Last updated: October 29, 2026, 6:30 p.m. ET (22:30 UTC). This is a developing story. We will update it as Binance releases verified information.
Short answer: In a suspected hack on October 29, 2026, about $3.5 billion in crypto moved out of Binance hot wallets on Ethereum in 40 minutes, from 20:24 to 21:04 UTC, according to on-chain tallies by Unchained and Decrypt. Binance said it is investigating “a potential security issue” and that “user funds are completely safe,” but it has not confirmed a hack or any loss. Tether and Circle froze $1.8 billion to $2.4 billion in stablecoins tied to the receiving wallet, depending on the count. If the losses are confirmed, this would be the biggest exchange hack on record, more than twice Bybit’s $1.5 billion in February 2025.
Key takeaways
- Confirmed: Binance is investigating. Tether froze more than 1.567 billion USDT and Circle more than 800 million USDC, their CEOs said.
- Not confirmed: that this is a hack, the total amount, and who did it. Estimates range from about $2.4 billion to $5.8 billion, depending on what is counted.
- Your funds: Binance says user funds are safe. Founder Changpeng Zhao (CZ) said he expects all user funds to be “fully covered.”
- Markets: bitcoin fell below $79,000 and BNB dropped about 7% to roughly $699, Decrypt reported.
What happened, step by step
All times are October 29, 2026, UTC (subtract 4 hours for ET).
| Time (UTC) | Event | Source |
|---|---|---|
| 20:24 | A Binance hot wallet sends about 167,464 ETH, roughly 1.6 billion USDT and 60+ other tokens to a new address in one transaction | Etherscan, via FinanceFeeds and Decrypt |
| 20:24–21:04 | More transfers follow from other Binance-labeled wallets, including about 780 million USDC | Etherscan, via FinanceFeeds |
| 21:01 | Tether blacklists the receiving address | Unchained |
| 21:04 | Circle freezes 823 million USDC; the main wave of Ethereum outflows ends | Decrypt, Unchained |
| about 21:15 | CZ posts on X: “It does look like a hack on Binance” | CZ on X |
| 21:16 | Binance posts that it is “actively investigating” and has “not confirmed any impact to user funds” | Binance on X, via Unchained |
| 21:25 | Tether CEO Paolo Ardoino says Tether froze “more than 1.567B USDT” | Ardoino on X, via Unchained |
| 21:29 | Binance updates its post to say “user funds are completely safe” | Binance on X, via Unchained |
Etherscan labeled the receiving address “Binance Hot Wallet Exploiter.” Within about 15 minutes, roughly 195,460 ETH (about $450 million) was moved on to another new address, on-chain researcher Spreek found. Ether can’t be frozen by an issuer, so that part is out of reach for now.
How much was taken? Why the numbers differ
| Figure | What it measures | Who reported it | Status |
|---|---|---|---|
| about $3.5 billion | Outflows from Binance hot wallets on Ethereum, 20:24–21:04 UTC | Unchained ($3.52 billion), Decrypt ($3.51 billion) | On-chain count, not confirmed by Binance |
| about $3.3 billion | Suspicious outflows across Ethereum, Arbitrum and Avalanche | Blockaid, via The Block | Under investigation |
| $5.57 billion | Ethereum plus $1.44 billion in bitcoin (18,270 BTC) and $630 million on Tron | On-chain tally cited by Decrypt | Bitcoin and Tron parts not verified |
| up to $5.8 billion | Total estimate | Conor Grogan of Coinbase, via The Block | Estimate |
| about $2.4 billion | Stablecoins frozen: 1.567 billion+ USDT and 800 million+ USDC | Tether and Circle CEOs | Stated by the issuers |
| about $1.8 billion | Stablecoins frozen in the main receiving wallet: 975 million USDT and 823 million USDC | On-chain count by Decrypt | On-chain count |
The gap comes from scope. The $3.5 billion figure covers Ethereum only. The bigger totals add other blockchains, and Binance hasn’t said which of those wallets it controls. Frozen funds are not the same as recovered funds: they are locked in place, and returning them takes legal steps.
How did the attacker get in?
It isn’t known yet. On-chain records show that a Binance hot wallet was linked to an outside smart contract a few minutes before the first transfer, using EIP-7702. That Ethereum feature lets a regular wallet run contract code, The Defiant and Cyprus Inform reported. The attacker’s address had been funded through the Tornado Cash mixer the day before, FinanceFeeds found.
Whether Binance’s own systems signed that change, or someone stole the keys, is the key open question. Not confirmed: any link to North Korea. No government or Binance statement has named a suspect. Binance said on October 27, 2026 that its security team had repelled several attacks linked to North Korea, Cyprus Inform reported.
What Binance and others have said
- Binance (X, 21:16 UTC, updated 21:29 UTC): “Our teams are aware of reports of a potential security issue and are actively investigating.” Later: “User funds are completely safe.” Binance has not called it a hack and has not given an amount.
- Yi He, Binance co-founder: “We are aware of reports of a potential security issue and we are actively investigating.” She told users not to trust unofficial links or requests for account details.
- Changpeng Zhao (CZ), founder and former CEO (on X): “User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”
- Circle CEO Jeremy Allaire: “In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident.”
- Richard Teng, Binance CEO: no public comment as of 22:30 UTC.
Not confirmed: whether Binance has paused withdrawals. No source we checked reported a pause as of 22:30 UTC.
Are Binance user funds safe?
Binance says yes. If the loss is confirmed, the likely backstop is SAFU, the emergency fund Binance created in 2018 from trading fees. Binance used it in May 2019, when hackers stole about 7,000 BTC, and covered users in full. Binance has not yet said whether SAFU will be used this time.
What this means for you:
- Don’t panic-sell on rumors. Binance hasn’t reported any user losses.
- Watch for scams. Fake “Binance support” messages and refund links usually appear within hours of a hack. Binance warned users about this.
- Check withdrawals yourself in the app before assuming they work or don’t.
- Keep long-term holdings in your own wallet if you don’t trade them. On an exchange, the company holds the keys.
How markets reacted
Bitcoin fell below $79,000, down about 2.6% in 24 hours, and BNB dropped about 7% to roughly $699, Decrypt reported. About $628 million of leveraged trades were liquidated within an hour, almost all of them bets on rising prices, according to Coinglass data cited by Cyprus Inform. If you trade with leverage, our guide to the crypto liquidation heatmap shows how these cascades build.
For where the stablecoin freezes fit in, DeFi lender Aave also froze markets so the attacker couldn’t borrow against stolen assets, The Block reported. Our DeFi explainer covers how those lending markets work.
What to watch next
- Binance’s official update: a confirmed amount, the cause and whether SAFU covers it.
- Withdrawals: whether Binance keeps them open in the next 24 hours.
- Frozen funds: whether Tether and Circle can return the $1.8 billion to $2.4 billion they locked.
- Attribution: any statement from the FBI or blockchain analytics firms such as Chainalysis.
- Spot bitcoin ETF flows: our ETF tracker updates on Friday, October 30, 2026.
FAQ
Was Binance hacked?
Not confirmed. On October 29, 2026, about $3.5 billion left Binance hot wallets on Ethereum, and Etherscan labeled the receiving address an “exploiter.” Binance said it is investigating a potential security issue. Founder CZ said it “does look like a hack.”
How much was stolen from Binance?
No official figure yet. On-chain tallies put Ethereum outflows at about $3.5 billion. Wider estimates reach $5.57 billion to $5.8 billion, but those include wallets that haven’t been verified. Between $1.8 billion and $2.4 billion in stablecoins was frozen.
Are my funds on Binance safe?
Binance says “user funds are completely safe.” It has a SAFU emergency fund, which it used to cover users after a 7,000 BTC hack in 2019. It has not said whether SAFU will be used now.
Has Binance stopped withdrawals?
No pause had been reported as of 22:30 UTC on October 29, 2026. Check the Binance app and its official X account for changes.
Is this the biggest crypto hack ever?
If confirmed at about $3.5 billion, yes. The largest exchange hack until now was Bybit’s, about $1.5 billion on February 21, 2025, which the FBI attributed to North Korea.
Sources
- The Block: Binance investigating hack as suspicious outflows reach up to $5.8 billion (October 29, 2026)
- Unchained: Binance says user funds are completely safe after $3.5 billion drains (October 29, 2026)
- Decrypt: Binance drained of $5.5 billion in suspected hack (October 29, 2026)
- FinanceFeeds: suspected Binance hack drains $3.3B from hot wallets (October 29, 2026)
- The Defiant: Binance-labeled wallet swept minutes after EIP-7702 delegation (October 29, 2026)
- BNO News: Binance investigates possible hack (October 29, 2026)
- Changpeng Zhao on X: “It does look like a hack on Binance” (October 29, 2026)
- Crypto News Flash: CZ says Binance outflows look like a hack (October 29, 2026)
- Cyprus Inform: suspected Binance hack, timeline (October 29, 2026)
- The Block: Binance loses 7,000 BTC in 2019 security breach (May 2019)
This article is for informational purposes only and is not investment advice.
