Short answer, as of 21:45 UTC on October 29, 2026: it looks like a hack, but Binance has not confirmed one. Starting at 20:24 UTC, billions of dollars in ETH, stablecoins and more than 60 other tokens were swept out of Binance hot wallets in minutes, to a new address set up by an attacker funded through the mixer Tornado Cash. Tether and Circle froze about $2.4 billion of the stolen stablecoins within the hour. Binance says it is investigating and has "not confirmed any impact to user funds"; its founder Changpeng Zhao (CZ) says it "does look like a hack" and that "user funds are safe."
If it is confirmed, it would be the largest crypto theft on record, well above the roughly $1.5 billion taken from Bybit in February 2025. Here is what is known, what is still rumor, and what to do if you have money on Binance.
Who this is for: people with crypto on Binance or any centralized exchange who want the facts in one place. What it does not cover: price predictions, legal claims, or advice on any specific coin. Numbers below are reports from the first hours of a developing story; each one says where it comes from. Nothing here is financial advice.
TimelineWhat happened, minute by minute
All times are UTC on Thursday, October 29, 2026 (early Friday morning in Asia). They come from on-chain records as reported by Decrypt, PANews and Cryptotimes; exact seconds differ between trackers.
About 20:21 — the setup
An address funded through Tornado Cash submits an EIP-7702 delegation for the Binance hot wallet labeled "Binance 14" (0x28C6…1d60). EIP-7702 lets an ordinary wallet temporarily run smart-contract code; Phylax Systems' Odysseas Lamtzidi told Decrypt the delegation let the wallet move funds without another signature.
20:24 — the sweep
A single transaction sends about 167,464 ETH, 1.615 billion USDT and 63 other token transfers (including RLUSD, wBETH, XAUt, UNI and USD1) to a brand-new address, 0x5227…CB2f8c. PANews valued it at about $2.5 billion.
20:24–20:45 — the second wallet
Trackers report a second Binance hot wallet on Ethereum emptied within about 20 minutes, which is where the $2.4–3.5 billion estimates for Ethereum alone come from.
By 21:04 — the freezes
Circle freezes 823 million USDC in the receiving wallet at 21:04 (Decrypt). Tether freezes 975 million USDT there, and its CEO later puts the total at more than 1.567 billion USDT.
About 21:20 — CZ speaks
Changpeng Zhao, who founded Binance but no longer runs it, writes that it "does look like a hack on Binance" and that "user funds are safe." BNB falls as much as 7–9%; Bitcoin slips below $79,000.
Within the hour — Binance responds
Binance says it is aware of reports of a possible security issue, is actively investigating, and has "not confirmed any impact to user funds." It warns users about scams.
Confirmed vs. notWhat we actually know
The single most important thing to understand right now is the gap between what the blockchain shows and what Binance has said. The blockchain shows money leaving wallets that analytics firms label as Binance's. Only Binance can say whose money it was, whether its systems were breached, and how it will cover the loss.
~$2.5B left the "Binance 14" hot wallet at 20:24 UTC
- Status
- Confirmed on-chain
- Based on
- One Ethereum transaction, visible on Etherscan
The receiving side was funded via Tornado Cash
- Status
- Confirmed on-chain
- Based on
- Funding trail of the initiating address
~$2.4B of USDT and USDC is frozen
- Status
- Confirmed by issuers
- Based on
- Tether's CEO (1.567B USDT) and Circle's CEO (800M+ USDC)
It was a hack
- Status
- Likely, not confirmed
- Based on
- CZ's post; Binance itself only says it is investigating
User balances are safe
- Status
- Asserted, not verified
- Based on
- CZ's statement; Binance has "not confirmed any impact"
$5.6B ("up to $6B") was stolen
- Status
- Not established
- Based on
- Sum of all outflows from Binance-labeled wallets on three chains
North Korea's Lazarus Group did it
- Status
- No evidence published
- Based on
- Speculation by analogy with Bybit
Withdrawals are halted
- Status
- Not announced
- Based on
- No Binance notice found; check the app
| Claim | Status | Based on |
|---|---|---|
| ~$2.5B left the "Binance 14" hot wallet at 20:24 UTC | Confirmed on-chain | One Ethereum transaction, visible on Etherscan |
| The receiving side was funded via Tornado Cash | Confirmed on-chain | Funding trail of the initiating address |
| ~$2.4B of USDT and USDC is frozen | Confirmed by issuers | Tether's CEO (1.567B USDT) and Circle's CEO (800M+ USDC) |
| It was a hack | Likely, not confirmed | CZ's post; Binance itself only says it is investigating |
| User balances are safe | Asserted, not verified | CZ's statement; Binance has "not confirmed any impact" |
| $5.6B ("up to $6B") was stolen | Not established | Sum of all outflows from Binance-labeled wallets on three chains |
| North Korea's Lazarus Group did it | No evidence published | Speculation by analogy with Bybit |
| Withdrawals are halted | Not announced | No Binance notice found; check the app |
Source: CalculatorAI · calculatorai.app · Etherscan transactions as reported by Decrypt and PANews; statements by Binance, CZ, Tether and Circle
How bigWhy the numbers keep growing
You will see headlines from $2.4 billion to "nearly $6 billion". They are not all measuring the same thing, and none of them is an official figure.
$2.38B
- What it counts
- Ethereum hot-wallet outflow only
- Reported by
- Cryptotimes
~$2.5B
- What it counts
- The single 20:24 UTC transaction to the attacker's address
- Reported by
- PANews, from Etherscan
$2.77B
- What it counts
- Outflows across five chains, community trackers
- Reported by
- FXStreet, Crypto Briefing
$3.3–3.55B
- What it counts
- Two Ethereum hot wallets; up to six chains
- Reported by
- FinanceFeeds
$5.57B
- What it counts
- All outflows from Binance-linked wallets: Ethereum $3.51B, Bitcoin $1.44B (18,270 BTC), Tron $630M
- Reported by
- Decrypt on-chain tally
$5.64B
- What it counts
- Same idea, as of 21:22 UTC, plus $38M on Arbitrum, Optimism and Base
- Reported by
- Lookonchain
| Estimate | What it counts | Reported by |
|---|---|---|
| $2.38B | Ethereum hot-wallet outflow only | Cryptotimes |
| ~$2.5B | The single 20:24 UTC transaction to the attacker's address | PANews, from Etherscan |
| $2.77B | Outflows across five chains, community trackers | FXStreet, Crypto Briefing |
| $3.3–3.55B | Two Ethereum hot wallets; up to six chains | FinanceFeeds |
| $5.57B | All outflows from Binance-linked wallets: Ethereum $3.51B, Bitcoin $1.44B (18,270 BTC), Tron $630M | Decrypt on-chain tally |
| $5.64B | Same idea, as of 21:22 UTC, plus $38M on Arbitrum, Optimism and Base | Lookonchain |
Source: CalculatorAI · calculatorai.app · Cryptotimes, PANews, FXStreet, Crypto Briefing, FinanceFeeds, Decrypt, Lookonchain — October 29, 2026
The "up to $6 billion" headlines round the last two rows. Those totals are real outflows, but an outflow is not a theft. Exchanges move billions between their own hot and cold wallets every day, and a panic is exactly when they move the most, to meet withdrawals. In 2023 Binance explained a reported $4.6 billion "outflow" as internal shuffling. As of this writing, no tracker has published a link between the Bitcoin and Tron outflows and the attacker's address. The defensible number today is the one transaction everyone can see: about $2.5 billion.
In contextThe biggest crypto thefts, compared
Even the conservative figure would make this the largest theft from a crypto company on record, about 1.7 times Bybit.
About $2.5 billion in one transaction is 1.7× Bybit and 61× Binance's own 2019 hack.
Show these figures as a table
| Value ($ millions stolen) | |
|---|---|
| Binance (suspected), Oct 2026 — ~$2.5B, unconfirmed | 2,500 |
| Bybit, Feb 2025 — ~$1.46B, attributed to North Korea by the FBI | 1,460 |
| Ronin bridge, Mar 2022 — $625M | 625 |
| Poly Network, Aug 2021 — $611M, mostly returned | 611 |
| BNB Bridge, Oct 2022 — ~$570M of BNB minted | 570 |
| Coincheck, Jan 2018 — ~$530M of NEM | 530 |
| Binance, May 2019 — 7,000 BTC, ~$40.7M | 41 |
Source: CalculatorAI · calculatorai.app · Bybit and FBI (2025); Sky Mavis (Ronin, 2022); Poly Network (2021); BNB Chain (2022); Coincheck (2018); Binance (2019); Etherscan via PANews (2026)
Binance has been here before at a much smaller scale. In May 2019 hackers took about 7,000 BTC from its hot wallet; Binance covered the loss in full from its emergency fund and paused deposits and withdrawals for about a week. In October 2022 a bug in the BNB Chain bridge let an attacker mint 2 million BNB; validators halted the chain and most of the coins never left it.
Key termsHot wallets, SAFU and freezes
A hot wallet is the part of an exchange's crypto that stays online so withdrawals can be processed in minutes. Most of an exchange's holdings sit in cold wallets, offline. A hot-wallet hack is serious but, in principle, limited to what was online.
SAFU ("Secure Asset Fund for Users") is Binance's emergency insurance pool, set up in 2018 and funded from trading fees. Binance has publicly sized it at roughly $1 billion. It paid for the 2019 hack. Binance has not said whether it will draw on it now, and a $2.5 billion loss would be larger than the fund, so any full reimbursement would also rely on the company's own balance sheet. CZ wrote that he expects users to be covered; that is his expectation, not a commitment from Binance.
A freeze is something only a stablecoin issuer can do. Tether and Circle can block their own tokens at a given address, which is why roughly 97% of the stolen USDT is now stuck. Ether, Bitcoin and most other tokens have no issuer who can freeze them, which is why hackers usually swap stablecoins away within minutes. This time they were too slow. It also shows the trade-off we described in our guide to stablecoins and tokenized assets: the issuer's power to freeze protects victims, and it means the issuer, not you, ultimately controls the coin.
What to doIf you have money on Binance
Check the official channels only
Read announcements inside the Binance app or on binance.com typed by hand. Ignore screenshots and DMs.
Look at your balance and recent activity
Confirm your balances, open orders and withdrawal history look normal. If anything is wrong, contact support from inside the app.
Tighten your account
Turn on an authenticator app or a passkey, a withdrawal address allowlist and an anti-phishing code if you have not already.
Do not panic-withdraw to an untested address
If you decide to move funds, send a small test amount first to an address you control and have used before. Congested networks and fake support pages are where people lose money in a panic.
Write down what you hold now
Record each asset, amount and the date you bought it. If reimbursement or a tax loss is ever involved, you will need the numbers.
Watch leverage
News like this moves prices fast. More than $600 million of positions were liquidated across the market within an hour of the first reports.
Should you move everything to your own wallet? Self-custody removes exchange risk: no hot wallet of yours sits on a company's servers. It replaces it with your own risk — a lost seed phrase or a mistyped address is permanent, and nobody can freeze stolen funds for you. A middle path many people use: keep what you trade on the exchange and what you hold for years in a wallet you control. Whatever you choose, keep the totals in one place — a portfolio tracker that holds exchange balances and wallet addresses side by side makes it obvious how much sits with any one company.
Proof of reserves is the other thing to watch. Binance publishes a monthly Merkle-tree report that lets each customer check their balance is included in the total the exchange says it holds. The first report after this incident will show whether customer assets are still fully backed.
If you hold crypto through a card or payment app rather than an exchange account, the same question applies: whose wallet is it? Visa and Mesh's crypto payments plan works by connecting to balances in third-party wallets, and those balances are only as safe as the company that runs them.
What nextWhat to watch in the coming days
- An official Binance post-mortem: the cause (a compromised signing key? a flaw in how the wallet handled EIP-7702?), the final loss, and how it will be covered.
- Withdrawals: whether Binance keeps them open, slows them or pauses some networks.
- Where the ETH goes: about 167,000 ETH cannot be frozen. Watch for swaps into Bitcoin or Monero (Monero rose about 6% on the news) and for bridge or mixer activity.
- Attribution: whether the FBI or blockchain analysts link the attack to a known group, as they did with Bybit within five days.
- Ripple effects: other exchanges reviewing EIP-7702 handling, and outflows from Binance as customers react.
Live updates
- 22:10 UTC, Oct 29 — Binance updated its statement to say user funds are "completely safe" (reported by Unchained). It still has not called the outflows a hack, published a loss figure or announced a withdrawal suspension. Some outlets now cite about $3.5 billion in outflows.
- 21:45 UTC, Oct 29 — First version. Binance investigating, no confirmed loss; about $2.4 billion in stablecoins frozen; outflow tallies range from $2.4 billion to $5.6 billion.
FAQFrequently asked questions
Was Binance hacked?
Very likely, but not officially confirmed as of 21:45 UTC on October 29, 2026. About $2.5 billion left a Binance hot wallet in one transaction to an attacker-controlled address funded through Tornado Cash. CZ said it "does look like a hack." Binance says it is investigating.
How much was stolen from Binance?
The single confirmed transaction moved about $2.5 billion. Higher figures — $3.3 billion, $5.57 billion, $5.64 billion, "up to $6 billion" — add up all outflows from Binance-labeled wallets on several chains, which may include Binance's own internal transfers. About $2.4 billion of the stablecoins taken has been frozen by Tether and Circle.
Are my funds safe on Binance?
CZ says user funds are safe, and Binance updated its statement at about 22:10 UTC to say user funds are "completely safe" — but it has not yet explained the outflows or published a loss figure. In past incidents Binance covered losses in full from its SAFU fund. Check your balance in the app, enable strong 2FA and a withdrawal allowlist, and ignore anyone contacting you about "securing" your account.
Should I withdraw from Binance?
That depends on how much you hold there and whether you can keep a wallet safely yourself. If you move funds, use an address you control and have used before, send a small test first, and never follow a link from a message about the hack. Spreading holdings across a few custodians limits any single company's risk.
Is this bigger than the Bybit hack?
Yes, if confirmed. Bybit lost about $1.46 billion in ETH on February 21, 2025, which the FBI attributed to North Korea. The confirmed transaction here is about $2.5 billion, roughly 1.7 times larger.
Can the stolen crypto be recovered?
Partly. Frozen USDT and USDC can be reissued to the victim once law enforcement and the issuers agree. Stolen ETH and other tokens cannot be frozen; they can only be traced and, sometimes, blocked when they reach an exchange that cooperates.
Where these numbers come fromSources and limits
- On-chain details (wallet "Binance 14", the 20:24 UTC transaction, 167,464 ETH, 1.615 billion USDT, the Tornado Cash funding, the EIP-7702 delegation): Decrypt and PANews, both reading Etherscan.
- Freezes: Circle CEO Jeremy Allaire's statement and the 21:04 UTC freeze via Decrypt; Tether CEO Paolo Ardoino's 1.567 billion USDT figure via Crypto Briefing.
- Statements: Binance's "not confirmed any impact to user funds" and CZ's posts via Decrypt and Crypto Briefing.
- Estimates: Cryptotimes, FXStreet, FinanceFeeds, Decrypt and Lookonchain (reported by TechFlow).
- Market moves: Decrypt (Bitcoin below $79,000, BNB about −7%, Monero +6%); Crypto Briefing (BNB down as much as 9%); liquidations of about $628 million in an hour as reported by BeInCrypto.
- Past incidents: Bybit's February 2025 disclosure and the FBI's February 26, 2025 statement; Binance's May 2019 security-breach notice; BNB Chain's October 2022 bridge report; contemporaneous reporting for Ronin, Poly Network and Coincheck.
- Arithmetic: frozen stablecoins = 1.567B USDT + 0.823B USDC ≈ $2.39B (97% of the 1.615B USDT moved); $2.5B ÷ $1.46B ≈ 1.7×. Script: drafts/binance-hack-2026-numbers.mjs.
Limits: this is a developing story written in the first 90 minutes. Figures differ between trackers, several reports were not readable directly from our network, and wallet labels come from third-party analytics, not from Binance. This page will be updated as Binance publishes official information.
