Binance: $5.6 billion outflow estimate and a second wallet transfer
Binance: $5.6 billion outflow estimate and a second wallet transfer
BWEnews estimated $5.6 billion in outflows at 21:22 UTC on October 29; Etherscan records a second Binance 14 transfer at 21:44 UTC. Estimated outflows and frozen funds are different measures, and final loss remains unconfirmed.
Who should check: Exchange operators, treasury teams and organizations whose employees, contractors or AI agents can authorize transfers, wallet delegations or software releases.
Review signing authority, persistent delegations, independent approvals and revocation paths.
What happened and why does it matter?
BBX, citing BWEnews, reported $5.643 billion (approximately $5.6 billion) in outflows from Binance wallets at 21:22 UTC on October 29, across six networks. This is an attributed estimate at that cutoff, not a final loss confirmed by Binance. Oktsec has not independently reconciled the aggregate.
Etherscan records Binance 14 receiving an EIP-7702 delegation at 20:20:59 UTC. At 20:24:23 UTC, it transferred 167,464 ETH and 63 tokens, including approximately 1.615 billion USDT. A separate transaction transferred 780 million USDC from Binance Hot Wallet 34 to the same recipient.
At 21:44:11 UTC, Binance 14 sent another 200,397,771.824195 USDT, 369.831856995580626695 ETH and 13 other ERC-20 tokens to that recipient. This second transfer occurred after the estimate's cutoff. We do not add it to that aggregate without reconciling coverage and valuation.
Binance reported $2.54 billion frozen after earlier Tether and Circle announcements. These are overlapping reports, not amounts to add together or a confirmed final loss. Frozen funds overlap with outflows; they are not an additional loss or a confirmed recovery total.
The delegation and relayer do not reveal how the signature was obtained, rule out stolen keys or establish that a legitimate signing workflow was deceived. The reviewed statements do not disclose root cause or official attribution.
EIP-7702 delegation persists until changed or cleared by a valid authorization. Disabling an application session does not clear account code. Inspect delegation state, stop automated funding of confirmed compromised addresses and coordinate revocation and custody recovery. Clearing delegation alone does not secure a stolen private key.
Review signing authority and independent approvals in your environment; this incident does not establish your exposure.
- Vendor / publisher
- Binance
- Disclosed
- Oct 29, 2026
- Latest evidence check
- Oct 30, 2026 UTC
What evidence supports this advisory?
Incident evidence
Priority rationale
Wallet transfers are documented in Etherscan. Review this week applies to signing controls in comparable environments; it does not establish compromise of the reader or a software flaw requiring a patch.
What does this mean for AI environments?
Inventory wallet CLIs, relayers and release pipelines available to AI agents. Require independent approval of the exact action before signing, record the authorization and test revocation of sessions and derived permissions. This is a control review, not evidence that an AI agent caused the Binance incident.
Sources behind this advisory
- Binance: investigation into a potential security issueBinance · Checked Oct 30, 2026 UTC
- Binance: $2.54 billion frozen, not a final loss estimateBinance · Checked Oct 30, 2026 UTC
- Binance 14: EIP-7702 delegation at 20:20:59 UTCEtherscan · Checked Oct 30, 2026 UTC
- Binance 14: ETH and token transfers at 20:24:23 UTCEtherscan · Checked Oct 30, 2026 UTC
- Binance Hot Wallet 34: 780 million USDC transferEtherscan · Checked Oct 30, 2026 UTC
- EIP-7702 delegation and transfer analysisOdysseas / Phylax · Checked Oct 30, 2026 UTC
- Circle: more than 800 million USDC frozenJeremy Allaire / Circle · Checked Oct 30, 2026 UTC
- Tether: more than 1.567 billion USDT frozenPaolo Ardoino / Tether · Checked Oct 30, 2026 UTC
- EIP-7702: account code delegation and security considerationsEthereum Improvement Proposals · Checked Oct 30, 2026 UTC
- BWEnews tally reported by BBX: $5.643 billion in outflows at 21:22 UTCBBX / BWEnews · Checked Oct 30, 2026 UTC
- Binance 14: second transfer at 21:44:11 UTCEtherscan · Checked Oct 30, 2026 UTC
Editorial record3 entries
Recorded October 29 wallet transfers and EIP-7702 delegation from Etherscan alongside Binance and issuer statements. Root cause, attribution and final loss remain undisclosed in the reviewed sources.
Removed the unrelated hiring research link and recruiter guidance. The reviewed evidence does not establish a recruitment connection to this incident.
Added the attributed $5.643 billion outflow estimate with its October 29 21:22 UTC cutoff and the separate 21:44:11 UTC Binance 14 transfer. Kept frozen funds separate from estimated outflows and final loss. Added persistent delegation checks.
Plan your response
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
1. Check whether this applies
Read the advisory and its sources, then record your decision below. If you are unsure, choose “Needs verification”.
2. Track the response
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
Inventory who and what can sign
List employee, contractor and service accounts that can transfer funds, delegate wallets or sign releases, including credentials and sessions outside central SSO.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.Check independent approval
For each signing path, identify who approves the exact action, who operates the signer and where both records are stored. Check whether one compromised account could bypass that separation.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.Review delegations and unexpected relayers
Review EIP-7702 account code, delegations and token approvals against approved contracts, chains and operators. A delegation can persist beyond the transaction that installed it. Investigate unexpected changes and stop automated funding of confirmed compromised addresses.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.Test complete revocation
Measure how long it takes to revoke signing sessions, delegated authority and derived credentials. Confirm what remains usable after the original account is disabled.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.
3. Share the plan
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Affected systems & fixes
Compare the running version and configuration with the vendor guidance.
| Product | Affected | Fixed release / action |
|---|
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
Evidence & sources
Why this priority
Wallet transfers are documented in Etherscan. Review this week applies to signing controls in comparable environments; it does not establish compromise of the reader or a software flaw requiring a patch.
Prioritization criteriaSources
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.
- Binance: investigation into a potential security issueBinance · Vendor notice · Checked Oct 30, 2026 UTC
- Binance: $2.54 billion frozen, not a final loss estimateBinance · Vendor notice · Checked Oct 30, 2026 UTC
- Binance 14: EIP-7702 delegation at 20:20:59 UTCEtherscan · Research report · Checked Oct 30, 2026 UTC
- Binance 14: ETH and token transfers at 20:24:23 UTCEtherscan · Research report · Checked Oct 30, 2026 UTC
- Binance Hot Wallet 34: 780 million USDC transferEtherscan · Research report · Checked Oct 30, 2026 UTC
- EIP-7702 delegation and transfer analysisOdysseas / Phylax · Research report · Checked Oct 30, 2026 UTC
- Circle: more than 800 million USDC frozenJeremy Allaire / Circle · Vendor notice · Checked Oct 30, 2026 UTC
- Tether: more than 1.567 billion USDT frozenPaolo Ardoino / Tether · Vendor notice · Checked Oct 30, 2026 UTC
- EIP-7702: account code delegation and security considerationsEthereum Improvement Proposals · Research report · Checked Oct 30, 2026 UTC
- BWEnews tally reported by BBX: $5.643 billion in outflows at 21:22 UTCBBX / BWEnews · Media report · Checked Oct 30, 2026 UTC
- Binance 14: second transfer at 21:44:11 UTCEtherscan · Research report · Checked Oct 30, 2026 UTC
Technical recordProducts, identifiers and supporting details
| Product / service | Hot wallets, EIP-7702 signing authorityBinance |
|---|---|
| Evidence | Incident documented by multiple sources |
| Exposure | Application or configuration dependent |
- Disclosed
- Oct 29, 2026
- Record reviewed
- Oct 30, 2026 UTC
For AI agent environments
Inventory wallet CLIs, relayers and release pipelines available to AI agents. Require independent approval of the exact action before signing, record the authorization and test revocation of sessions and derived permissions. This is a control review, not evidence that an AI agent caused the Binance incident.
Indicators
Transaction sender / relayer: 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 Delegated contract: 0x63e842B054Bd624a465454D533C33F573e9c6fAe Recipient labelled Binance Hot Wallet Exploiter 2: 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8cCopy
Indicators alone do not establish compromise.