Binance was hacked for billions. What that means for a casino balance

On Thursday 29 October, between 16:20 and 17:04 New York time, billions of dollars walked out of wallets that Etherscan labels as Binance hot wallets. Binance still has not used the word hack. Its founder did, within the hour. Tether, Circle and Ripple froze about $2.5 billion between them before most people had finished reading the first alert, and by Friday withdrawals from the exchange were paused.

If none of your money sits on Binance, this still reaches you. Most crypto casino payouts end up on an exchange, and for a very large share of players that exchange is Binance. This post is about what is actually established, what is not, and what it does to a cashout that is in flight right now.

What is known about the numbers

Nobody agrees on the total, because the counts measure different things. It is worth keeping them apart.

• Unchained counted about $3.52 billion arriving at one new Ethereum address between 16:24 and 17:04 ET: roughly 197,170 ETH, 1.68 billion USDT, 823 million USDC and around $564 million across 62 other tokens.
• Blockaid flagged about $3.3 billion in suspicious transfers across Ethereum, Arbitrum and Avalanche.
• Decrypt’s tally across three chains came to $5.57 billion: $3.51 billion on Ethereum, $1.44 billion in 18,270 Bitcoin and $630 million on Tron.
• Arkham Intelligence labelled a cluster of wallets “binance-hacker-1029” holding roughly $5.84 billion. That is what the wallets hold, not a confirmed figure for what was taken.

Binance has published no figure at all. On the widest of those counts this is the largest crypto theft on record by a distance. The previous record was the Bybit hack in February 2025, which the FBI put at about $1.5 billion. Binance’s own 2019 hack cost it 7,000 Bitcoin, worth around $40 million at the time.

How the money moved

The mechanism is worth understanding, because it is new and it is not the usual story of a leaked key.

At 16:20 ET an address set an EIP-7702 delegation on the wallet Etherscan labels Binance 14, pointing it at a contract that the same address had deployed earlier that day. EIP-7702 is an Ethereum upgrade that lets an ordinary wallet temporarily run a smart contract’s code. The address that did this had been funded in part through Tornado Cash’s 0.1 ETH pool.

Four minutes later it swept Binance 14. Binance 16 sent 28,005.6 ETH to the same destination. Calls routed through Binance 14 pulled 780 million USDC out of a wallet labelled Hot Wallet 34, then 43 million more.

How the delegation was authorised is the part nobody has answered. A delegation of that kind needs a signature from the wallet. Until Binance says where that signature came from, the root cause is unknown, and anyone telling you otherwise is guessing.

Security firm PeckShield flagged the outflows at 16:55 ET, more than twenty minutes after the on-chain analyst Spreek raised the alarm publicly.

The freeze is the part that matters for a casino player

Tether blacklisted the receiving address at 17:01 ET, locking about 975 million USDT inside it. Circle followed three minutes later with 823 million USDC. Paolo Ardoino later said Tether had frozen more than 1.567 billion USDT in total, and that seven downstream wallets had also been blacklisted, two of them holding about 205 million USDT between them. Ripple froze roughly $200 million. Binance co-CEO Yi He publicly thanked them.

Aave froze its lending markets after the attacker borrowed 20,000 wrapped ETH, about $44 million, using stolen USDT as collateral.

Read that again with your own balance in mind. Three companies reached into wallets they do not control and switched off the money, in minutes, with no court involved. That is the same button we wrote about when Tether froze $42 million of USDT. This week it was pressed on $2.5 billion in under an hour.

Nobody is suggesting your casino payout gets frozen for being a casino payout. The point is narrower and it has not changed: a stablecoin balance is a line in somebody’s database, and that somebody can edit it. The faster the industry gets at freezing stolen funds, the more comfortable it gets with freezing in general. We laid out how exchanges already score gambling-linked deposits in the piece on withdrawal risk scoring, and that was before an incident that normalised a billion-dollar freeze as a good news story.

What Binance has actually said

Less than the coverage suggests, and the edit history is instructive.

The first post went up at 21:16 UTC: teams are “actively investigating” a “potential security issue” and “at this stage, we have not confirmed any impact to user funds.” At 21:24 UTC the sentence about user funds was deleted. At 21:29 UTC a new one replaced it: “User funds are completely safe.” Three positions in thirteen minutes, and the word hack in none of them.

Changpeng Zhao, who no longer runs the exchange, said it before Binance said anything: “it does look like a hack on Binance.” He added that as a shareholder he expects all user funds to be fully covered. That is a shareholder’s expectation, not a company commitment.

By Friday the story had moved to the cashier. Binance first described blocked withdrawals as a technical error being restored, then said a security check was underway and withdrawals would resume once the issue was fully resolved. There is still no loss figure, no root cause and no timeline. Binance has not said whether it will use SAFU, the emergency fund it holds at about $1 billion and converted into Bitcoin in February. On the larger loss estimates, that fund does not cover the hole on its own.

Markets took it badly. Bitcoin fell below $79,000, Ether below $2,300, BNB dropped about 7%, and Coinglass recorded roughly $600 million in liquidations in a single hour. Monero rose about 6%.

What to do if a casino payout is in the middle of this

Five things, in the order they matter.

• Do not route a cashout through Binance until withdrawals are confirmed working. A casino can pay you on time and the money still sits. Most casinos pay to an address you supply, so supply a different one. A self-custody wallet is the simplest answer this week.
• Take the payout anyway. This is not a reason to leave a balance at the casino instead. The casino is not safer than Binance. It is a smaller, less audited version of the same risk, which is the whole argument of what makes a crypto casino trustworthy.
• Expect a phishing wave, and assume anything that finds you is part of it. Every large exchange incident is followed by fake support accounts, fake compensation forms and fake “secure your funds” links. Binance’s own statement spent a third of its length on this. No exchange and no casino will ever message you first asking for a seed phrase, a password or a 2FA code.
• If you use USDT or USDC as your casino currency, know what you are holding. We went through the trade-off in stablecoins and casino payouts. The stability is real. So is the blacklist function.
• Keep the withdrawal habits boring. Small test amount first, correct network, no balance left sitting that you would mind losing access to overnight. The full version is in our withdrawal guide.

What we are watching

Whether Binance publishes a figure and a cause, or lets “potential security issue” stand. Whether withdrawals come back fully or in stages. Whether SAFU is used and what the shortfall looks like against the real total. Whether any of the frozen $2.5 billion is actually returned, because freezing and recovering are not the same thing and the second one usually takes years.

And one thing specific to this site: whether casinos that settle treasury through Binance start paying slowly. Several operators we review hold working balances on major exchanges. If an exchange-side pause turns into a cashier-side delay, it shows up in payout times before it shows up in any announcement. That is what we measure, and we will update this post if it moves.

Frequently asked questions