0.25 percent a year. No private key to guard, no recovery phrase to lose.
This is an opinion piece by Mehab Qureshi, Senior Editor at TheStreet. The views expressed are his own and do not reflect the views of TheStreet.

I'm with Elon Musk on Binance's hack

Table of Contents

TheStreet Roundtable

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!