$6.3B Binance Hack Sends Ethereum to $2,200: Who's Selling?

The Biggest Crypto Heist Ever Just Sent Ethereum to $2,200

Co-produced by Daniel Aharonoff and DigitalDan

As the chief editor of ethdan.me, I have covered exchange hacks, market crashes, and more "worst days ever" than I care to count. But Thursday, October 29, 2026, was different. In about 20 minutes, attackers drained an estimated $6.3 billion from Binance — the world's largest crypto exchange — in what is now the largest theft in the history of cryptocurrency. And Ethereum, already battered by a brutal October, took a direct hit: ETH slid from around $2,330 to as low as $2,177 before clawing back above $2,200 on Friday.

So what's the big deal? This was not a small exchange in a faraway jurisdiction getting picked off. This was Binance. And the selling it triggered — more than $350 million in Ethereum futures liquidations in 24 hours, funding rates at their most bearish since early June, and US spot Ethereum ETFs posting a record monthly outflow of $1.45 billion — raises a question every Ethereum holder needs to answer right now: is this the capitulation that marks the bottom, or the start of a contagion that takes ETH below $2,000?

What's the Big Deal? $6.3 Billion Gone in 20 Minutes

Let me lay out what actually happened, because the scale here is hard to overstate.

The heist itself: Late Thursday, attackers drained Binance's hot wallets across multiple blockchains in a burst lasting roughly 20 minutes. The haul included bitcoin, ether, and stablecoins USDT and USDC, plus smaller tokens. Blockchain analytics firms TRM Labs, Chainalysis, and Elliptic have linked the attack with high confidence to TraderTraitor, the North Korean hacking group associated with the Lazarus Group — a name that shows up in crypto breach reports with depressing regularity.

The starting point: Binance initially pointed to a compromised DevOps engineer's laptop that let attackers submit unauthorized withdrawal requests through internal systems. By Friday, the exchange said its investigation had uncovered "additional points of breach," calling it a complex attack. Notably, Binance has reported no evidence that private wallet keys were leaked — this was an attack on the exchange's internal withdrawal machinery, not on Ethereum itself.

The Ethereum angle is huge: The attacker initially took about 200,000 ETH from Binance, then acquired roughly 308,000 more by swapping stolen stablecoins and other tokens. At one snapshot on Friday morning, tracked attacker wallets held more than 508,000 ETH. Separately, reporting linked approximately $2.5 billion in ether and token outflows from one exchange wallet to EIP-7702 authorizations — the Ethereum feature that lets accounts delegate execution to smart-contract code. That detail matters, and I will come back to it, because it is the part of this story that is specifically about Ethereum's design, not just Binance's security.

The freeze that saved half the haul: Around $3 billion of the stolen assets — mostly USDT and USDC — was frozen on-chain by their issuers, Tether and Circle, with help from industry partners. Stablecoin issuers can blacklist specific wallet addresses, and once flagged, those tokens become effectively unspendable.

Binance is covering the losses: The exchange said it set aside more than $6.34 billion in company resources to restore customer balances, including $5 billion already held in the exact token assets affected, plus its Secure Asset Fund for Users (SAFU), an emergency reserve of around $1 billion. Withdrawals were paused while security checks run — Binance said they could resume within about 45 to 48 hours — while deposits stayed open. CEO Richard Teng's message was blunt: "Bottom line — your money is safe, and we're covering every loss."

Why You Should Care: Ethereum Just Broke Its Last Line of Defense

The hack did not happen in a vacuum. It landed on a market that was already exhausted, and that is why the damage to Ethereum was so severe.

ETH fell through key levels: Ethereum dropped from about $2,330 to $2,177 on Thursday and Friday, before recovering to around $2,239. It fell below the $2,256 horizontal support level, and traders are now watching $2,204 as the next floor, with deeper levels at $2,107, $1,972, and $1,828 if the slide extends. Analyst Ali Martinez warned that ETH appears to have broken below a broadening pattern on its daily chart, suggesting a potential decline toward $2,000.

Liquidations hit $350 million: Ethereum futures liquidations topped $350 million in 24 hours, driven by more than $311 million in long liquidations, according to Coinglass data. Open interest fell by 410,000 ETH to 12.61 million ETH. Funding rates dropped to -0.0105, the lowest since early June — meaning traders are now paying to stay short. That is the derivatives market voting, loudly, that it expects more downside.

The ETF exodus just set a record: US spot Ethereum ETFs posted $105.48 million in net outflows on Thursday alone. October's total now stands at about $1.45 billion — officially surpassing November 2025's $1.42 billion as the worst month on record for these funds. Remember, just days ago October was $78 million short of that record with two trading days left. It did not need two days. One hack-filled session did it.

Bitcoin fell too — but Ethereum fell harder: Bitcoin slid to a six-week low near $76,500 before recovering to around $78,400, while the S&P 500 dropped 2.1% and tech stocks sold off alongside crypto. The whole market was risk-off. But Ethereum's decline carried an extra ingredient: the EIP-7702 question.

The EIP-7702 Question: Is This an Ethereum Problem?

Here is where I want to slow down, because this is the part of the story that will matter long after the Binance headlines fade.

What EIP-7702 does: Introduced in Ethereum's Pectra upgrade, EIP-7702 lets a regular wallet account sign an authorization delegating its execution to smart-contract code. In plain language, it lets your normal wallet temporarily act like a smart wallet, with features like batched transactions and sponsored gas fees.

Why it showed up in the hack reports: Reporting linked roughly $2.5 billion in ether and token outflows from one exchange wallet to EIP-7702 authorizations. That sentence has been shared widely, and it deserves a careful reading: the use of EIP-7702 authorizations during an attack does not itself establish a flaw in Ethereum's consensus or in the EIP. If attackers gain control of an internal system that can submit authorized transactions, they can use whatever transaction types that system supports. The authorization mechanism worked as designed; the question is who held the keys to use it.

Why it still matters for Ethereum: Even if EIP-7702 is not the villain here, this incident puts a spotlight on it that will not go away. Expect three things:

• More scrutiny of delegated accounts: Wallet providers and auditors will re-examine how EIP-7702 authorizations are issued, revoked, and monitored, especially for high-value accounts.
• A revocation wave: Users and institutions will check for unintended delegations and revoke them — healthy hygiene, but also a trust dent in a flagship usability feature.
• A debate about speed vs. safety: Every feature that makes Ethereum easier to use also creates a new surface for attackers who compromise the systems around it.

The honest bottom line: Ethereum's chain did not break. Blocks kept being produced, validators kept validating, and no consensus flaw has been alleged. But an Ethereum feature is now part of the largest heist narrative in crypto history, and narratives move markets just as surely as fundamentals do.

Who's Still Buying? The Other Side of the Panic

Now, the twist — because there is always a twist, and this one fits the pattern that has defined Ethereum's entire October on ethdan.me.

The stakers still aren't blinking: As of October 28, about 44.1 million ETH was staked — roughly 36% of supply, an all-time high. Those coins are locked. They cannot be panic-sold into a hack headline.

Binance itself is the biggest buyer in this story: Think about what "covering $6.34 billion in losses" actually means in market terms. Binance says it already holds $5 billion in the exact tokens stolen. That is an exchange absorbing a historic loss with its own balance sheet rather than socializing it onto users — the opposite of what happened at FTX, Mt. Gox, and every exchange failure that scarred this industry. CertiK's CEO noted that roughly $3 billion in frozen assets plus Binance's $1.17 billion emergency fund would cover about 66% of reported losses on their own, leaving a gap Binance says its company funds close. CertiK also said it needs more detail to independently verify the $5 billion matching-token claim — and that verification, via Binance's promised public Proof of Reserves, is now the single most important credibility test in crypto.

The frozen $3 billion is a strange kind of victory: The stablecoin freeze worked. Tether and Circle blacklisted attacker addresses within hours, and close to half the haul is now unspendable. But notice the tension: the same centralized kill-switch that saved billions here is exactly what crypto purists have always warned about. This week, that kill-switch was the hero. The debate about whether it should exist at all just got a lot more complicated.

What I'm Watching Next

Here is my checklist for the days ahead — and I suggest you keep the same one:

1. Binance withdrawals resuming: The 45-to-48-hour window lands around the weekend. A smooth resumption calms the market; any delay re-ignites panic.
2. Proof of Reserves: Binance promised user funds will be verified publicly. The market will read that document like a verdict.
3. The $2,204 level: If ETH holds it into the weekly close, the "range between $2,150 and $2,300" scenario from trader Daan Crypto Trades looks plausible. A weekly close below $2,200, as analyst Ted Pillows warned, could open a move below $2,000.
4. The attacker wallets: The 18,270 BTC has not moved. The ETH is still being tracked. Any movement — to a mixer, a bridge, or an exchange — will be front-page news in crypto within minutes.
5. The EIP-7702 fallout: Watch for statements from the Ethereum Foundation, client teams, and major wallet providers about delegation safety. Any concrete change here would be the lasting technical legacy of this hack.
6. ETF flows next week: October's record $1.45 billion outflow is now history. The question is whether November starts with a reversal or a continuation. The funds still hold about 5.9 million ETH — they are wounded, not dead.

Final Thoughts: The Biggest Test Ethereum Has Faced in Years

Let me be blunt about what I think this all means. The $6.3 billion Binance hack is the largest theft in crypto history, full stop — bigger than the Bybit hack, bigger than Mt. Gox in dollar terms, bigger than anything this industry has ever had to absorb. It hit the biggest exchange, it moved through Ethereum's own newest account feature, and it landed in a month when Ethereum ETFs were already bleeding at a record pace.

And yet — and this is the part that keeps me from despair — the system responded the way it is supposed to. Stablecoin issuers froze $3 billion. The exchange covered the rest from its own funds instead of its users' balances. The chain never stopped. The stakers never left.

One group is going to look very smart in six months: either the sellers who got out near $2,200 as the hack headlines screamed, or the stakers and buyers who treated the biggest heist in crypto history as someone else's security failure rather than Ethereum's obituary. History has examples of both — but history also says that the days when everyone is certain crypto is finished have usually been the days to pay closest attention.

Stay tuned to ethdan.me for the next chapter of this story — because if those attacker wallets start moving, or if Binance's Proof of Reserves raises more questions than it answers, this story is far from over.

Co-produced by Daniel Aharonoff and DigitalDan