The Binance hack: what happened and how Aave held back part of the funds

What happened on 29 October[3][1][2]

Binance is a centralized exchange (CEX): it holds customer funds for them. Such an exchange keeps most customer funds in cold wallets, cut off from the internet, and part in hot wallets, from which it handles withdrawals as they come in. On the evening of 29 October 2026 it was Binance's hot wallets that started sending huge amounts to the hacker's address.

According to TRM Labs, outflows began at 20:05 UTC, and most of the funds moved within about 20 minutes across ten networks, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. According to LlamaRisk, at 20:24 UTC a single transaction on Ethereum moved 167,464 ETH and 63 other tokens. A second wave hit wallets on Avalanche and Polygon around 23:05 UTC, almost three hours later.

Binance puts the total at about US$6.3bn, TRM Labs at US$6.36bn and Chainalysis at US$5.912bn at prices at the time of the theft. The previous record belonged to Bybit: US$1.5bn in 2025.

How the hacker got in[3][2][6]

Binance's first account, from the night of 29 to 30 October: an infected laptop of a DevOps engineer may have given the hacker access to an internal service container, through which they submitted unauthorized withdrawals. Binance found no sign of leaked private keys to its wallets.

Later updates added that the incident has several causes and that the investigation found additional points of breach. Binance co-CEO Richard Teng wrote that the attacker did not simply use one engineer's permissions. The full technical report is not out yet.

Put simply: the hacker did not have to steal a key. It was enough that Binance's system that signs withdrawals started signing their orders like ordinary customer withdrawals. According to TRM, preparation took at least 36 hours, and the hacker's wallet was funded with small Tornado Cash withdrawals.

Freezes: what could be stopped[3][2]

Stablecoins such as USDT or USDC have an issuer that can block the tokens at a given address. Tether froze 971.1M USDT at 21:01 UTC, and Circle 823M USDC three minutes later. Later, Tether chief Paolo Ardoino spoke of more than 1.567bn USDT.

Ripple (RLUSD), World Liberty Financial (US$27M in USD1 and US$2M in WLFI), First Digital (FDUSD) and the Arbitrum Security Council, which moved US$30.5M in ARB and ETH to a frozen address, blocked their parts too. Binance says about US$3bn is frozen.

ETH and BTC have no issuer, so nobody can freeze them. According to TRM, the hacker still holds more than 420,000 ETH and 18,270 BTC, about US$2.4bn. That is why in the first minutes they sold about 325M USDT for ETH, accepting a loss of more than 10% on the rate.

Why the hacker went to Aave[1][3]

Aave is a lending protocol: you deposit one token as collateral and borrow another against it. Between 20:58 and 21:01 UTC one of the hacker's wallets deposited 60M USDT on Aave V3 on Ethereum and borrowed 19,762 WETH, worth about US$44.6M at the time.

The aim was simple: swap tokens an issuer can freeze for ETH that nobody can freeze, and do it faster than Tether could react. The hacker never meant to repay the loan. They left the USDT on Aave and walked away with the ETH.

According to LlamaRisk, this was the hacker's only position on Aave, and after 21:01 UTC none of their wallets touched Aave again. The position holds US$59.9M of collateral against US$43.8M of debt, so it is over-collateralized and puts nobody who deposited on Aave at risk.

How Aave responded and where US$14M comes from[1][4][5]

Within 10 minutes of the first reports, Aave Labs, TokenLogic and Certora formed a single crisis team. Between 21:42 and 23:04 UTC the Guardian multisigs froze 175 Aave V3 markets on 16 networks and 117 Aave V4 markets on four. A frozen market takes no new deposits or loans, but you can still repay, withdraw and liquidate positions. The aim was to cut the hacker off from further loans.

Before reopening, LlamaRisk wants to lower borrow caps on the main markets by about US$3.7bn on V3 and US$130M on V4, because the hacker still holds a lot of ETH, stablecoins and governance tokens.

Recovering funds is for now only a prospect. According to Binance co-founder Yi He, the collateral on Aave is not covered by a full freeze, and the hacker borrowed only about US$46M in ETH against it. Once law enforcement unlocks these funds, an additional US$14M can be recovered. As of the morning of 30 October none of it had come back.

What this means for Binance customers[3][6][2]

Binance says it will cover all customer losses from its SAFU fund (Secure Asset Fund for Users), an emergency reserve and its own money. Deposits already work, and withdrawals are due back within about 45-48 hours of its 30 October update, after an overhaul of the withdrawal service's security. Binance.US is a separate company and was not affected.

The market fell: BTC dropped below US$77,000, ETH fell about 5.7% to about US$2,211 and BNB about 8%. Binance promises a technical report on the attack and an updated Proof of Reserves.

• Do not panic if a withdrawal is stuck: it is an announced pause, not a sign the funds are gone
• Ignore messages about refunds, compensation and airdrops after the attack. Binance announces such things only on its official channels
• Never give anyone your seed phrase or 2FA codes, even someone who says they are support
• Keep on an exchange only what you trade. Move the rest to self-custody, ideally a hardware wallet
• Spread funds across several places, so that a pause at one exchange does not block everything