Binance Suspected Hack: Up to $5.8B Drained in 40 Minutes

Wallets labeled as Binance hot wallets lost billions in under an hour. The stablecoin freezes look like a win. They're not the whole story.

Key takeaways

• Wallets labeled as Binance hot wallets shed up to $5.8 billion across Ethereum, Bitcoin, and Tron in approximately 40 minutes on October 29, 2026, per on-chain tallies from named analysts, what would be, if confirmed, the largest exchange hack on record.
• Tether CEO Paolo Ardoino and Circle CEO Jeremy Allaire confirmed freezing more than $1.567B in USDT and more than $800M in USDC respectively in receiving wallets, but ETH and BTC sent to attacker addresses cannot be recalled and are already moving.
• Binance has not confirmed a breach or disclosed a loss figure; co-founder CZ acknowledged on X that it "does look like a hack" and pledged full coverage of user losses, but no audited reserve or SAFU balance has been published.

Wallets identified on-chain as Binance hot wallets drained up to $5.8 billion in approximately 40 minutes, from roughly 20:24 to 21:04 UTC on October 29, 2026, first reported by The Block. Conor Grogan, a senior director at Coinbase, tallied the ceiling at $5.8 billion; on-chain analyst Spreek flagged approximately $3.55 billion flowing into a single unlabeled receiving wallet. A separate breakdown tracked at least $5.57 billion across Ethereum ($3.51B), Bitcoin (18,270 BTC, approximately $1.44B), and Tron ($630M), with smaller amounts across Arbitrum, Optimism, and Base.

Receiving addresses were brand new. The contract call funding the operation was routed through Tornado Cash, per Spreek's own on-chain analysis.

What the On-Chain Data Shows

Binance co-founder and former CEO Changpeng Zhao posted on X at approximately 21:16 UTC:

"It does look like a hack on Binance. Appreciate the quick freeze from Tether ($971m) and Circle ($823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered."

Binance co-founder Yi He posted separately that the company is "actively investigating" a "potential security issue" and that "user funds are completely safe." Binance has not formally confirmed a breach or disclosed how much, if anything, was stolen. BNB dropped more than 5.5% on the news; Bitcoin slid approximately 2.6% to below $79,000.

Tether CEO Paolo Ardoino confirmed on X that Tether froze more than 1.567 billion USDT linked to the incident. Circle CEO Jeremy Allaire confirmed on X that Circle froze more than $800 million in USDC "in coordination with law enforcement." CZ's own post credited Tether with approximately $971 million and Circle with approximately $823 million in freezes, totaling roughly $1.79 billion in confirmed stablecoin freezes at the time of his post.

The Freeze Is the Tell

The speed of the stablecoin freezes is being framed broadly as the system working. It is also a clean demonstration of what custodial stablecoins actually are: permissioned IOUs with a kill switch held by a third party.

Tether and Circle can freeze balances because they control the underlying smart contracts and can blacklist specific addresses. That power is not selective to hacks. It can be invoked by governments, sanctions lists, or a phone call. Every USDT and USDC holder on every exchange watched their asset class get frozen on someone else's timeline, without their consent.

Prior TFTC coverage documented exactly this dynamic when Tether froze a payments firm's operating capital for a year.

The ETH and BTC in the attacker's wallets are a different story. Those cannot be frozen. They are already moving. The recoverable fraction was the permissioned fraction.

The math there is the number that matters, and no outlet has published it cleanly: the stablecoin freezes captured a confirmed floor of roughly $1.79 billion of a potential $5.57 to $5.8 billion outflow, leaving a substantial native-asset portion already moving beyond reach.

Assets held on an exchange are held on a perimeter the user cannot inspect, which is the custodial risk this hot wallet breach exposes. Bitcoin in self-custody had zero exposure to this event.

The SAFU Question Nobody Has Answered

CZ's pledge that "all user funds will be fully covered" is a promise from a shareholder who no longer runs the company. Binance set up its SAFU emergency reserve in 2018, funded by a percentage of trading fees. The current SAFU balance versus a potential $5 billion-plus loss is an open question.

No audited figure has been published. If SAFU was sized for a sub-billion-dollar event, the solvency conversation is coming whether Binance wants it or not.

The falsifiable version of what happens next: if SAFU fully covers every dollar of user losses, with no haircuts, no KYC gates on withdrawals, and all affected users made whole quickly, and if Tether and Circle can show the frozen stablecoins were returned to their rightful owners rather than simply immobilized, then the custodial model performed as advertised. That outcome would be the first of its kind in crypto exchange hack history. Watch for it.

What to Watch

Binance has committed to updates through official channels. The numbers to track: the SAFU balance disclosure, the confirmed total stolen versus the stablecoin freeze recovery rate, and whether withdrawal restrictions emerge. If outflows are confirmed at the high end of the range, this surpasses the February 2025 Bybit theft of approximately $1.5 billion, confirmed by the FBI (https://www.ic3.gov/psa/2025/psa250226) as occurring on or about February 21, 2025, as the largest exchange hack on record. The gap between "user funds are safe" and an audited balance sheet is where this story lives until Binance publishes one.

Update, October 29, 2026

The ETH shortfall is worse than a simple theft figure suggests. A CoinDesk review of Binance's own proof-of-reserves data found that the wallets emptied in the attack are the same wallets Binance uses every month to demonstrate 1:1 full backing of customer assets, and that its most recent reserve report, dated October 1, specifically includes "Binance 14" -- the wallet at the center of the attack.

Binance held exactly enough ETH to cover customer balances at a 100% reserve ratio as of that October 1 snapshot. The roughly 204,500 ETH taken in the attack represents approximately 5.6% of Binance's ETH reserves, leaving its ETH backing near 94%.

The attacker's smaller positions, including ENA, UNI, PEPE, and AAVE, represent anywhere from 7% to 15% of Binance's reported holdings of each.

That means Binance's 1:1 backing of some assets, ETH in particular, has likely fallen below 100% until the exchange replaces what was taken.

Binance's next reserve snapshot is scheduled for November 1, at which point it will be possible to see whether the stolen assets have been replenished. Binance's monthly proof-of-reserves report was the document that made this shortfall visible at all -- the same transparency mechanism that exchanges publish to reassure customers that their funds are fully backed has now confirmed those backing wallets were the ones hit.

Update, October 30, 2026

TRM Labs published its formal attribution overnight, pinning the attack on TraderTraitor, North Korea's elite state hacking unit, with high confidence based on on-chain and off-chain intelligence. TRM traced approximately $6.36 billion in transfers from Binance-attributed wallets across ten blockchain networks, calculated most of it moving in about 20 minutes, and identified preparation activity beginning at least 36 hours before funds moved. The signature matches prior North Korea-linked heists, including Bybit and the KelpDAO hack from April 2026: small Tornado Cash withdrawals funding an operator wallet, staging well before the theft, and signatures obtained in advance then executed in one burst. Chainalysis CEO Jonathan Levin separately stated high confidence that TraderTraitor was the likely perpetrator, citing Binance funds commingling with proceeds from the $388 million Bitget exploit from late September -- the same conclusion ZachXBT reached independently at 04:51 UTC, tracing commingled funds through THORChain to a shared consolidation address. The FBI attributed the Bybit theft to TraderTraitor. No government agency has yet made a formal attribution on Binance.

Binance's own account of the breach has materially changed since the initial disclosure. The firm initially pointed to a compromised DevOps engineer's laptop, but CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action," describing "a more complex attack process" with "additional points of breach." Binance separately stated it found "no evidence of any wallet private key leak," a detail that aligns with Blockaid's earlier analysis: the attacker exploited EIP-7702 to push 50 separate wallet authorizations in a single transaction batch, gaining control of Binance's hot wallet signing infrastructure without needing the keys themselves. A root-cause report is forthcoming. Teng added that the investigation has not attributed responsibility to any individual.

On the recovery side, Binance revised its total impact figure to $6.3 billion and confirmed approximately $3 billion frozen across stablecoin issuers and chain-level interventions. Tether, Circle, Ripple, and World Liberty Financial froze roughly $2.67 billion in stablecoins; Arbitrum's Security Council froze approximately $30 million in ETH and ARB. Teng said the exchange would cover all remaining losses using its SAFU fund and company funds, and separately disclosed it has reserved more than $6.34 billion of company funds for that purpose. The math is unchanged: even at the $3 billion frozen ceiling, more than $3 billion in native assets -- ETH and BTC that no issuer can touch -- remains unrecovered and moving through permissionless cross-chain infrastructure.

The picture that emerges is a state actor that has now pulled off the two largest exchange thefts in history within eight months using the same toolkit each time, and an exchange whose internal security architecture was not compromised through a single door but through multiple ones simultaneously. Every bitcoin held on an exchange is a bitcoin that a nation-state can spend 36 hours quietly authorizing away. Every bitcoin held in self-custody, with keys the owner controls, was unaffected. That is the point. That has always been the point.

Sources

• CZ (@cz_binance) on X
• Paolo Ardoino (@paoloardoino) on X, confirmed more than 1.567B USDT frozen (exact post URL unconfirmed; cited as plain-text attribution)
• Jeremy Allaire (@jerallaire) on X, confirmed more than 800M USDC frozen (exact post URL unconfirmed; cited as plain-text attribution)
• Spreek (@spreekaway) on X, on-chain analysis flagging $3.55B inflow to unlabeled wallet and Tornado Cash routing (exact post URL unconfirmed; cited as plain-text attribution)
• Conor Grogan (Coinbase, senior director), $5.8B ceiling tally (exact post URL unconfirmed; cited as plain-text attribution)
• Yi He (@heyibinance) on X, Binance investigating "potential security issue" (exact post URL unconfirmed; cited as plain-text attribution)
• First reported by The Block
• FBI / IC3 PSA on Bybit theft, February 2025: https://www.ic3.gov/psa/2025/psa250226