The Binance hack is the biggest story in crypto right now, and the numbers are still changing by the hour. On the evening of 29 October 2026, billions of dollars started leaving wallets linked to the world’s largest crypto exchange. Binance says it is investigating a security issue and that user funds are safe. Here is everything confirmed so far, what is still just a claim, and what it means if you hold crypto or mine and get paid out to an exchange.
Developing story. Last updated 29 October 2026, late evening UTC. Some outlets stamp their reports 30 October in local time. Figures differ between sources and Binance has not published a loss number, so treat every dollar amount below as preliminary. I will keep updating this post.
The short version
- What happened: wallets labeled as Binance hot wallets were drained over roughly 40 minutes, starting around 20:24 UTC on 29 October.
- How much: estimates run from about $2.8 billion (the Ethereum side alone, per Etherscan) up to $5.8 billion (Coinbase’s Conor Grogan). The tweet going around says $5.6 billion.
- What Binance says: it is “actively investigating” a “potential security issue” and “user funds are completely safe.” It has not formally called it a hack or given a loss figure.
- What CZ says: founder Changpeng Zhao wrote “It does look like a hack on Binance.”
- Frozen: Tether and Circle froze more than $2.3 billion in stablecoins. Binance says its verified frozen total is $2.54 billion. Frozen is not the same as recovered.
- Withdrawals: Binance suspended withdrawals on multiple networks as a precaution. Some, including Bitcoin and Ether, were reported open at last check.
- Cause: not confirmed. Analysts point to an Ethereum feature called EIP-7702, and the attacker’s setup address was funded through Tornado Cash.
What Binance has actually said
Binance confirmed to TechCrunch that it is dealing with a security incident. In its statement it said it is “aware of reports of a potential security issue and actively investigating,” and “Rest assured that user funds are completely safe.” Spokesperson Ross O’Leary said Binance “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.” Co-founder Yi He repeated the message and warned users to ignore unofficial links and requests for account information.
Reporters noted that Binance edited its statement several times through the night. The early wording said it had not confirmed any impact to user funds, and later versions said funds were completely safe. Binance.US said its platform was not affected.
One thing to keep straight: CZ stepped down as CEO in 2023. He is still a major shareholder, and he said he expects all user funds to be fully covered. That is his expectation, not a binding commitment from the exchange.
Timeline (UTC, 29 October 2026)
| Time | What was reported |
|---|---|
| Oct 28 | The attacker’s setup address receives a small amount of ETH from Tornado Cash |
| 20:20 | A transaction links the main Binance Ethereum hot wallet (“Binance 14”) to a newly deployed contract through EIP-7702 |
| 20:24 | Binance 14 sends 167,464 ETH and dozens of tokens to a new address in one transaction |
| 20:26–20:41 | More Ethereum-side outflows, including 28,005 ETH from a second wallet and 780 million USDC |
| 20:32 | On-chain analyst Spreek publicly flags the transfers |
| 21:05 | First reports that Tether is freezing funds |
| 21:15–21:17 | CZ says it “does look like a hack”; Yi He says a potential issue is being investigated |
| 21:18 | Circle’s CEO says over $800 million in USDC is frozen, in coordination with law enforcement |
| 21:24 | Binance posts its first official statement |
| 21:25 | Tether’s CEO says more than 1.567 billion USDT is frozen |
| Later | Withdrawals on several networks paused; Bitcoin, Ether and some Tron USDT routes reported open |
How much was taken in the Binance hack?
There is no single number yet, and the gap between estimates is huge. Here is who is saying what:
| Source | Estimate | Notes |
|---|---|---|
| Etherscan (via Dennis Weidner’s report) | about $2.8 billion | Ethereum only |
| Blockaid | about $3.3 billion | Suspicious outflows across Ethereum, Arbitrum and Avalanche |
| Arkham, via The Block | about $3.55 billion | Incoming transfers to one unlabeled wallet |
| Tweet going around (Arkham data) | over $5.6 billion | Includes Bitcoin and Tron outflows |
| Conor Grogan (Coinbase) | up to $5.8 billion | Upper end of what has been floated |
Why the spread? The higher figures include about 16,700 to 18,300 BTC and over $600 million on Tron. Several reports say those transfers have not been clearly linked to the attacker, and some movements may overlap or be internal. One outlet also argued the on-chain evidence is thinner than the claims suggest. For scale, a DefiLlama figure puts Binance’s known wallets at about $144 billion, so $2.8 billion is just under 2% of that.
On the Ethereum side, Etherscan’s token breakdown at 21:15 UTC showed roughly $1.6 billion in USDT, $780 million in USDC, $442 million in ETH, and smaller amounts of wBETH, RLUSD, XAUt, UNI, ENA, PEPE, USD1, LINK and AAVE.
How did the Binance hack happen? What we know and what is a guess
Nobody has confirmed the cause. What is documented on-chain: a transaction tied the Binance 14 hot wallet to an attacker-deployed contract through EIP-7702, an Ethereum feature live since the Pectra upgrade in May 2025. It lets a wallet hand control to a smart contract, but it needs a valid signature from the wallet’s private key. About three and a half minutes later, the contract emptied the wallet. The setup address was funded through Tornado Cash.
Here is the important part. How the attacker got that signature is unknown. The reported possibilities, none proven, are a stolen private key, Binance’s signing system being tricked into signing an attacker’s instruction, or someone with inside access. Binance has not commented on the signing question. Where the attacker got their gas money does not by itself show who they are, and I found no source that attributes this to any group, including North Korea’s Lazarus, which was blamed for the 2025 Bybit theft.
What was frozen, and what wasn’t
- Tether: CEO Paolo Ardoino said more than 1.567 billion USDT was frozen.
- Circle: CEO Jeremy Allaire said more than 800 million USDC was frozen.
- Ripple: Yi He said about $200 million in RLUSD was frozen, though one report said roughly 52.5 million RLUSD at the holding wallet was still unfrozen.
- Binance’s own total: Binance said earlier figures of about $1.8 billion were outdated and that the “current verified total frozen is $2.54 billion.”
The catch: native ETH and BTC can’t be frozen. Reports put about 195,460 ETH (around $444 million) in one attacker wallet and roughly 57,900 ETH more in another, combined about 253,000 ETH, or $570 million. One report says around $700 million in USDT left the receiving address before it was blacklisted, with much of it swapped to ETH. Frozen also doesn’t mean returned to Binance. That depends on law enforcement and the issuers.
The attacker trying to cash out
Decrypt reported the attacker hunting for exit ramps. Wallets received ETH from Uniswap contracts, and one wallet deposited $60 million in USDT into Aave and borrowed ETH against it. Aave froze its V3 markets on Ethereum mainnet to stop new deposits and borrowing, and Kamino on Solana paused some markets. The attacker also swapped 36 million RLUSD for ETH.
Market reaction
BNB fell more than 5.5%, and later showed closer to a 6% to 7% drop. Bitcoin dropped about 2.4% to 2.6% to just under $79,500 and below $79,000 at points. Ether fell about 3%. Monero rose roughly 6%, and a few outlets suggested a rotation into privacy coins, but that is speculation. No source says the stolen funds moved into Monero, so the “Monero to $1000” talk is just chatter for now.
Is this the biggest crypto hack ever?
If it is confirmed at anything near these figures, yes by a wide margin. Even the lowest estimate on the Ethereum side is roughly double the biggest exchange hack so far.
| Incident | Year | Amount |
|---|---|---|
| Binance (suspected) | 2026 | about $2.8 billion to $5.8 billion, unconfirmed |
| Bybit | 2025 | about $1.46 billion (FBI attributed it to North Korea) |
| Ronin Network | 2022 | $625 million |
| Poly Network | 2021 | $611 million |
| BNB Chain Bridge | 2022 | $570 million |
Will users get their money?
Binance’s line is that user funds are completely safe. It also has a Secure Asset Fund for Users (SAFU), an emergency reserve set up in 2018. Reports say it holds 15,000 BTC, about $1.18 billion, and Binance has not said whether it will use it. In May 2019, Binance covered about 7,000 BTC stolen from a hot wallet from that fund and paused withdrawals for about a week while it ran a security review. A hot wallet loss is also not the same as a loss from user balances, which is why the distinction between what left the wallets and what customers are owed matters.
What the Binance hack means for holders and miners
This section is my take, not data, and it is not financial advice.
- Don’t panic-click links. Every big incident brings a wave of fake “unlock your funds” messages on Telegram, WhatsApp and X. Only trust Binance’s official channels and never share account details or seed phrases.
- Check where your payouts go. If your miner or pool pays out to a Binance deposit address, remember that withdrawals can be paused for days. Consider sending payouts to a wallet you control and moving to an exchange only when you want to sell.
- Self-custody has a catch too. Reports note that bitcoin held in self-custody had zero exposure to this event. But self-custody means you are the security team. Keep backups offline and never type your seed phrase into a website.
- Don’t spread your funds randomly. Moving money around in a panic, especially through unknown bridges or sites, is how people get hit twice.
- Be careful with the price talk. A big hack can move the market in either direction and nobody knows which way this one goes. Plan around your own risk and not around a tweet.
What we still don’t know
- The real loss figure, and how much of the Bitcoin and Tron outflow is tied to the attacker.
- How the signature was obtained: stolen key, tricked signing system or insider.
- Who is behind it. No credible attribution has been reported.
- When all withdrawals fully resume and whether Binance uses SAFU.
- How much of the frozen money actually makes it back, and where the remaining ETH goes.
Sources
- The Block: Binance investigating hack as suspicious outflows reach up to $5.8 billion
- TechCrunch: Binance pauses withdrawals as hackers suspected of stealing billions in crypto
- CryptoTicker: Binance hack, $2.8B drained from hot wallet via EIP-7702
- TFTC: Binance suspected hack, up to $5.8B drained in 40 minutes
- Finbold: Binance confirms $2.54 billion frozen after suspected record hack
- Decrypt via Yahoo Finance: Binance hacker hunts for exit ramps as DeFi exchanges pause markets
- Tech-ish: Binance pauses withdrawals after more than USD 3 billion leaves its hot wallets
Information current as of 29 October 2026 and likely to change as the investigation continues. This is news and commentary, not investment or financial advice.