World’s biggest crypto exchange hit by suspected $5.8 billion hack in biggest crypto heist ever. Here’s how it happened

Hackers compromised a primary wallet using Ethereum’s EIP-7702 feature and laundered funds through Tornado Cash.

Stablecoin issuers quickly froze over $2.5 billion of the stolen assets, while Binance confirmed customer funds are fully covered.

Binance, the world’s largest cryptocurrency exchange, is investigating a major security breach after hackers allegedly moved billions of dollars in digital assets from wallets linked to the platform on October 29, 2026.

The incident could become the biggest cryptocurrency heist in history, surpassing the $1.5 billion Bybit hack in 2025. 

Blockchain analysts estimate that up to $5.8 billion in digital assets may be linked to the suspicious transactions, although the actual amount stolen has not been independently confirmed.

Binance founder Changpeng Zhao, popularly known as CZ, acknowledged the incident, saying, “It does look like a hack on Binance.”

He added that he expected customers’ funds to be fully covered, despite no longer managing the exchange. Binance has also assured users that their funds are safe.

Binance CEO Changpeng Zhao, known as "CZ".Ben McShane/Sportsfile for Web Summit via Getty Images The suspected attack centred on a Binance wallet identified as Binance 14, which holds cryptocurrency on the Ethereum network.

Blockchain researchers believe the attacker exploited a feature called EIP-7702, which allows ordinary cryptocurrency wallets to execute instructions through smart contract code.

The feature simply allows a regular crypto wallet to perform more complex transactions using programmed instructions. According to Cointelegraph, the attacker allegedly used malicious code to redirect funds from the Binance-linked wallet to an address under their control.

Researchers also traced the funding of an address associated with the operation to Tornado Cash, a cryptocurrency mixing service that makes it harder to trace the origin of digital transactions.

However, investigators have yet to establish how the attacker obtained the authorisation needed to execute the operation.

As the suspicious transfers came to light, cryptocurrency companies moved to stop some of the assets from being spent.

Tether and Circle, the companies behind the USDT and USDC stablecoins, respectively, froze billions of dollars’ worth of tokens linked to the incident.

According to Reuters, Tether and Circle froze more than $2.38 billion in stablecoins. Tether accounted for approximately $1.57 billion in USDT, while Circle froze more than $800 million in USDC.

Binance co-founder Yi He also said Ripple had frozen approximately $200 million in RLUSD, its dollar-pegged stablecoin.

Binance co-founder Yi He However, freezing the assets does not mean all the funds have been recovered. Stablecoin issuers can block transactions involving their tokens, but cryptocurrencies such as Ethereum do not have a central issuer with the same powers.

Despite the scale of the incident, Binance has maintained that customers’ funds are safe.

The exchange initially said it was investigating reports of a potential security issue before updating its statement to assure users that their funds were completely safe.

READ NEXT: These Are the Easiest and Safest Ways to Convert Crypto in Nigeria

The incident has raised fresh concerns about the security of cryptocurrency exchanges, particularly as blockchain technology introduces new features that make digital transactions more flexible.

Although EIP-7702 was designed to improve how cryptocurrency wallets interact with applications, the suspected attack highlights how criminals could exploit its features if wallet authorisation mechanisms are compromised.

Currently, investigators and blockchain analysts are still tracing the movement of the assets.

While CZ has acknowledged that Binance appears to have been hacked, the exchange has not published a final account of the breach or independently confirmed the reported $5.8 billion figure as money stolen.