Binance Hack: $3.3B Left Hot Wallets, $1.79B Frozen

Status (updated 30 October 2026, 03:15 IST / 21:45 UTC): Binance says it is investigating a potential security issue and that user funds are completely safe. It has not confirmed a hack, identified a cause, or announced a withdrawal suspension. Tether and Circle have frozen about $1.79 billion in stablecoins linked to the incident.

More than $3 billion in crypto was moved out of Binance hot wallets late on 29 October 2026, according to Etherscan data. The transfers were triggered by a wallet funded through the Tornado Cash mixer. Binance founder Changpeng Zhao said the incident “does look like a hack on Binance,” and Tether and Circle froze roughly $1.79 billion in USDT and USDC. Binance itself said it is investigating and that customer funds are safe.

If Binance confirms a theft of that size, it would be the largest crypto exchange hack on record, ahead of the roughly $1.5 billion stolen from Bybit in February 2025. Only about half of the reported outflow has been frozen. Around 195,460 ETH, worth roughly $450 million, was forwarded to a second newly created address within minutes and cannot be frozen by any issuer.

Latest Updates

• 30 Oct, 03:00 IST (21:30 UTC): Binance said on X that its teams are actively investigating reports of a potential security issue, that user funds are completely safe, and that updates will come only through official Binance channels.
• 30 Oct, about 02:50 IST: Founder Changpeng Zhao said it looks like a hack on Binance. He credited Tether with freezing about $971 million and Circle with about $823 million, and said that as a shareholder, he expects all user funds to be fully covered.
• 30 Oct, 02:40 IST (21:10 UTC): Whale Alert reported freezes of one Ethereum address holding 971.1 million USDT and another holding 823 million USDC, and linked both to the Binance incident.
• 30 Oct, 02:11 IST (20:41 UTC): 780 million USDC moved from the wallet labelled Binance: Hot Wallet 34 to the same receiving address.
• 30 Oct, 01:54 IST (20:24 UTC): Binance 14 sent about 167,464 ETH and 63 other tokens, including about 1.6 billion USDT, to a newly created address. Binance 16 sent another 28,005 ETH to it 24 seconds later.

What Happened To Binance’s Hot Wallets

At 20:24 UTC on 29 October, a single Ethereum transaction moved about 167,464 ETH, worth roughly $388 million at the time, out of the wallet Etherscan labels Binance 14. The same transaction carried 63 other tokens, including about 1.6 billion USDT and smaller amounts of RLUSD, wBETH, XAUt, UNI, and USD1, to the address 0x5227f603…CB2f8c. That address had no history before Thursday. A second exchange wallet, Binance 16, sent another 28,005 ETH to it 24 seconds later, Cyber Kendra observed.

Seventeen minutes later, a further 780 million USDC left a wallet labelled Binance: Hot Wallet 34 for the same recipient. According to the transaction seen by Cyber Kendra, the two transfers were roughly $3.3 billion combined. Wider tallies vary: the Walter Bloomberg account counted $2.77 billion leaving Binance across five blockchains, and market feed Tree News put the Ethereum outflow at about $2.53 billion. None of these figures has been reconciled with the others, and adding them together would double-count the same assets.

A hot wallet is an internet-connected wallet that an exchange uses to pay out customer withdrawals, while most reserves sit in offline cold storage. The receiving address did not hold the funds for long. Within 15 minutes, it forwarded about 195,460 ETH to another fresh address, 0x8532…43D4, while still holding roughly $1.5 billion in tokens.

Why Researchers Suspected A Hack

Exchanges normally pay network fees for internal transfers from their own labelled wallets. These transfers were instead set off by a separate address, 0x7C86…5CA0, whose only funding came from Tornado Cash in three deposits of roughly 0.1 ETH on 28 and 29 October. Tornado Cash lets users deposit crypto and withdraw it to an unrelated address, so the source of those fees cannot be traced. That is the main reason attackers use it to fund a fresh wallet.

Spreek, the pseudonymous on-chain researcher who first flagged the transfers on X, initially hedged: “It COULD be routine wallet maintenance, but it looks extremely sus.” Tree News labelled the activity a suspected key compromise, meaning someone other than Binance may have gained the ability to authorise transfers from the wallet. Binance has not explained how a third-party address was able to trigger movements out of its hot wallets. That is the central technical question in the incident.

What Binance And CZ Have Said

Binance’s official statement on X described the incident as reports of a potential security issue and said, “User funds are completely safe.” The exchange said its security teams are reviewing all relevant information urgently and will publish updates only through official Binance channels once the information is verified. It also warned users not to trust unofficial links, messages, or requests for account information.

Zhao went further in his own post, saying the activity looks like a hack and crediting Tether and Circle for quick freezes. Zhao no longer manages the exchange, which is run by co-CEOs Richard Teng and Yi He. He said that as a shareholder, he expects all user funds to be fully covered. As of publication, the founder had called it a hack while the company had not.

How Much Has Been Frozen

Whale Alert reported at about 21:10 UTC that one Ethereum address holding 971.1 million USDT and another holding 823 million USDC had been frozen, and linked both to the Binance incident. Together, the freezes lock about $1.79 billion. Stablecoin issuers can blacklist an address at the token-contract level, which stops frozen tokens from moving. Crypto Briefing also reported the Tether freeze.

Neither issuer has said exactly which addresses it froze. The frozen USDT is about 640 million lower than the USDT in the first transfer. The frozen USDC is larger than the 780 million USDC transfer traced so far, and Binance has not accounted for either gap. Circle’s action also stands out because the company said in April that it freezes funds only when legally compelled through a lawful process. Native ETH cannot be frozen this way, so the ether already sent onward remains outside any issuer’s reach.

Are Binance User Funds Safe?

Binance says they are, and as of publication, it has not announced any suspension of deposits or withdrawals. Hot wallets do hold customer money, but they normally carry only a fraction of an exchange’s total reserves. If Binance does take a loss, it has an emergency reserve called the Secure Asset Fund for Users (SAFU), worth about $1 billion and held in Bitcoin since early 2026. SAFU was used to cover the 7,000 BTC stolen in Binance’s 2019 breach. Binance has not said whether it would draw on SAFU or its own balance sheet this time.

What Binance Users Should Do Now

Binance has not asked users to move funds or change settings. Its only instruction so far is to stay alert for scams. Large incidents reliably bring fake refund offers, phishing pages, and support impersonators. Users should open Binance only through the official app or a typed URL, ignore direct messages promising compensation or asking them to verify an account, and keep two-factor authentication and Binance’s anti-phishing code switched on. Whether to move funds off the exchange is a personal decision, and the facts that would inform it are still emerging.

Market Reaction

Markets reacted before Binance did. CoinGlass data showed $629 million in futures liquidations within an hour, $607 million of it in long positions. BNB, the token most closely tied to the exchange, fell as much as 9%. Bitcoin slipped below $78,500 and Ether below $2,250, according to Coindoo.

How It Compares With Past Exchange Hacks

The largest exchange theft on record is the roughly $1.5 billion Bybit hack in February 2025, which the FBI attributed to North Korean hackers. Bitget lost up to $387.5 million from its hot and warm wallets in September 2026, then paused withdrawals and pledged to cover users from its protection fund. Binance’s own confirmed exchange breach in May 2019 cost about 7,000 BTC, then worth around $40 million. The October 2022 exploit of the BNB Chain bridge, which drained about $570 million, hit cross-chain infrastructure rather than Binance’s exchange wallets.

The Binance transfers came hours after Polymarket froze trading over a third-party breach that drained about $2.65 million from its users. Nothing has linked the two incidents.

What Happens Next

Binance has not yet disclosed the root cause, the final loss after the freezes, whether any withdrawals will be paused, or how affected balances would be covered. No security firm or government agency has attributed the activity to any group. This article will be updated as Binance and investigators publish verified information.

Frequently Asked Questions

Was Binance hacked?

Binance has not confirmed a hack. It says it is investigating a potential security issue and that user funds are completely safe. Founder Changpeng Zhao said the activity does look like a hack, and on-chain data shows more than $3 billion moving from Binance hot wallets in transfers triggered by a Tornado Cash-funded address.

How much money left Binance?

Two Ethereum transfers on 29 October 2026 moved about $3.3 billion, including about 167,464 ETH, 1.6 billion USDT and 780 million USDC, according to PANews and Etherscan data. Other estimates range from $2.53 billion to about $3 billion and have not been reconciled.

How much of the money has been frozen?

Tether froze about 971.1 million USDT and Circle froze about 823 million USDC, roughly $1.79 billion in total. Ether cannot be frozen by an issuer, and about 195,460 ETH had already been moved to another new address.

Are my funds on Binance safe?

Binance says user funds are completely safe and has not announced a withdrawal suspension. Zhao said he expects all user funds to be fully covered. Binance also holds an emergency reserve called SAFU, worth about $1 billion in Bitcoin.

Can I still withdraw from Binance?

As of 30 October 2026, 03:15 IST, Binance had not announced any suspension of withdrawals. Users should check the official Binance app or announcements page for changes rather than relying on social media posts.

What is Binance 14?

Binance 14 is the label block explorers such as Etherscan give to one of Binance’s main Ethereum hot wallets, which are online wallets the exchange uses to process customer withdrawals.

Why does Tornado Cash matter in the Binance incident?

The address that triggered the transfers was funded only through Tornado Cash, a mixer that hides where funds come from. Exchanges normally pay fees from their own wallets, so a mixer-funded trigger is a common sign of an outside attacker.

Who is behind the Binance hack?

No one has been identified. Binance, security firms, and law enforcement have not attributed the activity to any person or group.

Is this the biggest crypto hack ever?

If Binance confirms a theft of the reported size, it would exceed the roughly $1.5 billion Bybit hack of February 2025, the largest exchange hack on record. The final loss will depend on how much is frozen or recovered.