Binance Hack: Wallets Drained, Losses Covered by Exchange

The world’s largest cryptocurrency exchange, Binance, has confirmed a security incident after large amounts of cryptocurrency flowed out of its internet-connected “hot wallets” on Thursday, October 29. Early estimates describe it as possibly the largest crypto theft on record, but the exact amount taken is still disputed — estimates run from about $1.7 billion to more than $6 billion — and Binance says it will cover all customer losses. Here is what is confirmed, what is still unclear, and what it means for ordinary users.

What happened

On Thursday afternoon, blockchain tracking firms spotted unusually large outflows from wallets linked to Binance. According to CoinDesk’s review of blockchain records, the wallet known as “Binance 14” moved 167,464 ether at 4:24 p.m. ET (20:24 UTC), followed by 28,005.6 ether from a second wallet, “Binance 16.” About 15 minutes later, roughly 195,460 ether, worth around $442 million at the time, was sent on to a second address. Blockchain explorer Etherscan labeled one receiving address the “Binance Hot Wallet Attacker.”

Binance confirmed the incident the same evening. In a statement emailed to TechCrunch, the company said it was “aware of reports of a potential security issue and [is] actively investigating.” Binance also said it had temporarily suspended withdrawals on multiple networks as a safety step, and that withdrawals would resume once the security issue is resolved.

Binance co-CEO Yi He said on X that Binance will cover “all hacking losses” and that user funds are safe. Binance founder Changpeng Zhao, who no longer runs the company, also posted about the incident on X.

What we know and what we don’t know

What we know:

• Binance confirmed a security incident on October 29, 2026, and suspended withdrawals on multiple networks as a precaution.
• Large amounts of cryptocurrency left Binance-linked hot wallets on Thursday afternoon, starting at about 4:24 p.m. ET.
• Binance says it will cover all hacking losses, and its co-CEO says user funds are safe.
• Stablecoin issuers have frozen a large share of the stolen stablecoins: Binance put the verified freeze total at $2.54 billion, including more than $1.567 billion in USDT frozen by Tether and about $800 million in USDC frozen by Circle.
• Binance.US, a separate exchange, said it was not affected by the incident.
• Crypto prices fell after the news broke: bitcoin dropped about 4.8% to near $77,000, and ether fell about 5.7% to around $2,215.

What we don’t know:

• The exact confirmed amount stolen. Estimates from different trackers range widely, and Binance has not yet published its own confirmed loss figure.
• How the attacker gained control of the wallets. CoinDesk reported the attack used an Ethereum feature called EIP-7702, which lets a wallet hand control to a piece of software, but Binance has not yet confirmed the full method.
• Whether the incident is fully contained, or whether more funds could still move.
• When withdrawals will fully resume.
• Who carried out the attack. CNN reported on October 30 that investigators believe the attackers first compromised a Binance engineer’s laptop, and blockchain firm TRM Labs has pointed to North Korea — but that is investigators’ claim, not a confirmed finding by Binance or US law enforcement, and the FBI and Secret Service had not commented in the latest reports.

How big is the loss? The numbers disagree

This is the most confusing part of the story, and readers should be careful about any single number shared on social media. Different trackers count different things: some count everything that left the wallets, some count what sits in attacker-linked wallets now, and some count only what they can confirm as stolen.

Here is the range reported so far:

• CNN, reporting on October 30, put the amount stolen at more than $6 billion — the highest estimate so far.
• Arkham Intelligence, a blockchain analytics firm, put the assets held in attacker-linked wallets at about $5.84 billion.
• Chainalysis said it was updating its estimate to roughly $5.9 billion in value at the time of the theft.
• Coinbase executive Conor Grogan estimated total outflows of up to $5.8 billion.
• Analyst Spreek traced about $3.55 billion moving through a single attacker wallet.
• The Wall Street Journal reported that at least $1.7 billion was stolen.
• TechCrunch reported that watchers believed at least $2 billion had been drained, while noting the numbers were unconfirmed and the theft was possibly still ongoing.

The honest summary is this: somewhere between about $1.7 billion and more than $6 billion, depending on who is counting and what they count. Until Binance publishes its own confirmed figure, no single number should be treated as final. The earlier same-day reports of “about $2.77 billion in outflows” from Binance-linked wallets, which circulated before Binance confirmed the incident, are part of this same fast-moving picture and were labeled unconfirmed at the time.

How the attack reportedly worked

CoinDesk’s analysis of Binance’s own proof-of-reserves data adds an important detail. Binance publishes a monthly list of the wallets it controls and compares those totals with what customers hold. Its October 1 report included the “Binance 14” wallet, which held 1.26 billion USDT and 89,475 ether at that time, among 37 assets.

According to CoinDesk, the attacker used the EIP-7702 feature to turn Binance 14 into a “sweeper” that forwarded incoming funds to the attacker’s address after getting the wallet’s key to sign a permission. CoinDesk estimated that the roughly 204,500 ether taken represents about 5.6% of Binance’s ether reserves, which would leave ether backing near 94% based on the October 1 snapshot. Binance’s next reserves snapshot is due November 1, and it should show whether the missing assets have already been replaced.

It is important to be clear about what this does and does not prove. The reserves analysis shows which wallets were involved and how much they held a month ago. It does not by itself prove how the attacker obtained the signing permission, and Binance has not yet published its own account of the method.

What has been frozen so far

One reason the final loss may end up smaller than the largest estimates is that stablecoin issuers can freeze some stolen funds. Binance said the total verified freeze amount stood at $2.54 billion and was still growing as it worked with law enforcement, token issuers, and blockchain intelligence firms.

The breakdown reported so far:

• Tether froze more than $1.567 billion in USDT linked to the incident.
• Circle froze about $800 million to $823 million in USDC.
• Ripple froze roughly $200 million.
• World Liberty Financial, a crypto company linked to President Donald Trump and his family, said it worked with custodian BitGo to freeze about $27 million in its USD1 stablecoin and about $2 million worth of its own tokens.

Reuters reported the overall frozen total as $3 billion, including the Tether and Circle freezes — the figure CNN’s October 30 reporting also pointed to. Not all stolen assets can be frozen this way: bitcoin and ether moved into regular wallets cannot be frozen by an issuer, and the attacker has already moved funds through decentralized exchanges and lending platforms, according to Arkham data cited by CoinDesk.

Binance also has a user protection fund called SAFU, created in 2018, which CoinDesk reported holds around $1 billion in bitcoin. That fund could help offset losses, though Binance has said it will cover hacking losses directly.

Why prices fell

Crypto markets reacted quickly. Bitcoin fell 4.8% to near $77,000, and ether fell 5.7% to about $2,215, according to CoinDesk’s market data. BigGo Finance reported about $628 million in derivatives positions were liquidated within an hour as hack suspicions spread.

That reaction is not surprising: Binance is the world’s largest crypto exchange by trading volume, with more than 300 million registered users and about $160 billion in assets under custody, according to its 2024 annual report as cited by Reuters. When the biggest exchange in the market pauses withdrawals, traders rush to reduce risk, and that selling pushes prices down.

This article does not offer investment advice and does not predict where prices will go next. Prices in crypto markets can move sharply on incomplete news, and the figures in this story are still changing.

A second, separate incident the same day

Readers may also have seen news about Polymarket, a prediction market platform, halting trading earlier on Thursday. That was a separate incident involving a third-party provider, not Binance. Reuters and CoinDesk both treated the two events as unrelated, and Polymarket said its own issue was resolved the same day. Mixing the two stories together would give a misleading picture of what happened at Binance.

What Binance users should do now

Binance has said withdrawals are temporarily suspended on multiple networks and will resume after security checks are complete. Users should follow only Binance’s official channels for updates on when withdrawals reopen, and should be extra careful about scam messages: after a major hack, fake support accounts often appear offering to “recover” funds. No legitimate support team will ask for your password or your private recovery phrase.

If you use Binance, check your account only through the official app or website you normally use, not through links in unsolicited messages. If you notice any transaction you did not make, report it through Binance’s official support channels and keep a record of the details.

What to watch next

Several updates could change this story quickly:

1. Binance’s own confirmed loss figure and its account of how the attack happened.
2. Whether withdrawals resume, and on which networks first.
3. The November 1 proof-of-reserves snapshot, which should show whether missing assets have been replaced.
4. Further freezes by issuers, or movement of the remaining funds through exchanges that cannot freeze them.
5. Any statement from law enforcement about the investigation or the attacker.

This is a developing story. The figures above reflect reporting available as of October 30, 2026, and they will be updated as Binance and investigators publish more information.

Related coverage: DoorDash to Buy Instacart for $17 Billion · Google’s Genie 4 World Model Explained: What It Does · Apple M6 MacBook Pro and iMac: Preorders Open, Ships Nov 6

Sources

• CoinDesk, “Binance loses $5.7 billion in largest crypto hack to date” (October 29, 2026, updated 9:03 p.m. EDT) and “Binance says customer money is safe after huge hack drains key reserve wallets” (October 29, 2026, 8:17 p.m. EDT)
• CNN, reporting on the Binance theft investigation (October 30, 2026) — updated loss and freeze estimates, engineer-laptop detail, TRM Labs attribution
• Reuters, via NorthJersey, “Binance freezes $3 billion in assets as it probes hacking incident” (October 29, 2026)
• TechCrunch, “Binance pauses withdrawals as hackers suspected of stealing billions in crypto” (October 29, 2026)
• BigGo Finance, “approximately $5.8 Billion Drained from Binance Hot Wallets” (October 29, 2026)
• Binance statements on X and to TechCrunch, as quoted by CoinDesk, Reuters, and TechCrunch; Binance.US statement that it was not affected, as reported by Reuters

Note on sourcing: Binance’s company statements are quoted here as reported by Reuters, CoinDesk, and TechCrunch. Loss figures differ across trackers and are presented as a range, not a single confirmed total, because Binance had not published its own confirmed figure at the time of writing. The claim that North Korea was likely behind the attack comes from blockchain investigators, not from Binance or law enforcement, and is labeled as a claim in this article.