The Binance hack just rewrote the record books: attackers made off with an estimated $6.3 billion in the largest crypto theft ever reported, and the industry’s biggest stablecoin issuers moved fast to lock down what they could. Tether, Circle and Ripple collectively froze or halted billions of dollars linked to the breach within hours, turning the incident into a live test of how quickly stablecoin-issuing power can be used as a brake on stolen money.
What Happened in the Binance Hack
Binance says the attack unfolded on the evening of October 29, with the exchange publishing its $6.3 billion impact estimate and a roughly $3 billion frozen total on October 30. Withdrawals were suspended as the exchange investigated, and blockchain analytics firm Arkham Intelligence labeled a wallet cluster “binance-hacker-1029” holding roughly $5.84 billion.
Figures have moved all day and still differ across sources – frozen totals, per-issuer splits and the ultimate damage number should all be treated as provisional. What is not in dispute: this is bigger than any prior single exploit in crypto’s history.
How the Attackers Got In
Binance’s preliminary account points to an unglamorous entry point: a compromised DevOps engineer’s laptop. From that machine, the attacker reached a service container and submitted unauthorized withdrawal transactions from Binance hot wallets.
On-chain, the mechanics were sharper. The attacker sprayed 50 pre-signed EIP-7702 authorizations with consecutive nonces in a single transaction; one nonce matched and installed a sweeper contract on the hot wallet labeled “Binance 14,” and the next call drained it. Funds were routed through a contract call allegedly funded by Tornado Cash and commingled via THORChain. The attacker’s remaining balance sits mainly in about 197,460 ETH.
At one point the attacker supplied 60 million USDT to Aave and borrowed 19,762 wETH – roughly $45 million – before Tether froze the address and Aave froze the affected markets about 46 minutes later. On-chain investigator ZachXBT has linked the exploit to September’s ~$388 million BitGet hack, saying funds from both were commingled at the same address after arriving via THORChain – a sign he reads as the same actor.
Tether, Circle and Ripple Freeze Billions
The stablecoin response was the story’s second act. Tether CEO Paolo Ardoino said the issuer froze more than $1.567 billion in USDT; Circle CEO Jeremy Allaire confirmed more than $800 million in USDC frozen in coordination with law enforcement; Ripple halted around $200 million in XRP and RLUSD, according to executive Yi He. Binance’s own thank-you note cited roughly $971 million from Tether and $823 million from Circle – a reminder that reconciliation is still catching up to events.
All told, about $3 billion was frozen on-chain, including roughly $2.83 billion on Ethereum alone. Around $3.3 billion remained unaccounted for at the time of reporting.
What Comes Next
Frozen is not recovered. Returning assets requires technical and legal process, and Binance has not yet published a full post-mortem – the DevOps-laptop account remains preliminary. For the stablecoin sector, the episode cuts both ways: critics will note how much money can vanish in hours, while issuers will point out that real-time freeze capability just demonstrated exactly why regulators want them tightly supervised.
Figures reflect reporting as of October 30 and are moving; we will update as the post-mortem lands.
Related: Bybit Sues North Korea Over Its $1.5B Hack and Wins a Rare Asset Freeze
