Binance Says User Funds Are Safe After Reserve-Linked Wallets Drained in Suspected Hack

What to Know

• Binance 14, a hot wallet central to Thursday’s suspected hack, appeared in Binance’s 1 October proof-of-reserves data.
• The wallet was listed as holding 1.26 billion USDT and 89,475 ETH among 37 assets at the time of the reserve report.
• Binance held exactly enough ETH to cover customer balances on 1 October, meaning the stolen ether could leave ETH backing near 94% until replacement funds are added.
• The attacker moved 167,464 ETH from Binance 14 at 20:24 UTC, or 4:24 pm ET, followed by 28,005.6 ETH from Binance 16.
• Nearly 15 minutes later, 195,460 ETH, around $442 million, was sent to a second address.
• The roughly 204,500 ETH taken represents approximately 5.6% of Binance’s reported ETH reserves.
• USDC backing stood at 108.26% of customer balances on 1 October, while several altcoin positions may also have been affected.
• Tether, Circle, Ripple and World Liberty Financial have frozen large portions of stolen stablecoin and token balances.
• Binance says user funds are safe, and its 1 November reserve snapshot will be closely watched for evidence of replacement assets.

Reserve-Linked Wallets Put Binance Backing Under Scrutiny

Binance is facing renewed scrutiny after wallets connected to its published proof-of-reserves system were drained in a suspected hack, raising immediate questions about how the exchange will restore asset backing across affected balances. The exchange has said user funds are safe, but the incident is significant because the emptied wallets were not isolated treasury addresses with no customer relevance. They were part of the wallet set Binance itself has used to demonstrate that customer crypto balances are fully backed.

The focal point is a hot wallet labeled Binance 14. That wallet appeared in Binance’s 1 October proof-of-reserves materials and was listed as holding 1.26 billion USDT and 89,475 ETH among 37 assets. Because the wallet was included in the exchange’s reserve framework, crypto taken from it formed part of the assets supporting customer liabilities on the platform. As a result, the suspected hack has moved beyond a standard exchange security incident and into a broader discussion about proof-of-reserves durability, operational controls, and the speed with which a major platform can replenish drained balances.

On 1 October, Binance’s proof-of-reserves data showed that the exchange held exactly enough ETH to cover customer balances, representing a 100% reserve ratio for ether. That left little cushion against an ETH-denominated loss. The roughly 204,500 ETH taken in the incident represents approximately 5.6% of Binance’s ETH reserves, implying that ether backing could sit near 94% until the missing assets are replaced or otherwise offset. Binance’s next reserve snapshot, scheduled for 1 November, is therefore set to become a key transparency checkpoint for customers, analysts and market participants.

How the Suspected Attack Unfolded

The suspected attacker reportedly used an Ethereum feature known as EIP-7702, which allows a wallet to delegate control to a piece of software. After obtaining a signature from Binance 14’s key granting that permission, the attacker was able to turn the wallet into a sweeper, a setup that automatically forwarded incoming funds to an address controlled by the attacker. The mechanism matters because it highlights how advanced wallet functionality can create new operational risks if signing controls are compromised.

Blockchain data shows 167,464 ETH leaving Binance 14 at 20:24 UTC, or 4:24 pm ET. That was followed by 28,005.6 ETH from Binance 16, with both transfers landing in the attacker’s wallet. Nearly 15 minutes later, 195,460 ETH, valued at around $442 million, moved to a second address. The scale and speed of those movements intensified concern across the crypto market, particularly because the drained addresses were tied to published reserves rather than to an undisclosed internal wallet pool.

The loss did not appear limited to ETH. The attacker’s smaller positions included ENA, UNI, PEPE and AAVE. Those positions represented anywhere from 7% to 15% of Binance’s reported holdings of each asset, suggesting that several token reserve ratios could also be pressured until replacement funds are added. USDC may also be affected because Binance reported holding 108.26% of customer USDC balances on 1 October, a cushion that could be narrowed by losses depending on the exact amount and recoveries.

Binance Says Customer Balances Will Be Honored

Binance and co-CEO Yi He have said user funds are safe. In practical terms, that means customers should expect their account balances to be honored even if assets that backed those balances were stolen from reserve-linked wallets. Founder Changpeng Zhao also said he expects users to be fully recovered. Those statements are important for confidence, but the next measurable test will be whether the exchange’s updated reserve disclosure shows the missing assets have been replaced.

For centralized exchanges, proof-of-reserves data is meant to assure customers that platform liabilities are matched by on-chain assets. However, the Binance incident underscores a crucial distinction. A reserve snapshot can show that assets existed at a point in time, but it cannot by itself prevent those assets from being drained later. This is why market participants tend to evaluate proof-of-reserves alongside security architecture, internal controls, wallet segregation, emergency funds and the exchange’s ability to mobilize replacement liquidity after a shock.

Binance’s SAFU emergency fund may become part of that conversation. The fund holds around $1 billion in bitcoin and could be used to offset losses, although any use of the fund would be a strategic decision for the exchange. The presence of an emergency fund provides a potential backstop, but investors will be watching for concrete on-chain evidence of replenishment rather than relying solely on public assurances.

Stablecoin Issuers Freeze Large Parts of the Haul

Stablecoin issuers and token entities have already moved to freeze portions of the stolen assets. Tether CEO Paolo Ardoino said more than 1.567 billion USDT was frozen. Changpeng Zhao said Circle’s USDC freeze was around $823 million. Ripple also froze around $200 million in assets, while World Liberty Financial froze $27 million worth of its USD1 stablecoin. These freezes may reduce the attacker’s ability to cash out or move value through compliant venues, though frozen assets do not automatically equal immediate recovery for the exchange.

The freezing of stablecoins highlights a defining feature of centralized stablecoin infrastructure. Unlike fully permissionless crypto assets, many fiat-backed stablecoins can be frozen by issuers when funds are linked to hacks, sanctions or law-enforcement requests. That capability can be controversial among decentralization advocates, but in exchange-hack scenarios it can also limit losses, preserve potential recovery paths and slow the movement of stolen funds through the broader market.

Even so, a frozen token balance may still require legal, technical or administrative steps before it can be reissued, returned or otherwise reflected in an exchange’s usable reserves. That means Binance’s reserve ratios may remain the core near-term metric for customers. The 1 November snapshot will show whether the exchange has already filled the hole, whether frozen assets have been recognized in any way, or whether affected assets remain below prior backing levels.

Why the 1 November Reserve Snapshot Matters

The next proof-of-reserves snapshot is likely to be one of Binance’s most closely examined disclosures. Market participants will look first at ETH, because the 1 October report showed no surplus beyond customer balances. If roughly 204,500 ETH was removed from reserve-linked wallets and no replacement assets were added, ether backing would be expected to remain below full coverage. If the exchange has replenished the missing ETH, the reserve ratio should reflect that restoration.

Traders will also assess USDC and affected altcoins. Binance had a larger USDC cushion than ETH on 1 October, but a major theft can quickly change reserve dynamics. For smaller tokens such as ENA, UNI, PEPE and AAVE, even comparatively smaller stolen positions can represent a meaningful share of reported holdings. That is why reserve coverage across several assets, not just ether, will be examined closely.

The incident also arrives at a sensitive time for centralized exchange transparency. Since proof-of-reserves became a widely discussed standard, customers have increasingly expected exchanges to publish wallet balances and liability comparisons. However, transparency does not eliminate custody risk. A platform can publish wallets, prove ownership and still suffer losses if signing permissions, hot wallet operations or internal key management fail. The Binance case may therefore sharpen industry debate around how much reserve data should be published, how hot wallets should be segmented, and whether reserve snapshots should be supplemented by more frequent attestations.

Market Confidence Depends on Replacement and Clarity

For Binance, the immediate challenge is confidence. Public statements that user funds are safe can calm customers in the short term, especially when paired with freezes by major stablecoin issuers. But confidence in a reserve-backed model ultimately depends on verifiable restoration. If the next snapshot shows affected assets back at or above full coverage, the market may view the incident as a major operational failure that was financially absorbed. If gaps remain, scrutiny could intensify.

The broader crypto market will also be watching how the attacker’s remaining funds move. Large ETH movements can influence sentiment even when the stolen coins are not immediately sold, because traders may anticipate future liquidation attempts, mixing activity or cross-chain movement. At the same time, the freezing of major stablecoin components may limit the attacker’s flexibility and could improve the odds of partial recovery.

For customers, the key issue is whether account balances remain accessible and honored. Binance has said they are safe, and senior figures have indicated that users should be made whole. The central unresolved question is how quickly the exchange replaces missing reserve assets and how clearly that replacement appears in its next public data. Until then, the suspected hack will remain a major test of centralized exchange resilience, proof-of-reserves credibility and post-breach transparency.

Frequently Asked Questions (FAQs)

What happened to Binance’s reserve-linked wallets?

Wallets connected to Binance’s published proof-of-reserves data were drained in a suspected hack. The key wallet identified in the incident was Binance 14, which appeared in the exchange’s 1 October reserve data.

Why is Binance 14 important?

Binance 14 matters because it was listed as part of the exchange’s reserves backing customer balances. It held 1.26 billion USDT and 89,475 ETH among 37 assets in the 1 October reserve report.

How much ETH was taken?

The incident involved roughly 204,500 ETH. Blockchain movements included 167,464 ETH from Binance 14 and 28,005.6 ETH from Binance 16, followed by 195,460 ETH moving to a second address nearly 15 minutes later.

What does this mean for Binance’s ETH backing?

Binance held exactly enough ETH to cover customer balances on 1 October. Because the stolen ETH represented approximately 5.6% of reported ETH reserves, ether backing could be near 94% until the exchange replaces the missing assets.

Are Binance user funds safe?

Binance and co-CEO Yi He have said user funds are safe. That means the exchange says customer balances will be honored, although market participants will look to the 1 November reserve snapshot for confirmation that affected assets have been replenished.

Which other assets were affected?

The attacker’s smaller positions reportedly included ENA, UNI, PEPE and AAVE. Those positions represented anywhere from 7% to 15% of Binance’s reported holdings of each asset, making reserve coverage for those tokens another area to watch.

Have any stolen funds been frozen?

Yes. Tether froze more than 1.567 billion USDT, Circle’s USDC freeze was described as around $823 million, Ripple froze around $200 million in assets, and World Liberty Financial froze $27 million worth of USD1 stablecoin.

Could Binance use its SAFU fund?

Binance’s SAFU emergency fund holds around $1 billion in bitcoin and could be used to offset losses. Whether and how it is used will depend on the exchange’s response and replacement strategy.

When will the market know if Binance replaced the missing assets?

Binance’s next reserve snapshot is scheduled for 1 November. That disclosure will be closely watched to see whether the exchange has restored full backing for ETH and other affected assets.