Binance halts withdrawals after suspected crypto theft

Binance halted withdrawals across several networks on Oct. 29, 2026, after flagging a potential security issue, and said it is investigating following user reports of possible problems. The exchange has not confirmed a hack of its platform.

Changpeng Zhao posted on X on Oct. 29, 2026, that the situation appears to be a hack targeting Binance dot com. Zhao, who no longer manages Binance dot com but remains its largest shareholder, said he expects all user funds to be fully covered.

Estimates of funds drained from Binance range from at least $2 billion to upwards of $5.8 billion. Watchers tracking crypto said Binance hot wallets—internet-connected wallets used for customer withdrawals—lost at least $2 billion in early reports on Oct. 29, 2026. An on-chain tally counted at least $5.57 billion leaving Binance-linked wallets across Ethereum, Bitcoin and Tron that day. According to a Coinbase director and Kairos Research, $5.8 billion seems to have exited Binance on Ethereum, Bitcoin and Tron, and observers saw a Binance wallet send more than $2.7 billion to an outside account.

Exchanges use internet-connected hot wallets for customer withdrawals, and these wallets are less secure than offline cold storage. Blockchain records show $630 million moved on Tron, $1.44 billion in 18,270 Bitcoin and $3.51 billion on Ethereum from Binance-linked wallets. At 20:24 UTC, the initial Ethereum transfer moved 167,464 ETH and 63 token transfers including 1.615 billion USDT to a fresh address.

A Tornado Cash-funded address—Tornado Cash is a cryptocurrency mixer—set up an EIP-7702 delegation on a Binance hot wallet three minutes before the first Ethereum transaction. Under EIP-7702, a regular wallet can execute delegated code that stays active and approves later transfers without a new signature. How the attacker obtained the required signature remains unknown. Odysseas Lamtzidi, founder of Phylax Systems, said, “7702 lets a normal wallet execute delegated code.

The delegation persists; that code can authorize later transfers without another signature from the wallet”

The wallet attributed to the hacker contains $1.77 billion in Tether, $1.44 billion in Bitcoin and $1.01 billion in Ethereum. It also holds over a billion more in other currencies.

Circle froze about $800 million in coordination with law enforcement. Sources disagree on whether Circle froze Tether or USD Coin and on whether the amount was about $800 million or $823 million. Binance said it has frozen $2.54 billion in funds and the figure may grow as it traces assets. Tether froze about $1.56 billion in connection with the Binance incident, and at the main receiving address Tether froze 975.1 million USDT.

Binance said customer funds remain completely safe and pledged to restore withdrawals after the security problem is fully fixed. Binance spokesperson Ross O’Leary called the withdrawal suspension a precautionary measure following a security incident. O’Leary said, “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.” Yi He, Binance co-CEO, said, “Safety first: withdrawals are currently disabled until the environment is confirmed to be secure”

The apparent hack affects only Binance dot com, not Binance dot us, which operates normally. Coinbase says it is not affected by the incident.

Bitcoin dropped under $79,000, about 2.6 percent lower in a day, while BNB fell roughly 7 percent and Monero gained about 6 percent. If confirmed, the theft would rank as the biggest crypto theft ever, surpassing the approximately $1.5 billion Bybit breach from February 2025. Binance lost 7,000 Bitcoin worth about $40 million in a 2019 hack.

Binance’s X account first acknowledged the problem at 5:15 p.m. Eastern Time on Oct. 29, 2026. The exchange halted Binance Alpha trading at 7:06 p.m. Eastern Time that day and said it would return after the security issue ends. Binance Alpha showcases early-stage crypto projects that Binance has not yet listed.

Binance did not say whether it received any correspondence from the hackers, and the identity of the hackers remains unknown. Customers ought to stay alert for scams and avoid trusting unofficial links, messages or requests for account details.

Polymarket paused trading after it confirmed that an outside company suffered a compromise. One estimate puts 700 Polymarket users affected with $2.7 million drained, and Polymarket said one of its third-party providers was compromised and it will make anyone affected whole.

Attackers took roughly $2 million in customer funds by compromising DebugBear software, according to security researchers, and according to Hudson Rock technology chief Alon Gal, DebugBear was altered to load malicious code that targets signed-in trading sessions and moves assets. DebugBear confirmed an ongoing security incident and told users of its RUM (real user monitoring) product to remove the embed code from their websites.