On the evening of 29 October 2026, billions of dollars in crypto left Binance's hot wallets for new addresses in what Binance's founder called a likely Binance hack, and one on-chain tally puts the total at about 5.57 billion USD. Binance hasn't confirmed a breach. It says it's investigating and that user funds are "completely safe," and no withdrawal freeze had been announced in the first hours. If you hold crypto on Binance, the useful first move is to avoid the scams that follow every incident like this, and then decide calmly how much you want to keep on any exchange.
This is a developing story, written a few hours after the first transfers. We'll update it as Binance publishes its own account.
What happened
The first large transfer went out at 20:24 UTC, when a Binance hot wallet sent 167,464 ETH and more than 1.6 billion USDT, along with dozens of other tokens, to a brand-new address in a single Ethereum transaction. Over the next hours, more funds left Binance-linked wallets on Bitcoin and Tron as well. A hot wallet is the part of an exchange's holdings kept online so withdrawals can be paid out quickly; most of an exchange's reserves normally sit in offline cold storage.
By the count Decrypt reported, at least 5.57 billion USD moved: about 3.51 billion on Ethereum, 18,270 BTC (about 1.44 billion) on Bitcoin, and about 630 million on Tron. Other estimates differ, which is normal this early. Security firm Blockaid was looking at about 3.3 billion USD in suspicious outflows, and Coinbase's Conor Grogan put the figure as high as 5.8 billion, according to The Block. If the larger numbers hold, this would be more than three times the 1.5 billion USD Bybit hack of February 2025, which until now was the largest exchange theft on record.
What Binance and others have said
Binance's statement on X says it is "aware of reports of a potential security issue and is actively investigating," and asks users to be wary of scams and unofficial links. The wording changed twice within about 15 minutes, FinanceFeeds reported: the first version said Binance had "not confirmed any impact to user funds," a later edit removed that line, and the current version says "User funds are completely safe." It doesn't use the word hack, give a loss figure or name a cause.
Changpeng Zhao, Binance's founder, who no longer runs the exchange, posted that it "does look like a hack" and that, as a shareholder, he expects all user funds to be fully covered. That's an expectation from a shareholder and not yet a commitment from the company.
The stablecoin issuers moved fastest. Circle CEO Jeremy Allaire said Circle had frozen more than 800 million USDC "in coordination with law enforcement," and Tether CEO Paolo Ardoino said Tether froze more than 1.567 billion USDT. Freezes only work on tokens whose issuer can block an address, so the ETH and BTC that left can't be stopped that way.
How it may have happened
Nobody has confirmed the method. One early account from Odysseas Lamtzidi, founder of security firm Phylax Systems, points to an Ethereum feature that lets a wallet hand its transaction logic to a piece of code, and says an address funded through the Tornado Cash mixer set this up for a Binance hot wallet about three minutes before the first transfer. Once that delegation is in place, the code can authorize later transfers without the wallet signing again. How the attacker got the signature needed to set it up is still unknown, and that's the question that will decide whether this was a stolen key, a tricked signer or something else.
Is your crypto on Binance safe?
The fair answer, this early, is that nobody outside Binance knows yet. Exchanges pool customer deposits, so a loss from a hot wallet is first a loss to the exchange's own balance sheet, and whether customers end up whole depends on how much Binance holds in reserve. Binance has covered a hot-wallet theft before: when attackers took about 7,000 BTC in May 2019, it paid the loss from its emergency fund for users, known as SAFU, and paused deposits and withdrawals for about a week while it reviewed security, The Hacker News reported at the time. The outflow reported on 29 October is more than a hundred times that size in dollar terms.
If you're in the US, your account is with Binance.US, a separate exchange operated by BAM Trading Services, as Decrypt has explained, because Binance.com doesn't accept US customers. None of the reporting so far says Binance.US was affected, though it hasn't been ruled out either.
What to do now if you hold crypto on Binance
Start with the scams, because they arrive first. Expect fake support agents, fake "refund" pages and messages saying your account needs verifying; Binance itself warned users not to trust unofficial links or requests for account details. Use only the official app or a site address you type yourself.
Then check your own account. Look at your balances and recent activity, and see whether withdrawals go through normally; some users have reported withdrawals stuck in processing, which Binance hasn't confirmed. Panic doesn't help here, because the costly mistakes after an incident like this tend to come from rushing a transfer.
If you decide to move some of your crypto into self-custody, set it up before you withdraw, send a small test amount first, and pick a network your wallet supports. That matters most for stablecoins: USDT on Binance can be withdrawn on several networks, and a wallet that supports Ethereum tokens won't see USDT sent over Tron. Our guide on moving crypto from Coinbase to a cold wallet walks through the same steps, and they apply to Binance as well.
What this means for where you keep crypto
An exchange is a convenient place to buy, sell and trade, and the biggest ones invest heavily in security. They're also the largest single targets in crypto, and when something goes wrong, your access depends on the exchange's decisions about withdrawals and repayment. Our look at the Bitget hack and the largest crypto hacks of 2026 shows how often that question comes up.
A hardware wallet keeps the keys to your crypto on a device you hold, so an exchange incident can't reach coins you've already moved off it. It also hands you the job of protecting the device and its backup. Ryder One works with Bitcoin, Ethereum, Solana and a list of major tokens on Ethereum and Solana; it doesn't support Tron, so check the supported list and withdraw any stablecoins you plan to keep on it over a network it covers. If you're weighing a first hardware wallet after this, our checklist on your first hardware wallet covers what to compare before you buy.
Share: