The cryptocurrency market is facing reports of one of the largest security incidents in its history. According to blockchain analytics firm Chainalysis, losses from an alleged Binance hack may have reached $5.91 billion. If confirmed, that figure would be nearly four times the $1.46 billion stolen from Bybit in February 2025, when the exchange suffered one of the largest attacks the industry had ever seen.

The first reports of suspicious transfers emerged on the evening of October 29. Preliminary data indicated that approximately $2.77 billion had moved out of wallets associated with Binance within minutes across several blockchain networks. The reasons for the transfers were initially unclear, but suspicions of a large-scale attack soon emerged.

Binance stated that it would cover the losses and was conducting a security review. The company also reported that it was cooperating with law enforcement and taking steps to freeze assets. Deposits and withdrawals were temporarily suspended while the review was underway. The exchange promised to publish a detailed report after the investigation and urged users to rely on official information channels.

However, the final amount of the losses, the circumstances surrounding the alleged compromise and the volume of funds recovered or frozen still require confirmation.

How the Attack May Have Worked

According to preliminary technical analysis, the attacker may have exploited EIP-7702, a mechanism introduced to Ethereum as part of the Pectra upgrade. The technology allows a regular cryptocurrency wallet to temporarily function like a smart contract. This requires a specific authorization signed with the relevant private key.

A private key is secret information that allows its owner to control cryptocurrency. If an attacker gains the ability to create valid signatures on behalf of a wallet owner, they may be able to use authorized operations to transfer assets.

In this case, preliminary reports suggest that the attacker may have prepared 50 signed authorizations with sequential transaction numbers. This approach could have helped overcome uncertainty caused by the wallet’s changing transaction counter and increased the likelihood that one of the authorizations would be valid.

A specialized smart contract designed to sweep funds from the wallet may then have been installed. According to Blockaid, a similar mechanism was used to transfer USDT, Ethereum and other tokens.

The key question remains unanswered: how did the attacker obtain the required signatures? EIP-7702 does not allow arbitrary users to take control of other people’s wallets. A successful attack would have required valid authorizations or access to a system capable of generating them.

Investigators therefore need to determine whether private keys were compromised, whether the transaction-signing infrastructure was affected or whether another vulnerability was responsible. Until the investigation is complete, none of these explanations can be treated as conclusively established.

Which Assets May Have Been at Risk?

Preliminary estimates of the losses vary. Chainalysis put the potential damage at approximately $5.91 billion, while separate on-chain analytics indicated that at least $5.57 billion in assets had moved. These figures do not necessarily represent the final amount stolen: transfers between addresses alone do not prove that every transaction was connected to a theft.

The published estimates included the following asset breakdown:

• Bitcoin (BTC) – approximately $1.45 billion;
• Tether (USDT) – approximately $1.57 billion;
• Ethereum (ETH) – approximately $875 million;
• USD Coin (USDC) – approximately $823 million;
• Tron (TRX) – approximately $234 million;
• Ripple USD (RLUSD) – approximately $88.5 million;
• Wrapped Beacon ETH (WBETH) – approximately $75 million;
• Tether Gold (XAUT) – approximately $50 million;
• other cryptocurrencies – approximately $447.5 million.

These figures should be treated as preliminary estimates rather than a confirmed final tally. An accurate assessment requires investigators to establish the origin of each transfer, identify the owners of the addresses involved and determine which assets actually came under the attacker’s control.

According to the figures cited in preliminary reports, the potential losses were equivalent to roughly 3.9% of the $144 billion in customer assets reportedly held by Binance. However, this comparison is meaningful only if both figures cover the same categories of assets and the estimated losses are confirmed.

Freezing Funds: Why Stablecoins Can Be Stopped

One of the most significant aspects of the incident was the reported freezing of some assets. According to preliminary information, Binance said it had frozen approximately $3 billion. Stablecoin issuers Tether and Circle, as well as participants in the Arbitrum ecosystem, were also reportedly involved in the response.

Stablecoins are cryptocurrencies designed to maintain a relatively stable value, usually by tracking an asset such as the US dollar. USDT and USDC are widely used for trading, transfers and storing value within the cryptocurrency ecosystem.

Unlike Bitcoin, centrally issued stablecoins have issuers that can, under certain conditions, freeze specific addresses. This can make it possible to immobilize assets linked to suspected criminal activity even after they have moved between wallets.

However, freezing funds does not automatically return them to the affected party. Additional technical and legal procedures may be required. The ability to freeze assets also depends on the particular token, its technical design and the issuer’s authority.

Initial reports suggested that Circle may have frozen approximately $823 million in USDC, while Tether may have frozen around $1.567 billion in USDT. These figures require independent confirmation, and their relationship to the overall estimated losses must be clarified as the investigation progresses.

Meanwhile, analysts reported continued token swaps through decentralized exchanges, including Uniswap and SUN.io. Such transactions can complicate the tracking of assets, particularly when an attacker uses multiple blockchains and trading platforms.

Nevertheless, public blockchains allow investigators and analytics firms to trace transfers, identify connected addresses and share information with exchanges and token issuers. Combining on-chain analytics with asset-freezing mechanisms may help prevent some of the funds from being moved further.

Why the Incident Is Being Compared With the Bybit Hack

In February 2025, approximately $1.46 billion in cryptocurrency was stolen in an attack on Bybit. The incident became one of the largest hacks in the industry’s history and demonstrated the potential consequences of compromising a major exchange’s infrastructure.

The estimated $5.91 billion in potential Binance losses is almost four times that amount. If confirmed, the incident would be unprecedented in financial scale.

However, comparisons should consider more than the nominal value of the assets involved. The attack method, detection speed, ability to stop transfers, proportion of frozen funds and final losses incurred by customers or the platform are all important factors.

Cryptocurrency exchanges use different models for asset custody and transaction signing. As a result, the consequences of compromising one system may differ substantially from those of attacking another platform, even when both manage comparable volumes of assets.

An important historical example is the October 2022 incident involving BNB Chain. At the time, an attacker exploited a vulnerability associated with the BSC Token Hub bridge. After the attack was detected, the network was halted, helping limit the consequences. The incident demonstrated the importance of rapid response and emergency control mechanisms.

The alleged Binance incident differs in that assets may have moved across several blockchains. In such circumstances, a single exchange has no universal mechanism to stop every transfer independently. The available response options depend on the characteristics of each network, whether centralized token issuers are involved and how willing other market participants are to cooperate.

How the Incident Affected the Crypto Market

Amid reports of the possible hack, Bitcoin was reported to have fallen below $77,000. Before the decline, BTC had been trading near $82,000, according to the market figures cited in the initial reports.

The market capitalization of the cryptocurrency sector was also reported to have fallen by approximately $170 billion, while $1.32 billion in positions were liquidated over a 12-hour period. These figures should be treated as preliminary market estimates that may change as new information becomes available.

The market reaction is understandable. When the security of a major cryptocurrency exchange comes into question, investors reassess the risks of holding assets on centralized platforms. Some reduce their positions, others move their funds to self-custody wallets, and leveraged traders may face forced liquidations as prices fluctuate sharply.

Uncertainty about the scale of the incident and concerns over possible restrictions on asset transactions can create additional pressure. If users are unsure whether their funds will remain accessible, they may temporarily stop trading or reduce their activity.

However, it would be premature to attribute the entire market decline solely to the alleged Binance hack. Cryptocurrency prices are also influenced by broader financial market trends, liquidity conditions, interest rates, large investors’ behavior and the use of leverage.

Assessing the incident’s actual impact requires more than tracking Bitcoin’s price. Trading volumes, transfers between exchanges and self-custody wallets, futures funding rates and subsequent investor behavior are also important indicators.

What the Incident Reveals About Crypto Security

The alleged attack has renewed concerns about the risks of centralized cryptocurrency custody. Major exchanges provide convenient infrastructure for trading, exchanging and managing digital assets, but they also represent attractive targets for attackers.

Security depends on more than protecting private keys. Transaction-signing procedures, access controls, suspicious-activity monitoring, the distribution of responsibilities among employees and automated responses to unusual activity all play important roles.

Particular attention must be paid to new blockchain capabilities. Upgrades that expand wallet functionality and enable more complex operations create additional opportunities for users, but they also require security practices to evolve.

For investors, the incident is a reminder that storing cryptocurrency on an exchange involves counterparty risk. Even if users never disclose their keys and do not engage in suspicious activity, they remain dependent on the platform’s ability to protect its infrastructure and maintain access to funds.

Self-custody is not a universal solution either. Losing a seed phrase, falling victim to malicious software or making an incorrect transaction can result in irreversible losses. The choice of storage method should therefore reflect the amount invested, the user’s experience and their ability to manage security independently.

What Comes Next: The Key Questions for Investigators

Several factors will be critical in the coming days: the confirmed amount of the losses, the technical cause of the incident, the volume of frozen assets and the possibility of recovering the remaining funds.

It is equally important to establish whether customer balances were affected and whether the exchange has incurred obligations that could influence its financial position. Binance’s statement that it would cover the losses is significant, but investors need further details about the compensation process and the actual state of the platform’s assets.

If the investigation confirms that customer funds remain protected and the losses can be covered without disrupting the platform’s operations, market pressure may ease over time. If the vulnerability proves to have affected a broader part of the infrastructure, however, the consequences could last longer and undermine confidence in centralized cryptocurrency services more generally.

For now, definitive conclusions would be premature. Chainalysis estimates and on-chain analytics provide an indication of the incident’s potential scale, but they cannot replace a full technical investigation and an official report from the exchange.

The Bottom Line: Crypto Trust Depends on More Than Technology

Reports of a possible $5.91 billion Binance hack highlight the serious risks facing even the largest participants in the cryptocurrency industry. If the preliminary estimate is confirmed, the scale of the losses would far exceed previous records in the sector.

The incident is about more than the value of the assets involved. It raises broader questions about infrastructure reliability, private-key management, the ability to freeze suspicious transfers quickly and cooperation between exchanges and stablecoin issuers.

Cryptocurrencies have an important technological advantage: public blockchains make it possible to trace asset movements. But transaction transparency alone does not guarantee the recovery of stolen funds. The outcome depends on how quickly market participants can identify connected addresses, restrict further transfers and establish what happened.

For investors, the main lesson is that a major exchange’s reputation and business scale do not eliminate technical risk. In the long run, trust in the cryptocurrency market will depend not only on advances in blockchain technology and financial products, but also on companies’ ability to demonstrate the reliability of their systems and protect customer assets.