It is 9 p.m. in New York, and I am watching what could become the worst hack crypto has ever seen. I choose those words carefully. Elon Musk had three words for it: "Everyday is Zeroday," pos
It is 9 p.m. in New York, and I am watching what could become the worst hack crypto has ever seen.
I choose those words carefully.
Elon Musk had three words for it: "Everyday is Zeroday," posted at 6:33 p.m. over a report of the outflows. I am with Elon on this one.
A zero-day is a security flaw that attackers exploit before the software maker knows it exists, leaving zero days to prepare a fix. Musk added no data and no explanation, but he named the disease: every day, this industry runs on code somebody has not broken yet.
Musk's "Everyday is Zeroday" post over The Kobeissi Letter's breaking report, 6:33 p.m. ET. Screenshot: X.
When we covered the Bybit hack in February 2025, the $1.5 billion theft was the largest this industry had seen. Tonight's numbers break that record.
Earlier tonight I wrote our first story at 5:52 p.m., when the biggest confirmed number was a $1.5 billion freeze by the token issuers. By 8:52 p.m., Binance said the verified freeze had reached around $3 billion and repeated that user funds are safe.
The estimated theft is nearly double the freeze. At 8:26 p.m., Chainalysis put it at approximately $5.912 billion at the time of the theft, nearly four times the amount stolen in the Bybit heist.
My argument tonight is that the freeze is the wrong number to watch. A frozen token cannot be moved by anyone, including the thief, so the figure that decides how bad this gets is the gap between what was taken and what was caught.
Blockaid's account of the first sweep, from Tornado Cash funding to the collection address. Source data: Blockaid, Arkham Intelligence and Etherscan, Oct. 29-30, 2026.
Blockaid, Arkham Intelligence and Etherscan
Researcher Molly White, who has been following the wallets, estimates roughly $5.5 billion in liquid assets actually left Binance, with roughly $3 billion still under the attacker's control. She cautions that the trackers are not all measuring the same thing, since some totals count tokens already frozen by their issuers.
Even the lowest figure I have seen, roughly $3.5 billion that left Binance's Ethereum wallets alone, per Unchained, is more than double what Bybit lost. If Chainalysis is anywhere close, this is the largest crypto theft on record, with one caveat, the final number is not settled.
What unsettles me is how familiar the method sounds. Security firm Blockaid says the attacker used EIP-7702, a new Ethereum feature that lets a wallet temporarily run another program's code, and bundled 50 delegation requests into one transaction, and one slipped through.
Its CEO, Ido Ben-Natan, told CoinTelegraph the method looks "very, very similar" to the Bybit attack.
Arkham, another blockchain intelligence firm that says it has verified 70 addresses tied to the attacker, says the method cannot be confirmed yet, and Binance has confirmed none of the mechanics.
There is no evidence of that so far. Blockaid describes a defensive use of AI: it says its models flagged the drain within two minutes of the first sweep.
Arkham shows $2.18 billion in the attacker's collection address at 9:33 p.m. ET; Blockaid says about $1.8 billion of it is stablecoins frozen by their issuers. Screenshot: Arkham Intelligence.
Binance has suspended all deposits and withdrawals.
The fastest defense came from Tether and Circle, the companies behind the two biggest stablecoins, which froze more than $1.5 billion and $800 million respectively within minutes, more than $2.3 billion between them. That response limits the attacker's ability to move what was taken, not the size of what was already gone.
Binance says it "will cover all losses," and founder Changpeng Zhao, who no longer runs the exchange, added, "loss might be a bit higher than that, but will cover," against roughly $144 billion in customer assets.
The same address on Etherscan, tagged "Binance Hot Wallet Exploiter 2," funded by Binance 14 five hours earlier. Screenshot taken 9:34 p.m. ET.The first backstop is SAFU, a $1 billion emergency fund Binance converted into bitcoin earlier this year. If the unrecovered amount lands anywhere near what White estimates the attacker still holds, that fund alone would not cover it, and Binance would need another funding source.
This is how one hack becomes a market problem.
Binance is not one exchange among many. It reported 323 million registered users in a July 14, 2026 release.
Its share of all exchange trading was about 35 percent in the second quarter, the largest of any venue. In spot trading over the first half of the year, it did about four and a half times the volume of the next-largest exchange.
If the missing billions stay missing, customers at other exchanges could start asking whether their venue's pipes are any different. Confidence, not the theft, is what gets stolen next.
Tonight is a terrible week for all exchanges out there.
From our archives: Watch our previous conversation with Binance CEO Richard Teng.
Binance Token Listing (2:18)It deserves some tonight. Hours into what could be the industry's largest theft, the company said it will cover all losses, and Zhao added the bill "might be a bit higher than that, but will cover."
For context, Mt. Gox's creditors waited a decade for partial repayment.
QuadrigaCX's customers waited years for a fraction of their money, valued at 2019 bankruptcy prices.
FTX's customers are being repaid in dollars locked at November 2022 prices, so the market's recovery since then happened without them.
Binance has actually done this before, covering the 7,000 bitcoin stolen in 2019, and it keeps a $1 billion emergency fund for exactly this kind of night.
The honest answer is: we don't know. Every option asks you to trust someone, or to become your own security team.
Self-custody flips the risk. A hardware wallet means no exchange can lose your coins, but no one can save them either: lose access to both the wallet and its recovery phrase, and the money may be unrecoverable.
Ledger's wallets kept their keys safe through both of the company's scandals, yet a 2020 breach of its customer database still exposed the names and home addresses of some 272,000 buyers, and in December 2023 attackers slipped malicious code into its Connect Kit software and drained about $600,000 from people using apps built on it.
Since January 2024, Americans can buy bitcoin exposure in an ordinary brokerage account through a spot ETF, next to their index funds.
The largest, BlackRock's iShares Bitcoin Trust, holds about $66 billion and charges 0.25 percent a year. No private key to guard, no recovery phrase to lose.
This is an opinion piece by Mehab Qureshi, Senior Editor at TheStreet. The views expressed are his own and do not reflect the views of TheStreet.
