Binance, a leading cryptocurrency exchange, has temporarily suspended all crypto withdrawals after a suspected hack drained between $3.3 billion and $3.5 billion from its Ethereum hot wallets on October 29, 2026. The exchange assured users that their balances remain safe and that withdrawals will resume once the security issue is fully resolved. However, Binance has not disclosed the exact amount lost in the breach.
The breach involved Binance's hot wallet labelled "Binance 14" on Etherscan, which was redirected to a malicious contract using Ethereum's EIP-7702 feature introduced in May 2025. The wallet was pointed at a contract funded partly through the Tornado Cash mixer, and within four minutes, it transferred approximately 167,464 ETH, 1.615 billion USDT, and 62 other tokens to a new address.
The outflow continued for around 40 minutes, with Binance 14 still being drained after 00:40 UTC, indicating that the attacker either possessed the private key or coerced Binance's systems to sign transactions. Stablecoin issuers Tether and Circle responded by blacklisting the receiving address and freezing more than $1.567 billion USDT and $800 million USDC, respectively, in coordination with law-enforcement agencies.
Overall, about $2.4 billion of the stolen assets have been frozen, while the remaining portion - over $1 billion, largely ETH - remains unrecoverable. Binance founder Changpeng Zhao, who stepped down as CEO in 2023, called the incident a hack and suggested that the loss could be higher than the earlier $1 billion estimate, while pledging that Binance would cover the shortfall.
The incident has implications for Kenyan Binance users, who can swap USDT for M-Pay through the exchange's peer-to-peer market. Ads for such trades were still visible at about KES 130 per dollar shortly after the withdrawal pause. The exchange's Secure Asset Fund for Users (SAFU) holds 15,000 BTC, valued at roughly $1.18 billion (KES 154 billion) at Friday's price.
Kenyan crypto regulations require licensed platforms to keep customer assets separate and maintain sufficient reserves; existing operators have until November 4, 2026, to obtain a licence. Authorities have warned users to ignore unsolicited offers on WhatsApp or Telegram claiming to "unlock" frozen Binance funds and to follow official Binance channels for updates.
Binance has pledged to restore withdrawals once the security breach is fully resolved and to cover any loss not recovered. However, the exchange has not disclosed how the attacker obtained signing authority for the compromised wallet. Binance will continue to provide updates through its official communication channels, with further details expected as investigations progress.
Key points
- Binance suspends withdrawals after $3.3-$3.5 billion drains from Ethereum hot wallets
- The breach involved Binance's hot wallet labelled "Binance 14" on Etherscan
- About $2.4 billion of the stolen assets have been frozen
