Updated Oct 30, 2026, 12:16 a.m. EDT. Published Oct 29, 2026, 8:17 p.m. EDT
2 min read
Summary
- Binance 14, the hot wallet at the centre of Thursday’s suspected hack, appears in Binance’s 1 October proof of reserves, meaning the stolen crypto was part of the assets backing customer balances.
- Binance held exactly enough ETH to cover customers on 1 October, so the roughly 204,500 ETH taken would leave ether backing near 94%, with USDC and several altcoins also likely below 100%.
- Tether, Circle, Ripple and World Liberty Financial have frozen much of the stolen stablecoins, and Binance says user funds are safe. Its 1 November reserve snapshot will show whether it has replaced the missing assets.
The Binance wallets emptied in Thursday’s hack are the same wallets the exchange lists as proof that customers’ crypto is fully backed, according to a CoinDesk review of Binance’s own reserve data.
That means that Binance’s 1:1 backing of some assets, ether in particular, has likely fallen below 100% until the exchange replaces what was taken.
Every month, Binance publishes a list of wallets it controls and what they hold, and compares those totals with what customers hold on the platform. Its most recent report, dated Oct. 1, includes a wallet labeled “Binance 14,” the wallet at the center of the attack. At the time of the report, it held 1.26 billion USDT and 89,475 ETH, among 37 assets.
The attacker used an Ethereum feature called EIP-7702, which lets a wallet hand control to a piece of software. After getting Binance 14’s key to sign that permission, the attacker turned the wallet into a sweeper that forwarded incoming funds to their own address. Etherscan shows 167,464 ETH moving from Binance 14 at 20:24 UTC, or 4:24 pm ET, followed by 28,005.6 ETH from Binance 16, both into the attacker’s wallet. Nearly 15 minutes later, 195,460 ETH (around $442 million) was sent to a second address.
That loss falls on a thin cushion, as on Oct. 1 Binance held exactly enough ETH to cover customer balances (a 100% reserve ratio) and 108.26% of customers’ USDC. The roughly 204,500 ETH taken represents approximately 5.6% of Binance’s ETH reserves, leaving Binance’s ETH backing near 94%. The attacker’s smaller positions, including ENA, UNI, PEPE and AAVE, represent anywhere from 7% to 15% of Binance’s reported holdings of each.
Binance and its co-CEO Yi He have said user funds are safe. In practice, that means customers’ balances will be honored even though assets behind them were stolen. Founder Changpeng Zhao also said he expects users to be fully recovered.
Stablecoin issuers have frozen much of the haul, with Tether CEO Paolo Ardoino saying more than 1.567 billion USDT was frozen, while Zhao said Circle’s USDC freeze was around $823 million. Ripple also froze around $200 million in assets and World Liberty Financial froze $27 million worth of its USD1 stablecoin.
Binance’s SAFU emergency fund holds around $1 billion in bitcoin, which could be used to offset the losses.
The exchange’s next reserve snapshot will be taken on Nov. 1. It will show whether the exchange has already replaced stolen assets.
A representative for Binance did not immediately return CoinDesk’s request for comment.
Read all of CoinDesk’s coverage of the Binance hack here.
Originally published at https://www.coindesk.com/business/2026/10/30/binance-hack-drained-wallets-backing-customer-assets-reserve-data-shows.
