# Binance: $5.6 billion outflow estimate and a second wallet transfer Canonical: https://www.oktsec.com/radar/binance-hot-wallet-drain-october-2026 Publisher: Oktsec Language: en Published: 2026-10-30T00:00:29Z Updated: 2026-10-30T00:46:36Z Record reviewed: 2026-10-30T00:46:36Z Latest evidence check: 2026-10-30T00:46:36Z Disclosed: 2026-10-29 BWEnews estimated $5.6 billion in outflows at 21:22 UTC on October 29; Etherscan records a second Binance 14 transfer at 21:44 UTC. Estimated outflows and frozen funds are different measures, and final loss remains unconfirmed. ## Evidence and response priority - Category: Platform incident - Oktsec priority: Review this week - Rationale: Wallet transfers are documented in Etherscan. Review this week applies to signing controls in comparable environments; it does not establish compromise of the reader or a software flaw requiring a patch. - Evidence: Incident documented by multiple sources - Verification: Multiple sources - Fix status: Not applicable - Exposure requirement: Application or configuration dependent - Vendor: Binance - Products: Hot wallets, EIP-7702 signing authority ## Technical overview BBX, citing BWEnews, reported $5.643 billion (approximately $5.6 billion) in outflows from Binance wallets at 21:22 UTC on October 29, across six networks. This is an attributed estimate at that cutoff, not a final loss confirmed by Binance. Oktsec has not independently reconciled the aggregate. Etherscan records Binance 14 receiving an EIP-7702 delegation at 20:20:59 UTC. At 20:24:23 UTC, it transferred 167,464 ETH and 63 tokens, including approximately 1.615 billion USDT. A separate transaction transferred 780 million USDC from Binance Hot Wallet 34 to the same recipient. At 21:44:11 UTC, Binance 14 sent another 200,397,771.824195 USDT, 369.831856995580626695 ETH and 13 other ERC-20 tokens to that recipient. This second transfer occurred after the estimate's cutoff. We do not add it to that aggregate without reconciling coverage and valuation. Binance reported $2.54 billion frozen after earlier Tether and Circle announcements. These are overlapping reports, not amounts to add together or a confirmed final loss. Frozen funds overlap with outflows; they are not an additional loss or a confirmed recovery total. The delegation and relayer do not reveal how the signature was obtained, rule out stolen keys or establish that a legitimate signing workflow was deceived. The reviewed statements do not disclose root cause or official attribution. EIP-7702 delegation persists until changed or cleared by a valid authorization. Disabling an application session does not clear account code. Inspect delegation state, stop automated funding of confirmed compromised addresses and coordinate revocation and custody recovery. Clearing delegation alone does not secure a stolen private key. Review signing authority and independent approvals in your environment; this incident does not establish your exposure. ## Recommended response Review signing authority, persistent delegations, independent approvals and revocation paths. Relevant to: Exchange operators, treasury teams and organizations whose employees, contractors or AI agents can authorize transfers, wallet delegations or software releases. ## Response checklist 1. **Inventory who and what can sign** — List employee, contractor and service accounts that can transfer funds, delegate wallets or sign releases, including credentials and sessions outside central SSO. 2. **Check independent approval** — For each signing path, identify who approves the exact action, who operates the signer and where both records are stored. Check whether one compromised account could bypass that separation. 3. **Review delegations and unexpected relayers** — Review EIP-7702 account code, delegations and token approvals against approved contracts, chains and operators. A delegation can persist beyond the transaction that installed it. Investigate unexpected changes and stop automated funding of confirmed compromised addresses. 4. **Test complete revocation** — Measure how long it takes to revoke signing sessions, delegated authority and derived credentials. Confirm what remains usable after the original account is disabled. ## Relevance to AI environments Inventory wallet CLIs, relayers and release pipelines available to AI agents. Require independent approval of the exact action before signing, record the authorization and test revocation of sessions and derived permissions. This is a control review, not evidence that an AI agent caused the Binance incident. ## Indicators - Transaction sender / relayer: `0x7C8601d4645b93cea45F71e118A729332e6B5CA0` - Delegated contract: `0x63e842B054Bd624a465454D533C33F573e9c6fAe` - Recipient labelled Binance Hot Wallet Exploiter 2: `0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c` Indicators alone do not establish compromise. ## Sources - [Binance: investigation into a potential security issue](https://x.com/binance/status/2115915483832832425) — Binance; Vendor notice; checked 2026-10-30T00:00:29Z - [Binance: $2.54 billion frozen, not a final loss estimate](https://x.com/binance/status/2115947325617299903) — Binance; Vendor notice; checked 2026-10-30T00:00:29Z - [Binance 14: EIP-7702 delegation at 20:20:59 UTC](https://etherscan.io/tx/0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b) — Etherscan; Research report; checked 2026-10-30T00:00:29Z - [Binance 14: ETH and token transfers at 20:24:23 UTC](https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3) — Etherscan; Research report; checked 2026-10-30T00:00:29Z - [Binance Hot Wallet 34: 780 million USDC transfer](https://etherscan.io/tx/0xdc102dd89dded5a83f1008906883ffb7c81ff3b7d7965d8c7277d170b5e17481) — Etherscan; Research report; checked 2026-10-30T00:00:29Z - [EIP-7702 delegation and transfer analysis](https://x.com/odysseas_eth/status/2115910280140276155) — Odysseas / Phylax; Research report; checked 2026-10-30T00:00:29Z - [Circle: more than 800 million USDC frozen](https://x.com/jerallaire/status/2115916207463481846) — Jeremy Allaire / Circle; Vendor notice; checked 2026-10-30T00:00:29Z - [Tether: more than 1.567 billion USDT frozen](https://x.com/paoloardoino/status/2115918000373346709) — Paolo Ardoino / Tether; Vendor notice; checked 2026-10-30T00:00:29Z - [EIP-7702: account code delegation and security considerations](https://eips.ethereum.org/EIPS/eip-7702) — Ethereum Improvement Proposals; Research report; checked 2026-10-30T00:00:29Z - [BWEnews tally reported by BBX: $5.643 billion in outflows at 21:22 UTC](https://bbx.com/news-detail/3158067) — BBX / BWEnews; Media report; checked 2026-10-30T00:46:36Z - [Binance 14: second transfer at 21:44:11 UTC](https://etherscan.io/tx/0x55ba4dabc41b468e580751373ad31acdee6f5ba398682df2c93e5a8340870556) — Etherscan; Research report; checked 2026-10-30T00:46:36Z ## Editorial record - 2026-10-30T00:00:29Z: Recorded October 29 wallet transfers and EIP-7702 delegation from Etherscan alongside Binance and issuer statements. Root cause, attribution and final loss remain undisclosed in the reviewed sources. - 2026-10-30T00:17:49Z: Removed the unrelated hiring research link and recruiter guidance. The reviewed evidence does not establish a recruitment connection to this incident. - 2026-10-30T00:46:36Z: Added the attributed $5.643 billion outflow estimate with its October 29 21:22 UTC cutoff and the separate 21:44:11 UTC Binance 14 transfer. Kept frozen funds separate from estimated outflows and final loss. Added persistent delegation checks. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/binance-hot-wallet-drain-october-2026) · [Build a response plan](https://www.oktsec.com/radar/binance-hot-wallet-drain-october-2026#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=binance-hot-wallet-drain-october-2026&service=exposure_check) - [AI agent review consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=binance-hot-wallet-drain-october-2026&service=agent_review) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.