Billions Left Binance in Minutes. Know Where Yours Sit.

At 20:24 UTC on Thursday, one Ethereum transaction emptied a Binance hot wallet labelled Binance 14. By 21:04, FinanceFeeds counts about $3.3 billion gone from Binance hot wallets on Ethereum alone. On-chain investigator Emmett Gallic says he is tracking more than $5 billion across 46 addresses.

Take the lowest serious figure in circulation, roughly $2.8 billion drained on Ethereum by CryptoTicker's count, and it is still close to double the $1.5 billion the FBI says North Korea took from Bybit in February 2025, the theft TechCrunch calls the record. If the numbers hold, Thursday night was the largest crypto heist there has ever been.

Binance has confirmed none of it. No hack, no figure, no cause. For operators in Europe, the size of the hole matters less than two narrower questions: what you still hold there, and who is legally on the hook if it is gone.

What Happened on Chain

The sequence below comes from Etherscan, as reported by CryptoTicker and FinanceFeeds. On 28 October, an address received 0.1 ETH through Tornado Cash, the mixer. The next afternoon the same address deployed a contract. At 20:20 UTC, Binance 14 was delegated to that contract using EIP-7702, the Ethereum feature that lets an ordinary wallet point at a smart contract and run its code. At 20:24 the contract swept the wallet in a single transaction: 167,464 ETH, 1.615 billion USDT and dozens of other tokens, sent to an address Etherscan now labels Binance Hot Wallet Exploiter 2. A further 780 million USDC left a second Binance address at 20:41.

FinanceFeeds reports that the same sender ran identical delegate-and-sweep transactions against three smaller wallets earlier that day. That looks like a rehearsal. A delegation of this kind needs a signature from the wallet's private key, so whoever did this could, in some form, sign for a Binance hot wallet. Defimon describes it as abuse of an EIP-7702 delegation with a compromised key. CryptoTicker lists three ways to get that signature (a stolen key, a manipulated signing system as at Bybit, or an insider) and says none is proven.

Nobody has named an attacker. Markets did not wait for one. BNB was down about 6% at 21:26 UTC on CryptoTicker's CoinMarketCap reading, and around $628 million of positions were liquidated within an hour, almost all of them longs, according to CoinGlass data CryptoTicker cites.

Three Statements in 13 Minutes

Binance's first post on X, at 21:16 UTC, said it had not yet confirmed any impact on user funds. By 21:24 that sentence had gone. At 21:29 a new one said user funds were completely safe. FinanceFeeds tracked the edits through the post's history. Co-founder Yi He has said user funds are SAFU, a nod to the exchange's emergency fund. Founder Changpeng Zhao went further than the company did: "It does look like a hack on Binance." He added that, as a shareholder, he expects users to be fully covered.

Read that carefully. A shareholder's expectation is not a commitment from the exchange, and Binance has made none. It has not said whether the Secure Asset Fund for Users will be used. The last time it was, after a 7,000 BTC hot-wallet theft in May 2019, it covered the loss.

Withdrawals are partly shut. Late on Thursday, CryptoTicker reported BTC, ETH and USDT on Ethereum and Tron moving, while Solana, XRP and stablecoins on Solana, Optimism, Avalanche, NEAR and Polygon were paused, with Binance citing wallet maintenance. A Binance spokesperson told TechCrunch that withdrawals on several networks were suspended as a precaution after a security incident. Pick whichever explanation you like. Money on those networks is not moving either way.

No MiCA Licence, No MiCA Protection

This is the part operators in Europe should not skip. Binance has held no MiCA licence since the transition period ended on 1 July 2026. It withdrew its Greek application in June, stopped taking new EU registrations and told existing clients their assets would stay accessible. European clients who have not moved out since July still hold balances there.

Those balances sit outside the regime written for exactly this kind of night. Under Article 75(8) of MiCA, an authorised crypto-asset service provider that holds assets for clients is liable to them for the loss of those assets, or of the means of access to them, as a result of an incident attributable to it. The liability is capped at the market value of what was lost, at the time of the loss. A compromised hot-wallet key, if that is what this was, is hard to describe as anything other than attributable.

A licensed exchange would also be on the DORA clock, which covers crypto-asset service providers authorised under MiCA. Under Delegated Regulation (EU) 2025/301, a major ICT-related incident needs an initial notification within four hours of being classified as major, and no later than 24 hours after the firm becomes aware of it. An intermediate report follows within 72 hours and a final report within a month.

In the EU, Binance owes nobody that report. If you or your customers are owed money by Binance this weekend, your protection is the exchange's goodwill and its fund. That may well be enough. It is not a MiCA right.

The Freeze Cuts Both Ways

What did get stopped was stopped by the stablecoin issuers, not by Binance. Tether's chief executive Paolo Ardoino says Tether froze more than 1.567 billion USDT. Circle's chief executive Jeremy Allaire says Circle froze more than 800 million USDC, in coordination with law enforcement. Crypto News Flash puts the combined freeze at about $2.4 billion.

What could not be frozen tells you more. About 195,000 ETH, worth around $450 million, is beyond any freeze, and Gallic's count includes roughly $1.45 billion in bitcoin. Neither asset has an issuer with a blacklist. By Gallic's reckoning, the frozen stablecoins are less than half of the total.

For a treasury, the lesson is uncomfortable. The power that froze $2.4 billion of stolen stablecoins on Thursday works on any wallet, at the issuer's discretion. Circle is authorised in the EU as an electronic money institution supervised by France's ACPR, and USDC and EURC are MiCA e-money tokens. USDT is not authorised under MiCA. Know which one you hold, why, and what happens to it when the counterparty holding it is the one that gets drained.

What to Do Before Monday

1. Count your exposure. Every balance, settlement float and pending withdrawal you or your merchants hold at Binance, network by network. Some of it is not moving, so know which.
2. Find out who is liable. With a MiCA-authorised custodian, Article 75(8) gives you a claim for an attributable loss. With anyone else, find the clause in their terms that does the same job, or accept that there is none.
3. Watch your own hot wallets for EIP-7702 delegations. If the reports are right, one signature turned a Binance wallet into someone else's contract. Alert on any delegation from a wallet you control, and keep hot balances to what a day of operations needs.
4. Write the incident statement before you need it. Binance went through three versions in 13 minutes. Decide now who speaks, and never tell customers their funds are safe until you know.
5. Keep a second route out. If your crypto settlement runs through one exchange, this is what a bad night looks like.

The final figure will move all weekend. Your own exposure should not.