Binance Suspected Hack: Up to $5.8B Drained in 40 Minutes
Billions drained from Binance hot wallets in roughly 40 minutes on October 29, 2026. Tether and Circle froze a combined $2.37B in stablecoins, but ETH and BTC transferred to attacker wallets cannot be recalled.
Wallets labeled as Binance hot wallets lost billions in under an hour. The stablecoin freezes look like a win. They're not the whole story.
Key takeaways
- Wallets labeled as Binance hot wallets shed up to $5.8 billion across Ethereum, Bitcoin, and Tron in approximately 40 minutes on October 29, 2026, per on-chain tallies from named analysts, what would be, if confirmed, the largest exchange hack on record.
- Tether CEO Paolo Ardoino and Circle CEO Jeremy Allaire confirmed freezing more than $1.567B in USDT and more than $800M in USDC respectively in receiving wallets, but ETH and BTC sent to attacker addresses cannot be recalled and are already moving.
- Binance has not confirmed a breach or disclosed a loss figure; co-founder CZ acknowledged on X that it "does look like a hack" and pledged full coverage of user losses, but no audited reserve or SAFU balance has been published.
Wallets identified on-chain as Binance hot wallets drained up to $5.8 billion in approximately 40 minutes, from roughly 20:24 to 21:04 UTC on October 29, 2026, first reported by The Block. Conor Grogan, a senior director at Coinbase, tallied the ceiling at $5.8 billion; on-chain analyst Spreek flagged approximately $3.55 billion flowing into a single unlabeled receiving wallet. A separate breakdown tracked at least $5.57 billion across Ethereum ($3.51B), Bitcoin (18,270 BTC, approximately $1.44B), and Tron ($630M), with smaller amounts across Arbitrum, Optimism, and Base.
Receiving addresses were brand new. The contract call funding the operation was routed through Tornado Cash, per Spreek's own on-chain analysis.
What the On-Chain Data Shows
Binance co-founder and former CEO Changpeng Zhao posted on X at approximately 21:16 UTC:
"It does look like a hack on Binance. Appreciate the quick freeze from Tether ($971m) and Circle ($823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered."
Binance co-founder Yi He posted separately that the company is "actively investigating" a "potential security issue" and that "user funds are completely safe." Binance has not formally confirmed a breach or disclosed how much, if anything, was stolen. BNB dropped more than 5.5% on the news; Bitcoin slid approximately 2.6% to below $79,000.
Tether CEO Paolo Ardoino confirmed on X that Tether froze more than 1.567 billion USDT linked to the incident. Circle CEO Jeremy Allaire confirmed on X that Circle froze more than $800 million in USDC "in coordination with law enforcement." CZ's own post credited Tether with approximately $971 million and Circle with approximately $823 million in freezes, totaling roughly $1.79 billion in confirmed stablecoin freezes at the time of his post.
The Freeze Is the Tell
The speed of the stablecoin freezes is being framed broadly as the system working. It is also a clean demonstration of what custodial stablecoins actually are: permissioned IOUs with a kill switch held by a third party.
Tether and Circle can freeze balances because they control the underlying smart contracts and can blacklist specific addresses. That power is not selective to hacks. It can be invoked by governments, sanctions lists, or a phone call. Every USDT and USDC holder on every exchange watched their asset class get frozen on someone else's timeline, without their consent.
Prior TFTC coverage documented exactly this dynamic when Tether froze a payments firm's operating capital for a year.
The ETH and BTC in the attacker's wallets are a different story. Those cannot be frozen. They are already moving. The recoverable fraction was the permissioned fraction.
The math there is the number that matters, and no outlet has published it cleanly: the stablecoin freezes captured a confirmed floor of roughly $1.79 billion of a potential $5.57 to $5.8 billion outflow, leaving a substantial native-asset portion already moving beyond reach.
Assets held on an exchange are held on a perimeter the user cannot inspect, which is the custodial risk this hot wallet breach exposes. Bitcoin in self-custody had zero exposure to this event.
The SAFU Question Nobody Has Answered
CZ's pledge that "all user funds will be fully covered" is a promise from a shareholder who no longer runs the company. Binance set up its SAFU emergency reserve in 2018, funded by a percentage of trading fees. The current SAFU balance versus a potential $5 billion-plus loss is an open question.
No audited figure has been published. If SAFU was sized for a sub-billion-dollar event, the solvency conversation is coming whether Binance wants it or not.
The falsifiable version of what happens next: if SAFU fully covers every dollar of user losses, with no haircuts, no KYC gates on withdrawals, and all affected users made whole quickly, and if Tether and Circle can show the frozen stablecoins were returned to their rightful owners rather than simply immobilized, then the custodial model performed as advertised. That outcome would be the first of its kind in crypto exchange hack history. Watch for it.
What to Watch
Binance has committed to updates through official channels. The numbers to track: the SAFU balance disclosure, the confirmed total stolen versus the stablecoin freeze recovery rate, and whether withdrawal restrictions emerge. If outflows are confirmed at the high end of the range, this surpasses the February 2025 Bybit theft of approximately $1.5 billion, confirmed by the FBI (https://www.ic3.gov/psa/2025/psa250226) as occurring on or about February 21, 2025, as the largest exchange hack on record. The gap between "user funds are safe" and an audited balance sheet is where this story lives until Binance publishes one.
Sources
- CZ (@cz_binance) on X
- Paolo Ardoino (@paoloardoino) on X, confirmed more than 1.567B USDT frozen (exact post URL unconfirmed; cited as plain-text attribution)
- Jeremy Allaire (@jerallaire) on X, confirmed more than 800M USDC frozen (exact post URL unconfirmed; cited as plain-text attribution)
- Spreek (@spreekaway) on X, on-chain analysis flagging $3.55B inflow to unlabeled wallet and Tornado Cash routing (exact post URL unconfirmed; cited as plain-text attribution)
- Conor Grogan (Coinbase, senior director), $5.8B ceiling tally (exact post URL unconfirmed; cited as plain-text attribution)
- Yi He (@heyibinance) on X, Binance investigating "potential security issue" (exact post URL unconfirmed; cited as plain-text attribution)
- First reported by The Block
- FBI / IC3 PSA on Bybit theft, February 2025: https://www.ic3.gov/psa/2025/psa250226
Frequently Asked Questions
Is Bitcoin held in self-custody at risk from this event?
No. The hack targeted Binance's custodial hot wallets. Bitcoin held in self-custody, in hardware wallets or other setups controlled by the user, had zero exposure. This event did not touch the self-custody surface.
Only assets held on the exchange were at risk.
Can Tether and Circle always freeze stablecoins, and who else can trigger that?
Yes. Both Tether (USDT) and Circle (USDC) maintain administrative control over their token contracts and can blacklist specific addresses. The freeze power is structural, not situational. It can be invoked by the issuers voluntarily, under law enforcement coordination, or in response to government orders.
There is no mechanism by which a holder can prevent it. The Binance freeze was framed as protective. The same capability is available for uses that are not.
What is SAFU, and can it cover a loss of this size?
SAFU (Secure Asset Fund for Users) is an emergency reserve Binance established in 2018, funded by allocating a percentage of trading fees. Its purpose is to cover user losses in extreme situations. The current balance of the fund has not been publicly disclosed in audited form.
If confirmed outflows approach $5 billion, whether SAFU is capitalized to cover that exposure is the central unanswered question. Binance has not said it will draw on SAFU, and no reserve figure has been published as of this writing.
