Binance investigates up to $5.8 billion in suspicious crypto outflows

Binance is investigating suspicious cryptocurrency transfers worth up to $5.8 billion that moved from exchange-associated wallets on Oct. 29, 2026. Binance has not confirmed that customer funds were stolen and has not verified the full amount of any losses. Blockchain data showed large cryptocurrency transfers moving from Binance-associated hot wallets into an unidentified wallet. Investigators have not established how the attacker obtained the required authorization, and no public technical findings identify a threat actor or confirm an attack path.

Stablecoin issuers moved quickly to freeze assets tied to the suspicious transfers. Tether chief executive Paolo Ardoino stated that his company blocked over $1.567 billion in USDT tied to a possible Binance exchange hack. Jeremy Allaire, the chief executive of Circle, said the firm immobilized more than $800 million in USDC connected to the incident.

Binance said about $3 billion in affected assets had been frozen on-chain with help from blockchain partners. Cyber Security News reported that verified frozen assets total $2.54 billion, and tracing is still underway. Binance co-founder Yi He said Ripple froze approximately $200 million in RLUSD assets linked to the incident.

Binance halted deposits and withdrawals during security checks and said it would restore access after resolving the issue. The exchange said customer funds were safe and its security teams were urgently reviewing all relevant information.

Changpeng Zhao, the Binance founder, wrote on X that the activity looked like a hack and said he expects full coverage for customer funds. Zhao noted he no longer manages the exchange and spoke as a shareholder, separate from Binance’s official investigation. Yi He, a Binance co-founder, said the firm would cover every hacking loss.

It does look like a hack on Binance.

Changpeng Zhao, Pulse Nigeria

The transfers included Ethereum, stablecoins and other cryptocurrencies, and funds were subsequently shifted to other wallets. Investigators must establish who started the transfers, if they had authorization, and whether an attacker took control of the wallets. It is not yet known if the transferred assets were customer funds or Binance’s own funds.

Investigators found a signed authorization tied to EIP-7702, an Ethereum feature letting a wallet delegate functions to smart-contract code, shortly before funds moved. Researchers linked an address tied to the operation to Tornado Cash, described as a cryptocurrency mixing service.

If confirmed as stolen, the $5.8 billion would greatly surpass the roughly $1.5 billion taken from Bybit by North Korean hackers in February 2025, the prior record crypto heist. TRM and Chainalysis blamed the attack on TraderTraitor, North Korea’s elite hacking unit, with high confidence, while Binance has not explicitly confirmed that any funds were stolen.

Bitcoin fell more than 3 percent to reach a six-week low near $76,368 in early Asian trading. BNB lost nearly 7.7 percent, and Ethereum declined approximately 4.6 percent. Leveraged positions totaling roughly $1.4 billion faced liquidation within 24 hours, bullish bets, per Coinglass data.

Coinglass data indicates that $627.7 million in derivatives market liquidations occurred within one hour following the first alerts, with $606.6 million tied to long contracts. Binance’s share of the forced liquidation volume in that period reached $344.8 million. Shares in Coinbase Global slid 4.8 percent, while shares of Strategy fell nearly 6 percent in extended US trading.

Binance reported 335 million registered users worldwide and about $162.8 billion in assets under custody in its 2025 annual report. Binance’s Secure Asset Fund for Users, known as SAFU, is held at roughly $1 billion in Bitcoin, and resources beyond that reserve could be needed for a much larger confirmed shortfall. No detailed compensation plan has been published.

Binance’s initial investigation indicates a hacked DevOps engineer’s laptop may have let an attacker enter a service container and send unauthorized withdrawal transactions. Binance said it found no evidence that a wallet private key was leaked.

Binance.US, described as a separate exchange, said the security incident did not affect it. Coinbase said the incident did not affect it and was monitoring the situation.

On October 29, 2026, major Ethereum transfers started around 4:24 p.m. Eastern time as assets from the Binance 14 wallet moved to a newly created address. The Binance 14 transfer included more than 60 different tokens, with subsequent transactions bringing additional funds from other Binance-linked wallets.

One Ethereum transaction reportedly swept away roughly 167,464 ETH, 1.615 billion USDT and dozens of other tokens, and one receiving address had collected an estimated $3.52 billion within 40 minutes. Binance posted on X that withdrawals will resume as soon as the security issue is fully resolved and that user funds remain safe.

Our team is conducting security checks. Withdrawals will resume as soon as the security issue is fully resolved. User funds remain safe.

Binance, Crypto Economy

Richard Teng, a co-chief executive of Binance, said customer money was safe and Binance would cover every loss. Yi He wrote at 8 p.m. Eastern time that Binance would cover all hacking losses and share a full post-mortem once the investigation was complete.

Bottom line – your money is safe, and we're covering every loss.

Richard Teng, The Guardian

Binance’s official statement on X promised to cover all losses and publish a full post-mortem after the investigation ends, without identifying the entry point, naming an attacker, or giving a reopening date.

Aravind Srinivasan, head of GSR’s systematic OTC business, called the incident the biggest hack in history. Tim Sun, a senior researcher at HashKey Group in Hong Kong, said the breach might reduce risk appetite and lead investors to reconsider the safety of assets on centralized exchanges and related counterparty, solvency and liquidity risks.

Bernardo Brites, chief executive of Trace Finance, said AI is finding vulnerabilities faster than engineers can fix them and that users may leave smaller exchanges that cannot cover meaningful hacks. Officials issued a warning that criminal organizations are using digital currencies more often to shift money across borders beyond the traditional banking system.