Binance has put withdrawals on hold after billions of dollars in crypto left its hot wallets in under an hour on Thursday night.[1] If confirmed, it would be the largest exchange hack on record, well ahead of the roughly $1.5 billion taken from Bybit in February 2025. The outflows began at approximately 20:24 UTC, according to security firm Blockaid, which said the transfers "look consistent with unauthorized movement from those wallets".[2]
Our team is conducting security checks. Withdrawals will resume as soon as the security issue is fully resolved.
User funds remain safe.
We’ll keep you updated. Thank you for your patience.
The update does not say when withdrawals were paused, whether deposits and trading are affected, or how long the checks will take. Binance itself has not used the word "hack". Its founder has.
User funds are safe!
It does look like a hack on Binance. Appreciate the quick freeze from Tether (
$971m) and Circle ($823m).I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.
Zhao stepped down as Binance's chief executive in 2023 and no longer runs the exchange, as his post notes.[3] His post is not an official Binance statement.
What Binance has said
Binance posted a statement on X at 21:15 UTC and edited it three times over the next 14 minutes. The current version reads:[4]
Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe.
Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.
· Edited version; excerptView on X ↗
The edit history on X shows how the wording moved. The first version, at 21:15, did not mention user funds. A version posted at 21:16 added: "At this stage, we have not confirmed any impact to user funds."[5] That sentence was gone by 21:24, and at 21:29 the post was changed to say "User funds are completely safe."[4]
The statement does not say what happened, how much left the wallets or whether deposits and withdrawals are affected. Binance co-founder Yi He posted near-identical wording at 21:17 UTC.[6]
Timeline of the night
All times are UTC on 29 October 2026.
| Time | Event |
|---|---|
| 20:20 | A delegation under Ethereum's EIP-7702 standard is set on the hot wallet Etherscan labels "Binance 14", pointing it at a newly deployed contract[7] |
| 20:24 | A single transaction moves about 167,464 ETH, roughly 1.6 billion USDT and dozens of other tokens from Binance 14 to a new address[8][9] |
| 20:32 | Analyst Spreek flags a "possibly massive binance hack"[10] |
| 20:41 | About 780 million USDC moves to the same address[9] |
| 20:55 | PeckShield reports "unexpected large outflows" from Binance hot wallets[11] |
| 21:01–21:04 | Tether blacklists the receiving address; Circle freezes the USDC held there[7] |
| 21:11 | Blockaid says the transfers look like unauthorized movement[2] |
| 21:15 | Zhao posts that "it does look like a hack"[3] |
| 21:15–21:29 | Binance posts its statement and edits it three times[4] |
| 21:18 | Circle CEO Jeremy Allaire confirms the USDC freeze[12] |
| 21:25 | Tether CEO Paolo Ardoino says Tether froze more than 1.567 billion USDT[13] |
| 22:33 | Binance says withdrawals "will resume as soon as the security issue is fully resolved"[1] |
Etherscan now labels the receiving address "Binance Hot Wallet Exploiter 2".[14]
Tether and Circle freeze more than $2.3 billion
Because USDT and USDC are issued by companies that can blacklist addresses, a large part of the stablecoins taken could be frozen within about 40 minutes of the first transfer. The ETH and other tokens cannot be frozen in the same way.
Tether froze more than 1.567B USDT related to a potential Binance exchange hack.
Protecting the industry and our partners is our main priority.
Stay safe everyone.
Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.
Together, the two figures exceed $2.3 billion.[13][12] Zhao's earlier post gave smaller numbers, about $971 million from Tether and $823 million from Circle; Tether's figure rose as more transfers were traced.
How much was taken
Nobody has published a reconciled total, and Binance has given no figure. Estimates differ mainly because analysts count different chains, wallets and time windows.
| Estimate | Scope | Source |
|---|---|---|
| About $3.3 billion | Ethereum, Arbitrum and Avalanche | Blockaid, as reported by The Block[15] |
| About $3.5 billion | Ethereum only, 20:24 to 21:04 UTC | Unchained's own count[7] |
| At least $5.57 billion | Ethereum, Bitcoin and Tron | Decrypt, as reported by FinanceFeeds[16] |
| "Potentially up to $5.8B" | Not stated | Conor Grogan[17] |
Frozen stablecoins are counted in these totals, so the amount actually out of reach is lower. Cyber Kendra estimates that about 195,460 ETH, around $450 million, had been moved on to a second address beyond the issuers' reach.[9]
How the attack appears to have worked
Binance has not explained the cause. What follows comes from the on-chain record and analysts' readings of it, and is not confirmed.
Four minutes before the first large transfer, the Binance 14 wallet was given an EIP-7702 delegation.[18] EIP-7702, introduced with Ethereum's Pectra upgrade, lets an ordinary address run a smart contract's code. Here, that contract then moved the wallet's balances out.[7] Setting a delegation normally requires a signature authorized by the wallet's own key, which makes how that signature was obtained the central open question.
Spreek reported that the contract call "was funded by Tornado Cash", the Ethereum mixing service.[10] Cyber Kendra reports that the funding address received three deposits of about 0.1 ETH from Tornado Cash on 28 and 29 October.[9] No individual or group has been named.
Market reaction
The selling hit Binance's own token hardest. BNB traded at $703.10 at 22:07 UTC, down 6.9% over 24 hours, according to CoinGecko data cited by FinanceFeeds.[16] Cyber Kendra, citing CoinGlass data reported by PANews, says about $629 million of futures positions were liquidated within an hour, $607 million of them long positions.[9]
These are early figures from fast-moving markets. Volatility around exchange incidents tends to be high in both directions, and liquidity can thin out quickly.
What to do if you have funds on Binance
- Use official channels only. Open the Binance app or type binance.com yourself. Do not follow links in direct messages, emails, Telegram groups or replies on X.
- Check what Binance has actually said. Binance has said user funds are safe, but it has not explained the incident or said how any losses will be covered. Zhao's expectation that funds will be "fully covered" is his view as a shareholder, not a commitment from the company.[3]
- Withdrawals are paused. Binance says they will resume once the security issue is resolved, and has given no timescale.[1] When they reopen, expect queues and delays. Send a small test amount first and double-check the address.
- Ignore anyone offering to "unlock" or "fast-track" a withdrawal. That is a common scam during exchange freezes.
- Think before trading the news. Positions opened in the first hours after a major incident face sharp swings, wide spreads and liquidation risk. Leverage multiplies that risk.
Binance maintains an emergency insurance fund, SAFU (Secure Asset Fund for Users), which it used to cover the 7,000 BTC stolen in its 2019 hack. Binance has not said whether it will draw on SAFU or its own balance sheet this time.[9]
What we don't know yet
- When withdrawals will resume, and whether deposits or trading are affected.
- Whether Binance confirms a hack, and how the attacker obtained the ability to delegate a Binance hot wallet.
- The verified total taken, across all chains.
- Whether any customer balances were affected, and how Binance will cover the loss.
- Whether the remaining ETH and other tokens can be traced, frozen or recovered.
We will update this report as Binance and investigators publish verified information.
.jpg){kind=link}