Binance Hack Probe: Suspicious Outflows Reach Up to $5.8 Billion

On-chain trackers estimate that between roughly $5.5 billion and $5.8 billion left Binance-linked wallets on October 29, 2026, in what looks like a Binance hack. The company says it’s investigating. Tether and Circle moved fast to freeze part of the affected stablecoins. But Binance has not confirmed a loss figure, and every number below is a preliminary estimate.

What we know about the Binance hack

The Block reported that analyst Spreek flagged about $3.55 billion moving into an unlabeled wallet, with nearly $900 million of that pushed on to other addresses. Coinbase senior director Conor Grogan put the total at up to $5.8 billion.

Other tallies land in the same range. Decrypt’s on-chain count found at least $5.57 billion leaving Binance-linked wallets. A later PANews count of Binance-labeled wallets, as of 5:22 Beijing time on October 30, reached about $5.643 billion.

Binance hack timeline from the chain

According to a timeline compiled by CryptoTicker, a wallet labeled “Binance 14” was delegated to an outside smart contract via EIP-7702 at 20:20 UTC. Four minutes later, 167,464 ETH and 63 other tokens left in a single transaction for an address Etherscan now tags “Binance Hot Wallet Exploiter 2”.

The preparation started earlier. Kiprinform, citing Etherscan and on-chain researchers, said the triggering address was funded through the Tornado Cash mixer with three deposits of about 0.1 ETH on October 28 and 29. It deployed the smart contract that executed the withdrawals at 17:59 Cyprus time, more than four hours before the drain.

The stablecoin freezes

Decrypt reported that Tether froze 975.1 million USDT and Circle froze 823 million USDC in the main receiving wallet at 21:04 UTC, about $1.8 billion combined. The Block’s summary cited Tether CEO Paolo Ardoino as saying more than 1.567 billion USDT was frozen. PANews counted at least $2.316 billion frozen by 5:22 Beijing time on October 30. The PANews figure came later in the night, and the sources do not reconcile the other differences.

What is still unclear

Binance hasn’t publicly confirmed a breach. Co-founder and Chief Customer Service Officer Yi He wrote on X that the firm is “aware of reports of a potential security issue and we are actively investigating”, and warned users about scams. Decrypt quoted Binance saying it had “not confirmed any impact to user funds.”

Former CEO Changpeng Zhao went further. At 21:15 UTC he posted that “it does look like a hack on Binance” and said user funds are safe. He added that, as a shareholder, he expects all user funds to be fully covered, CryptoTicker reported. None of the cited reports show Binance itself making that commitment so far.

None of the cited sources attributes the incident to a specific group. FinanceFeeds noted that on October 27 Binance said it had blocked several North Korea-linked attacks over the prior week without losses of user assets. The FBI attributed the Bybit theft to North Korean hackers. Any link to this incident is unproven so far. The sources also do not explain how the EIP-7702 delegation on the Binance wallet was authorised.

How markets and analysts reacted

Leveraged traders were hit quickly. About $628 million in leveraged positions were liquidated within an hour, per CryptoTicker. Among the five assets below, BNB posted the steepest 24-hour drop.

Source: CoinGecko. BNB traded between $683.14 and $760.02 over the 24 hours. Decrypt reported that it fell about 7% to roughly $699, while Bitcoin dropped below $79,000. Bitcoin’s 24-hour range ran from $78,475 to $81,840. The Crypto Fear & Greed Index read 51, Neutral, on October 29. Because the index is published daily, it may not yet reflect the evening’s events.

What it means for investors

The main open question is how any confirmed losses would be covered. Readers will want a clear statement from Binance on that point, along with updated exchange proof of reserves reports that show what a platform holds.

Some risks are worth naming plainly:

• Scams often follow hacks, and Yi He has already warned users about them. Fake “refund” or “verification” messages ask for logins or seed phrases. No legitimate exchange asks for a seed phrase.
• Withdrawal delays or pauses can occur during incident response.
• Volatility can stay high while totals are revised, and leveraged traders face liquidation risk.
• Funds held on any centralised platform carry counterparty risk.

This is not a recommendation to buy, sell or move assets. Decisions depend on personal circumstances, and official updates from Binance are the primary source to watch.

Bottom line

On-chain data points to a suspected Binance hack worth up to $5.8 billion, with roughly $1.8 billion to $2.3 billion in stablecoins frozen so far, depending on the tally. Binance hasn’t confirmed losses or a cause. Watch for an official loss figure, any attribution and whether user balances are fully covered, as Zhao expects.

Sources

• Binance investigating hack as suspicious outflows reach up to $5.8 billion (The Block)
• Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 Billion – Decrypt (decrypt.co)
• Binance Hack: $2.8B Drained From Hot Wallet via EIP-7702 (cryptoticker.io)
• Crypto Crash After Binance Hack: The Timeline of the Night (cryptoticker.io)
• Suspected Binance hack: up to $5.6bn drained from the crypto exchange's wallets (www.kiprinform.com)
• Data: Outflows in suspected Binance breach may reach $5.6 billion, involving Bitcoin and Tron (panews.io)
• Suspected Binance Hack Drains $3.3B From Hot Wallets as Tether, Circle Freeze $1.8B (financefeeds.com)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.