---
title: "Ethereum upgrade tied to Binance breach that drained part of $6 billion loss"
description: "CoinDesk reported that an attacker used a 2025 Ethereum upgrade designed to make ordinary wallets smarter, armed with 50 signatures from Binance's own…"
language: en
canonical: "https://whycoinmoves.com/en/events/ethereum-here-s-how-ethereum-upgrade-e060f331587c1d"
published: 2026-10-30T11:35:57.000Z
updated: 2026-10-30T12:36:01.000Z
indexable: true
---

# Ethereum upgrade tied to Binance breach that drained part of $6 billion loss

CoinDesk reported that an attacker used a 2025 Ethereum upgrade designed to make ordinary wallets smarter, armed with 50 signatures from Binance's own…

Attributed sources: [CoinDesk](<https://www.coindesk.com/tech/2026/10/30/here-s-how-one-ethereum-permission-let-an-attacker-drain-usd2-5-billion-from-binance>)

## Key facts

CoinDesk reported that an attacker used a 2025 Ethereum upgrade designed to make ordinary wallets smarter, armed with 50 signatures from Binance's own wallet, in an incident tied to part of Binance's $6 billion loss. The report follows earlier coverage of the Binance hack that sent bitcoin and ether lower.
Evidence strength: Single source, 1 publisher group(s) (CoinDesk).
After site detection, observed returns were 5 minutes: -0.14% (difference from BTC +0.03 pp; Oct 30, 2026, 11:35 → Oct 30, 2026, 11:40, UTC; Gate · USDT); 1 hour: -0.51% (difference from BTC -0.23 pp; Oct 30, 2026, 11:35 → Oct 30, 2026, 12:35, UTC; Gate · USDT)
In the preceding 30 days, the 99th percentile of absolute hourly returns was 1.68% (OKX · USDT; cutoff Oct 30, 2026, 11:35, UTC).

## Returns after site detection

| Window | Return | BTC | Difference from BTC | Actual sampled interval (UTC) | Source |
| --- | --- | --- | --- | --- | --- |
| 5 minutes | -0.14% | -0.17% | +0.03 pp | Oct 30, 2026, 11:35 → Oct 30, 2026, 11:40 | Gate · USDT |
| 1 hour | -0.51% | -0.28% | -0.23 pp | Oct 30, 2026, 11:35 → Oct 30, 2026, 12:35 | Gate · USDT |

## Historical hourly baseline

| Metric | Value |
| --- | --- |
| Coverage | 100.0% (720/720) |
| Median absolute hourly return | 0.20% |
| 99th percentile of absolute hourly returns | 1.68% |
| BTC beta | 1.22 |
| Source / cutoff (UTC) | OKX · USDT / Oct 30, 2026, 11:35 |

## Claims and open questions

- CoinDesk reported that on Ethereum the attacker used a 2025 upgrade built to make ordinary wallets smarter, armed with 50 signatures from Binance's own wallet.
- CoinDesk framed the attack as an Ethereum upgrade that helped drain part of Binance's $6 billion loss.
- Which specific 2025 Ethereum upgrade was involved, and what would an official Binance or Ethereum Foundation statement or on-chain data show about how it was used?
- What portion of the $6 billion loss the described transaction accounts for, and what would a Binance filing or incident report confirm?

## Source evidence

- [Here’s how an Ethereum upgrade helped drain part of Binance’s $6 billion loss](<https://www.coindesk.com/tech/2026/10/30/here-s-how-one-ethereum-permission-let-an-attacker-drain-usd2-5-billion-from-binance>) — CoinDesk; published Oct 30, 2026, 11:35; received Oct 30, 2026, 11:35 (UTC).


## Recent ETH events and market reactions

- [Crypto liquidations reach $1.57 billion as Binance hack pressuures bitcoin and ether](<https://whycoinmoves.com/en/events/ethereum-crypto-liquidations-jump-1-57-a10f8b75bc1332>) — Published Oct 30, 2026, 11:09 (UTC) · Single source (1 publisher) · Security · 5m -0.10% / 1h -0.16%
- [Binance breach of about $6.3 billion sends bitcoin and ether lower](<https://whycoinmoves.com/en/events/ethereum-6-billion-binance-hack-sends-2f4bf6f5ca38bf>) — Published Oct 30, 2026, 04:00 (UTC) · Single source (1 publisher) · Security · 5m -0.07% / 1h +0.74%
- [CFTC chair says AI agents could challenge rules built around human traders](<https://whycoinmoves.com/en/events/ethereum-your-fridge-could-one-day-ea3db705917f92>) — Published Oct 29, 2026, 04:39 (UTC) · Single source (1 publisher) · Regulation · 5m +0.05% / 1h +0.31% / 24h -3.17%
- [Bitmine adds 10,452 ETH, reaching 4.95% of Ethereum supply](<https://whycoinmoves.com/en/events/ethereum-tom-lee-insists-crypto-bull-897e81c861e4a4>) — Published Oct 26, 2026, 14:12 (UTC) · Multiple publishers (2 publishers) · Market watch · 5m +0.47% / 1h +0.73% / 24h +0.61%
- [Ethereum delays Glamsterdam Hoodi testnet fork over gas security flaws](<https://whycoinmoves.com/en/events/ethereum-ethereum-delays-glamsterdam-test-after-c241dfc26e7def>) — Published Oct 23, 2026, 04:59 (UTC) · Multiple publishers (3 publishers) · Project updates · 5m +0.18% / 1h +0.24% / 24h -0.77%
- [Full coin archive](<https://whycoinmoves.com/en/coins/ethereum>)

## Research for this archive

- [Crypto hacks and price impact: Bybit and Cetus case studies](<https://whycoinmoves.com/en/research/crypto-security-exploits-and-evidence-evolution.md>)
- [Why is crypto moving? How to check the evidence behind a price explanation](<https://whycoinmoves.com/en/research/how-to-check-why-crypto-is-moving.md>)
- [Altcoin beta to Bitcoin: BTC, ETH, SOL and DOGE hourly returns](<https://whycoinmoves.com/en/research/hourly-returns-and-bitcoin-beta.md>)
- [Will Bitcoin go back up? Every crash since 2011 and its recovery time](<https://whycoinmoves.com/en/research/bitcoin-crash-recovery-time.md>)

Evidence levels describe source coverage, not the probability that a report is true. Price moves and their timing cannot establish a cause; minute samples show an observed interval and alert thresholds are heuristics. Explanations are model-assisted, with citations and figures checked. Source titles stay in their original language; full articles are not republished. [Methods and limitations](<https://whycoinmoves.com/en/methodology>)
