On the evening of October 29, 2026, billions of dollars in cryptocurrency began flowing out of wallets linked to Binance — the world's largest crypto exchange — into newly created addresses. On-chain trackers watched it happen in real time. By the next morning, estimates put the outflow at up to $5.8 billion. If confirmed stolen, that would make this the largest cryptocurrency heist in history, by a wide margin.
Binance says it is investigating a potential security issue and insists user funds are safe. Its founder, Changpeng Zhao, said on X that the incident "does look like a hack on Binance". The attack vector is unknown, the final total is unconfirmed, and the story is still developing. Here is what the on-chain evidence shows so far — and what is still rumor.
The short version
Up to ~$5.6–5.8 billion in crypto moved from Binance-linked hot wallets on October 29, per on-chain tracker estimates — not a confirmed stolen total
Tracker-estimated breakdown: ~$1.57B USDT, ~$1.45B BTC (18,270 BTC), ~$875M ETH, ~$823M USDC, ~$234M TRX, plus hundreds of millions in other tokens
$2.54 billion frozen so far: Tether froze $1.567B in USDT, Circle froze $800M+ in USDC (Binance-verified total)
Binance: investigating, user funds "completely safe", deposits and withdrawals suspended, full post-mortem promised
Would dwarf the previous record: the $1.5B Bybit hack of February 2025
How the money moved
The first alarm came from blockchain watchers tracking a Binance hot wallet labeled "Binance 14". According to transaction analysis shared by crypto journalist StarPlatinum, that wallet sent roughly $2.53 billion across 64 different tokens to a single new Ethereum address in one transaction — and 24 seconds later, a second Binance wallet sent another $174.4 million to the same address. A later update traced a third transfer of 780 million USDC, bringing the reported running total to about $3.48 billion from those wallets alone.
Blockchain intelligence platform Arkham Intelligence is tracking 55 addresses under the label "binance-hacker-1029", with combined holdings of roughly $5.78 billion. Etherscan has labeled the initial receiving address "Binance Hot Wallet Exploiter", tagging it as both an exploit and a heist address. Treat the distinction carefully: Arkham's figure is the value sitting in tracked wallets, not a confirmed amount stolen from Binance.
The freeze that slowed it down
What happened next is the part the industry got right. Tether CEO Paolo Ardoino said the company froze more than $1.567 billion in USDT connected to the incident. Circle CEO Jeremy Allaire confirmed more than $800 million in USDC frozen, adding that Circle is coordinating with law enforcement. Binance later clarified that the verified total frozen stands at $2.54 billion — and said the figure may keep rising.
Freezes only work on assets still sitting in freezable stablecoins. On-chain posts report that before the freezes took effect, the exploiter used about $60 million in stolen USDT as collateral on Aave V3 to borrow roughly 19,800 ETH — assets that move beyond any issuer's freeze button. That detail is unconfirmed, but it illustrates the race every exchange heist becomes: convert to unfreezable assets before the issuers react.
What Binance and CZ actually said
Binance's public line has been consistent: its teams are aware of reports of a potential security issue and are actively investigating; user funds are completely safe; updates will come through official Binance channels once information is verified. The exchange also warned customers to beware of scams and to avoid unofficial links, messages, or requests for account information — standard advice that matters enormously during a heist, when phishing spikes.
Changpeng Zhao — Binance's founder, who no longer runs the company — was blunter on X: "It does look like a hack on Binance", thanking Tether and Circle for the quick freezes. He added that user funds are safe and that as a shareholder he expects all user funds to be fully compensated. Deposits and withdrawals were suspended while security checks run, and Binance has promised a full post-mortem.
What we still don't know
The honest list is long. Nobody has confirmed how the attacker got in — the attack vector is unknown. The totals are tracker estimates; investigators are still separating unauthorized transfers from internal movements and overlapping transactions. Early on-chain reports describe the triggering address being funded through the Tornado Cash mixer and linked to the Binance 14 wallet via EIP-7702 shortly before the drain — interesting leads, not conclusions.
There is also a confusing detail worth knowing: Binance had announced scheduled maintenance of its Ethereum wallets for October 28, the day before the drain. That is why the first giant transfers were not immediately treated as a heist — an internal reserve reshuffle was plausible until the pattern kept going. Confusion like that is exactly what buys an attacker time.
The market felt it instantly
Crypto markets do not wait for post-mortems. Bitcoin dropped about $2,000, falling below $79,000. Roughly $600 million in leveraged long positions were liquidated. About $80 billion vanished from the total crypto market capitalization in 15 minutes. BNB, Binance's own token, fell around 4.4% to roughly $712. Some of that has already bounced — but volatility will likely persist until withdrawals reopen and the post-mortem lands.
What to do right now
Don't move funds on rumors. Panic withdrawals during an incident are how people fall for fake "migration" and "verification" scams.
Use only official Binance channels. The exchange explicitly warned about unofficial links and messages asking for account information.
Expect phishing to spike. Every major exchange incident triggers waves of fake support emails, SMS messages and lookalike sites. Verify senders independently.
Check your own account security. Withdrawal allowlists, authenticator-based 2FA, and unique passwords are the basics that matter most this week.
Treat every figure as provisional. Tracker estimates, frozen totals and "largest ever" claims will all move as investigators finish tracing funds across chains.
Where things stand
If the highest estimates are confirmed as stolen, this becomes the largest cryptocurrency hack on record — nearly four times the $1.5 billion Bybit theft attributed to North Korean hackers in February 2025. The Wall Street Journal notes Binance maintains its SAFU emergency insurance fund, reported at roughly $1.2 billion, and CZ has said he expects users to be made whole.
For now, the verified facts are: billions moved, $2.54 billion frozen, an investigation open, and an attack vector nobody has named. Everything else — the final total, the method, the attribution — is still being traced on-chain. This is a developing story; check Binance's official announcement page and verified security outlets before treating any new figure as fact.
Key takeaways
On-chain trackers estimate up to $5.8B moved from Binance-linked hot wallets on October 29, 2026 — estimates, not a confirmed stolen total.
$2.54B frozen so far (Tether $1.567B USDT, Circle $800M+ USDC) — the fastest coordinated freeze response in crypto history.
Binance is investigating; CZ says it looks like a hack and expects users fully compensated; deposits and withdrawals suspended pending security checks.
Attack vector unknown; early on-chain leads (mixer funding, EIP-7702) are unconfirmed; scheduled October 28 wallet maintenance initially masked the drain.
Markets reacted instantly: BTC below $79K, ~$600M liquidations, ~$80B in market cap erased in 15 minutes, BNB down ~4.4%.
If confirmed, this is the largest crypto heist ever — nearly four times the $1.5B Bybit record from February 2025.
Sources and scope
Figures in this article follow on-chain tracker estimates reported by BleepingComputer, Arkham Intelligence, The Wall Street Journal, Reuters and Finbold on October 29–30, 2026. All totals are tracker estimates: Arkham's ~$5.78B is the value held across labeled wallets, not a confirmed stolen amount, and Binance has not confirmed the total or the attack vector. Freeze figures ($2.54B total, $1.567B USDT by Tether, $800M+ USDC by Circle) are as stated by the companies and Binance. CZ's statements are from his public X posts of October 29, 2026. This is a developing story and figures may be revised.
Binance Hack 2026: Up to $5.8B Drained From Hot Wallets — Largest Crypto Heist in History — Hack The Planet
Binance is investigating a suspected breach after on-chain trackers linked up to $5.8B in crypto moving from its hot wallets on Oct 29, 2026. Tether and Circle froze $2.54B. What is confirmed, what is still rumor, and what to do now.
hackthepalnte.co.uk
Top comments (0)