Binance Suspected Hack: $5.7 Billion Drained From Hot Wallets, Tether and Circle Freeze $2.3 Billion — Explained
UPDATE — 6 November 2026, ~21:45 IST: Binance says the full zero-knowledge proof for its expanded 44-token Proof of Reserves snapshot is now live. Users holding any of the 44 tokens covered by the 4 November snapshot can now independently verify their balances are backed at least 1:1 through Binance's Proof of Reserves verification tool. The proof completes the transparency step Binance said would take 50–60 hours to generate after the 4 November 00:00 UTC snapshot. Replenishment remains at about 98% of the affected amount, with the remaining ~2% in less-liquid tokens still being sourced through market and over-the-counter channels. Binance also reopened withdrawals for a further batch of assets from 04:00 UTC today under Recovery Update #9 and says it is working to reopen HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of next week. No Recovery Update #10 and no 100% replenishment figure have been published yet. Sources: PANews, 6 November 2026; Binance on LinkedIn.
UPDATE — 5 November 2026, ~17:30 IST: Binance has issued Recovery Update #8, reopening withdrawals for more assets from 12:00 Beijing time (09:30 IST) today. The reopening spans six networks — UNI, AAVE, PAXG, VIRTUAL and MORPHO on Ethereum; ASTER, PROM, UNI, 1MBABYDOGE and FIL on BNB Smart Chain; AERO, VIRTUAL, MORPHO and AVNT on Base; JST, SUN and BTTC on TRON; GNS on Polygon; and MMT on SUI. Binance says withdrawal priority follows user demand measured over the preceding week, and deposits were never affected. Full restoration across all assets is still not confirmed, and the full zero-knowledge proof for the expanded 44-token reserve snapshot is still due in about 50–60 hours from the 4 November snapshot. Sources: Binance Recovery Update #8 announcement, 5 November 2026 (via TrustsCrypto and PANews); Binance on LinkedIn.
UPDATE — 5 November 2026, ~17:00 IST: Binance has proactively removed all API keys linked to third-party trading platform SignalPlus after SignalPlus reported a potential security issue on its side. Binance says its own systems were not affected and user funds remain safe; the move is precautionary and is not connected to the 29 October $6.3 billion hack. Binance advises SignalPlus users to log in directly to check positions and open orders, and not to re-bind API keys until SignalPlus confirms the issue is fully resolved. Sources: Binance announcement via Reuters, 5 November 2026; Crypto Briefing.
UPDATE — 5 November 2026, ~16:45 IST: US regulators are now checking banks after the hack. Reuters reports supervisors from the Federal Reserve and the Office of the Comptroller of the Currency began contacting banks on Monday morning to ask about unusual activity or disruption and whether their systems have any vulnerabilities, amid concern the crypto-market hack could spill into traditional finance. A bank contacted by regulators told Reuters it had no disruptions; banks are running diagnostics on their own systems, and a cybersecurity team at one of the largest US banks has contacted Binance and is preparing an internal report. Binance said it is in close contact with regulators worldwide. The Fed and the OCC declined to comment. Sources: Reuters, 5 November 2026 (also carried by Channel NewsAsia).
UPDATE — 4 November 2026, ~22:45 IST: Binance has completed its planned 4 November Proof of Reserves snapshot, expanding coverage from the original 10 tokens to 44 tokens. The exchange says about 98% of the affected assets have now been replenished from company funds, with the remaining ~2% in less-liquid tokens still being sourced through market and over-the-counter channels. The new zero-knowledge proof for the expanded snapshot is expected to take 50–60 hours to generate, so independent verification of the wider coverage is due around 7 November — the 31 October 10-token proof remains the only fully verifiable snapshot for now. Sources: Bloomberg (via BBX) and The Block, 4 November 2026.
UPDATE — 3 November 2026, ~21:30 IST: Binance has published its first detailed account of how the $6.3 billion heist happened — and it was a months-long campaign, not a single breach. In its initial incident report, published Tuesday, and a media briefing, Binance said: in June 2026 a wallet-team engineer downloaded a tampered Homebrew package while searching for an AI tool; in September a second engineer, contacted through a job platform by someone posing as a project director, was interviewed by a purported CEO and downloaded a coding assignment containing zero-day malware that evaded endpoint security; on 20 October the attackers used the compromised computer plus an internal AI tool to reach two wallet engineers' machines and found a container-deployment permission; on 29 October they used stolen credentials to deploy a container, run a malicious script and, via an EIP-7702 delegation, turn a hot wallet into a sweeper they controlled, draining funds from 20:05 UTC. Binance says the FBI has attributed the attack to North Korea (Pyongyang denies it), that it blocked 57 suspected North Korea-linked attempts in 2026, that about $2.85 billion has been frozen or intercepted, and that about 98% of affected tokens have been replenished from company funds; independent cybersecurity experts will review the incident. Sources: Binance initial incident report / media briefing via Reuters, CoinDesk, Bloomberg and The Block, 3 November 2026.
UPDATE — 3 November 2026, ~08:30 IST: Binance opens its next withdrawal phase today. Binance has announced it will reopen withdrawals for more assets on nine networks — BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, TRON and Base — in batches from 04:00 GMT on Tuesday 3 November (09:30 IST today), with all bSTOCKS on BSC also resuming. This extends the phased restoration that began on 1 November (15 networks); it is not a new incident. Deposits remain open, but Binance warns withdrawal processing may face delays during the resumption period. Sources: Reuters (3 November 2026) and Binance's announcement (3 November 2026).
UPDATE — 2 November 2026, ~9:45 PM IST: Customers have now pulled a net $4.72 billion from Binance since withdrawals reopened on Sunday morning — about 2.8% of the exchange's assets — Reuters reported on 2 November, citing a Binance spokesperson. Binance says withdrawal volumes have declined after an initial spike and are stabilising, with $2.7 billion in inflows, and it restored US dollar cash as a withdrawal option on Monday; most other cryptocurrencies remain partially suspended. Separately, Circle said on Monday it had frozen more than $1.1 billion in USDC linked to the heist, and about half of the stolen funds were held in stablecoins now frozen by issuers. Sources: Reuters, 2 Nov 2026; Binance spokesperson statement via Reuters; Circle statement via Reuters.
UPDATE — 1 November 2026, ~12:45 IST: Withdrawals are flowing again. Binance posted on its status page shortly after 06:00 GMT (11:30 IST) that the planned phased reopening had begun, and Reuters reports the exchange has resumed bitcoin withdrawals, with the first phase covering 15 cryptoassets including bitcoin, ether, XRP and dogecoin. Binance says it has now covered 95% — about $6 billion — of the $6.3 billion stolen, using company funds to buy replacement tokens; the remaining ~5% sits in less-liquid tokens that take longer to source. The full cryptographic proof of reserves is still due by 3 November. What this does NOT yet prove: that all 15 phase-one assets are withdrawing smoothly for all users, or that the remaining 5% is covered — watch the rest of the phase-one window (to 14:30 IST) and the 3 November proof-of-reserves report.
UPDATE — 1 November 2026, ~06:50 IST: The FBI has formally blamed North Korea for the theft — the first official US government attribution. In a statement on 31 October, issued with the US Secret Service and the IRS Criminal Investigation division, the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October 2026, identified the actors as TraderTraitor, and said it had observed them converting stolen assets primarily into Ethereum, expecting further laundering through DeFi platforms and instant-swap services. The bureau urged exchanges, blockchain firms and analytics companies to block transactions linked to the attackers' addresses. This confirms the earlier TRM Labs / Chainalysis / Elliptic attribution; Binance itself has still not named an attacker. Withdrawals remain paused, with the phased reopening still expected later today.
Image: Wikimedia Commons — Binance logo (official logo)
UPDATE — 30 October 2026, ~14:15 IST: Binance co-CEO Richard Teng has clarified how the attack unfolded. In an X post on Friday, Teng said the incident was "not a single 'one-click' action" and involved "a more complex attack process" — the attacker did not simply use one engineer's permissions, and Binance's investigation "has not attributed responsibility to any individual". The preliminary finding stands: a compromised DevOps engineer's laptop may have let the attacker reach an internal service and submit unauthorised withdrawals, with no evidence of a wallet private-key leak, and Binance says it will cover all losses from its SAFU fund and company funds. Still to come: the staged withdrawal reopening (within 48 hours of co-CEO Yi He's 09:47 IST update), the final stolen total, and the full technical post-mortem.
UPDATE — 30 October 2026, ~10:30 IST: Blockchain intelligence firm TRM Labs has now attributed the attack to North Korea. In a report published 30 October, TRM said it attributes the heist to TraderTraitor, North Korea's elite hacking unit, "based on robust on and off-chain intelligence" and "with high confidence" — the same unit the FBI blamed for the $1.5 billion Bybit hack in February 2025. TRM puts the theft at about $6.36 billion moved out of Binance wallets across ten blockchains in roughly 20 minutes from 20:05 UTC on 29 October, and says the attacker used an EIP-7702 delegation on Ethereum to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorisations prepared in advance. TRM also says about $2.4 billion in bitcoin and ether remains under the attacker's control. Note that this attribution is TRM's assessment, not yet a Binance or law-enforcement statement — Binance itself has said it is working with law-enforcement partners to confirm the attackers' identity. Still to come: the staged withdrawal reopening (within 48 hours of co-CEO Yi He's 09:47 IST update), the final stolen total, and the full technical post-mortem.
UPDATE — 30 October 2026, ~10:15 IST: Binance has given its first timeline for reopening withdrawals. In a "Service Update" posted on X at 04:17 UTC on 30 October (09:47 IST), co-CEO Yi He said: "We expect to begin resume withdrawal services in the next 48 hours." The team is working on enhancements to the withdrawal service and related address controls, and the 48-hour window covers the start of restoration — not a promised date for full service. Yi He also said deposits "remain unaffected and continue to operate as normal", a change from Binance's earlier notices, which listed deposits as temporarily suspended; users should go by the latest official update. Withdrawals remain paused until the security checks are complete, and Binance still promises to cover all losses from SAFU and company funds. Still to come: the staged reopening itself, the final stolen total, and the full technical post-mortem.
UPDATE — 30 October 2026, ~09:30 IST: Binance has now given its first account of how the hack happened and its own estimate of the scale. In a security-incident update published on Friday, the exchange said its initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions". Binance said it has found no evidence of any wallet private key leak, and stressed the findings are preliminary, with a detailed technical post-mortem to follow once the investigation is complete and the facts are fully verified. The exchange now puts the estimated total impact at around $6.3 billion, while about $3 billion in affected assets has been frozen on-chain so far, including Tether's ~$1.57 billion and Circle's ~$800 million in freezes. Binance reiterated it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds, and that deposits and withdrawals remain suspended until security checks are complete; it also promised an updated Proof of Reserves after remediation. What is still NOT confirmed: a final stolen total (the $6.3 billion is Binance's estimate of impact, not a final loss figure), and when withdrawals will resume.
UPDATE — 30 October 2026, ~06:00 IST: Binance has now confirmed it was the victim of a major hack, AFP reported on Friday morning, after the exchange had initially described only a "potential security issue". Binance said on X that the verified total frozen now stands at $2.54 billion and may rise further as it traces funds with law enforcement, stablecoin issuers and blockchain analytics firms. Co-founder Yi He said Binance will bear all losses from the hack, that user funds are safe, and that deposits and withdrawals remain temporarily suspended while security checks continue, with a full post-mortem to follow. Trading on certain products, including Binance Alpha, is also suspended until the security issue is resolved. What Binance has still NOT said: how much was actually stolen — analyst tallies of $5.5–$5.7 billion in outflows remain unconfirmed — or when withdrawals will resume.
TL;DR — Binance suspected hack explained: billions of dollars left wallets labelled as Binance hot wallets on Thursday, 29 October 2026, in what founder Changpeng Zhao said "does look like a hack on Binance". Binance itself has NOT confirmed a hack — it says it is investigating a potential security issue and that user funds are completely safe. Tether and Circle froze more than $2.3 billion in stablecoins linked to the outflows.
📌 KEY HIGHLIGHTS
- Billions left Binance-labelled hot wallets from 20:24 UTC on 29 October 2026 (01:54 IST, 30 October), first from wallet "Binance 14".
- On-chain tallies put total outflows at $5.5–$5.7 billion across Ethereum, Bitcoin and Tron — which, if confirmed as theft, would be the largest crypto hack on record.
- Binance says it is investigating a "potential security issue" and that "user funds are completely safe"; it has NOT called the outflows a hack.
- Tether froze more than $1.567 billion in USDT and Circle froze more than $800 million in USDC linked to the receiving wallet.
- Bitcoin fell below $79,000 and BNB dropped about 7% as the news spread; no final loss total is confirmed.
What happened?
On Thursday, 29 October 2026, on-chain researchers flagged a series of very large transfers out of wallets that Etherscan labels as belonging to Binance, the world's largest cryptocurrency exchange by volume. At 20:24 UTC (01:54 IST on 30 October), one transaction moved 167,464 ETH — worth about $388 million — plus 63 other token transfers, including roughly $1.6 billion in USDT, out of the wallet labelled "Binance 14" to a brand-new address. A second Binance-labelled wallet, "Binance 16", sent another 28,005 ETH to the same address 24 seconds later.
Two details made analysts suspicious. The receiving address did not exist before Thursday, and within 15 minutes it forwarded about $450 million onward to yet another fresh address. The transfer was also triggered by a wallet funded only through Tornado Cash, a mixing service that obscures where coins come from. On-chain researcher Spreek, who first flagged the activity, noted it "could be routine wallet maintenance, but looks extremely sus". Exchanges do routinely move funds between their own wallets — but a Binance-run transfer has no obvious reason to start from a mixer-seeded wallet and split onward within minutes.
By Thursday evening in the US, tallies from on-chain analysts put the total at $5.57 billion across Ethereum, Bitcoin and Tron: about $3.51 billion on Ethereum, $1.44 billion in 18,270 Bitcoin and $630 million on Tron, according to Decrypt's tally. CoinDesk, citing Arkham data, put the hacker's wallet at more than $5.7 billion, including nearly $1.5 billion of Bitcoin and $900 million of Ether. These are analyst tallies of wallet movements, not a confirmed theft total from Binance — and the figures differ by source because the outflows were still being counted as they happened.
What Binance, CZ, Tether and Circle actually said
Binance's own statements have been careful. Its first statement on X said its teams were "aware of reports of a potential security issue and are actively investigating" and had "not confirmed any impact to user funds". A revised statement at 5:29 p.m. ET (02:59 IST) went further: "user funds are completely safe". The exchange has not called the outflows a hack, has not given a loss figure, and has not explained the transfers.
Founder Changpeng Zhao, who no longer runs Binance, was blunter. Posting on X about ten minutes after the flagged outflows ended, he wrote: "User funds are safe! It does look like a hack on Binance." He added that, as a shareholder, he expects all user funds to be fully covered. His expectation is not a completed reimbursement — no payouts have been confirmed.
The stablecoin issuers moved fastest. Tether blacklisted the receiving address and its CEO, Paolo Ardoino, said Tether froze more than $1.567 billion in USDT related to a potential Binance hack; Tether also blacklisted seven downstream wallets. Circle followed with more than $800 million in USDC frozen, its CEO Jeremy Allaire said, in coordination with law enforcement. Together, the issuer freezes exceed $2.3 billion. Freezing tokens stops them moving — it does not by itself mean the assets have been returned to Binance or used to reimburse customers. Lending protocol Aave also froze markets after the exploiter borrowed about $44 million in wrapped ETH using stolen USDT as collateral, according to CoinDesk.
Illustrative image: cryptocurrency trading setup (Image: Pexels)
Timeline: how the suspected Binance hack unfolded
| Time (IST, 30 Oct unless stated) | What happened |
|---|---|
| 01:54 IST (20:24 UTC, 29 Oct) | First flagged transfer: 167,464 ETH + ~$1.6B USDT leaves "Binance 14" for a brand-new address |
| ~02:00–02:34 IST | Further outflows across Ethereum, Bitcoin and Tron; receiving address forwards ~$450M onward within 15 minutes |
| ~02:45 IST | CZ posts on X: "It does look like a hack on Binance", user funds safe, expects full coverage |
| ~02:59 IST | Binance revised statement: "user funds are completely safe", investigation under way |
| ~03:15 IST | Tether says >$1.567B USDT frozen; Circle says >$800M USDC frozen; drain still running in places |
| ~05:30 IST, 30 Oct | Binance confirms major hack (AFP); verified frozen total $2.54 billion; co-founder Yi He says Binance will bear all losses; withdrawals and some trading (incl. Binance Alpha) suspended pending security checks |
Why it matters for World readers
If confirmed, this would dwarf every previous crypto exchange theft — including the $387 million Bitget hack in September 2026 and the $1.5 billion Bybit hack of 2025 — and it lands on the same day as a second, much smaller incident: the Polymarket third-party breach that drained about $2.6 million. Two suspected exchange incidents in one day is a reminder that, for most users, the biggest crypto risk is not price swings but custody: coins held on an exchange are only as safe as that exchange's hot wallets and vendor access.
The market reaction was immediate. Bitcoin fell below $79,000, down about 3% to roughly $78,800; Ether fell about 4%; Binance's own BNB token dropped about 6.7–7%; and AAVE fell about 8%. That reaction is to uncertainty as much as to confirmed loss: until Binance explains what moved, why, and whether any customer funds are actually missing, traders are pricing in the worst case.
For Indian readers, the direct exposure is through Binance's global platform and through BNB and the wider crypto market, which moves together. This is not a confirmed loss of Indian users' funds, and Binance says user funds are safe — but anyone holding crypto on any exchange should treat today as a prompt to check their own security, not to panic-sell on unconfirmed headlines.
Should you care?
✅ Verdict: Yes — this is the biggest suspected exchange incident of the year, and the on-chain evidence plus the $2.3 billion in issuer freezes make it far more than a rumour. But do not treat any single dollar figure as final yet: Binance has not confirmed a hack or a loss total, and the $5.5–$5.7 billion tallies count wallet movements, including frozen funds that cannot move. Watch for Binance's own technical explanation and a confirmed loss figure; those, not the first on-chain tally, will decide how serious this really was.
What Binance users should do now
Do not click links in unsolicited messages claiming to help you "recover" funds — scam messages surge after incidents like this. Use only Binance's official app and official channels for updates, check that two-factor authentication is on, and be wary of any message asking for account details or seed phrases: Binance will never ask for those. If you keep large balances on any exchange, consider moving funds you do not actively trade to a hardware wallet — and remember that a freeze by Tether or Circle stops stolen stablecoins moving, it does not automatically return them.
FAQs
Has Binance confirmed it was hacked?
No. Binance says it is investigating a potential security issue and that user funds are completely safe. Founder Changpeng Zhao said it "does look like a hack", but the exchange itself has not used that word or given a loss figure.
How much was taken in the suspected Binance hack?
No final total is confirmed. On-chain tallies put outflows at $5.5–$5.7 billion across Ethereum, Bitcoin and Tron, but that counts all wallet movements, including more than $2.3 billion in stablecoins frozen by Tether and Circle. The confirmed, unrecovered loss — if any — is still unknown.
Are Binance user funds safe?
Binance says user funds are completely safe, and CZ says he expects all user funds to be fully covered as a shareholder. Those are assurances, not a completed audit or reimbursement; Binance has not confirmed whether any customer funds are missing.
Why did Tether and Circle freeze funds?
USDT and USDC are centrally issued, so their issuers can blacklist specific addresses. Tether froze more than $1.567 billion in USDT and Circle more than $800 million in USDC linked to the receiving wallet, stopping those tokens from moving further.
Takeaway: Billions moved out of Binance-labelled hot wallets in under an hour, the founder calls it a likely hack, Binance says funds are safe and is investigating, and $2.3 billion-plus is frozen — but the confirmed loss is still unknown. This story is developing, and TechByCountry will update this post when Binance gives its own account.
Follow World Tech on TechByCountry for tomorrow's 6 PM update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
CoinDesk — Binance loses $5.7 billion in largest crypto hack to date
The Block — Binance investigating hack as suspicious outflows reach up to $5.8 billion
Decrypt — Binance drained of $5.5 billion in suspected hack, Tether and Circle freeze $1.8 billion
Unchained — Binance says user funds are 'completely safe' after $3.5 billion drains from its hot wallets
BeInCrypto — Is Binance being hacked? $2 billion outflow puts customer funds in question
Related on TechByCountry: Polymarket hack: $2.6 million drained in third-party breach, SBI customer data leak on dark web: what customers should do, FCC bans Chinese labs from testing US electronics
Comments
Post a Comment