Was Binance hacked? What is confirmed on October 29, 2026, and how BNB and Bitcoin moved
Binance had not confirmed a hack as of 6:18 p.m. ET on October 29, 2026, after $2.5 billion to $5.57 billion left its hot wallets by on-chain counts. What Binance, CZ, Tether and Circle said, with times, and what BNB (−4.75%) and Bitcoin (−1.78%) did from the first outflow.
· 10 min read
The short version: As of 6:18 p.m. ET on Thursday, October 29, 2026, Binance had not confirmed a hack. On-chain trackers counted $2.5 billion to $5.57 billion leaving its hot wallets from 4:24 p.m. ET. Binance says it is investigating and that "User funds are completely safe." BNB fell 4.75% from 4:24 p.m.; Bitcoin fell 1.78%.
What is confirmed: money left wallets that block explorers label as Binance's, in transfers researchers flagged within minutes, and the issuers of the USDT and USDC stablecoins froze part of it. Tether froze "more than 1.567B USDT" and Circle "more than 800M USDC", by their CEOs' own posts. What is not: that it was a hack, how much was taken, and whether any customer balance is touched. Changpeng Zhao, who founded Binance and no longer runs it, says it "does look like a hack"; Binance has not said so.
As of 6:18 p.m. ET (22:18 UTC) on October 29, 2026. Times are New York time (UTC−4). This note reads the posts and prices available then; if Binance later says the transfers were its own, the timeline and the prices still stand.
What is confirmed, post by post
Every quote is from the post itself; the time is the post's own timestamp.
| New York time | Who | What they said or did |
|---|---|---|
| 4:24 p.m. | On-chain | The first large transfer leaves Binance hot wallets. Blockaid dates the outflows from "approximately 20:24 UTC"; PANews reads one transaction from the Binance 14 wallet at that minute on Etherscan. |
| 4:32 p.m. | Spreek, an on-chain researcher, on X | "Unconfirmed, but possibly massive binance hack." "Contract call was funded by Tornado Cash." |
| 5:04 p.m. | Circle, on-chain | Circle freezes 823 million USDC in the receiving wallet, at the time Decrypt gives. |
| 5:11 p.m. | Blockaid, a blockchain security firm, on X | The transfers "look consistent with unauthorized movement", but "we cannot yet rule out an internal treasury or operational sweep." |
| 5:15 p.m. | Changpeng Zhao (CZ), Binance's founder, on X | "It does look like a hack on Binance." "I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." |
| 5:16 p.m. | Binance, on X | "Our teams are aware of reports of a potential security issue and are actively investigating. At this stage, we have not confirmed any impact to user funds." |
| 5:18 p.m. | Jeremy Allaire, Circle's CEO, on X | "Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident" |
| 5:25 p.m. | Paolo Ardoino, Tether's CEO, on X | "Tether froze more than 1.567B USDT related to a potential Binance exchange hack." |
| 5:29 p.m. | Binance, on X | The same statement, with one line changed: "User funds are completely safe." |
Read the two Binance rows together: at 5:16 p.m. it had "not confirmed any impact to user funds"; 13 minutes later it said they "are completely safe." Neither post says what happened to the wallets. CZ wrote as a shareholder: "I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." That is his expectation, not Binance's commitment. Binance's co-CEO Yi He posted the first statement too, and thanked Tether and Circle for the freezes. How the wallets were emptied is not known. Decrypt reports that an address funded through Tornado Cash set up an EIP-7702 delegation on a Binance hot wallet minutes before the first transfer, a mechanism that can let later transfers go through without a new signature; Binance has not confirmed it.
How much left Binance: $2.5 billion to $5.57 billion, depending on who counts
No figure comes from Binance. Each count covers different wallets and chains, and some may include Binance moving its own money between its own wallets, which is why they disagree.
| Estimate | Who counted, and when |
|---|---|
| About $2.5 billion on Ethereum from the Binance 14 and Binance 16 wallets, plus 780 million USDC from a Binance smart account | Blockaid, in its X post |
| About $2.5 billion in one transaction from the Binance 14 wallet: about 167,500 ETH, 1.615 billion USDT and more than 60 other tokens | PANews, reading Etherscan |
| $2.77 billion across five blockchains, not named | The Walter Bloomberg account on X, as reported by Coindoo |
| About $3.3 billion from two hot wallets on Ethereum, between 20:24 and 21:04 UTC | Crypto Briefing, at 5:36 p.m. ET |
| About $3.52 billion on Ethereum | Unchained, from its own count, at 5:44 p.m. ET |
| More than $5 billion across 46 addresses | Investigator Emmett Gallic, as reported by Crypto News Flash |
| At least $5.57 billion on Ethereum ($3.51 billion), Bitcoin ($1.44 billion) and Tron ($630 million) | An on-chain tally by @WazzCrypto, reported by Decrypt |
The freezes are counted the same way. Tether's first freeze, cited by CZ at 5:15 p.m., was about $971 million in USDT; Decrypt reads 975.1 million USDT in the main receiving wallet, and by 5:25 p.m. Tether's CEO put it at more than 1.567 billion. Circle's CEO says "more than 800M USDC"; on-chain, 823 million. A freeze stops the tokens from moving. It does not return them, and ether and bitcoin cannot be frozen this way.
What BNB, Bitcoin and Ether did from 4:24 p.m. ET
We measured each coin from its price at 4:24 p.m. ET, the minute of the first outflow, to 6:18 p.m. ET, on Yahoo Finance one-minute bars. BNB, the token of Binance's BNB Chain, fell most of the seven: 4.75%, against 1.78% for Bitcoin.
| Coin | 4:24 p.m. ET | 6:18 p.m. ET | Change | Lowest after 4:24 p.m. | At the low |
|---|---|---|---|---|---|
| BNB | $739.42 | $704.32 | −4.75% | −8.17% | 4:47 p.m. |
| Ether (ETH) | $2,315.76 | $2,265.86 | −2.15% | −3.52% | 4:47 p.m. |
| Solana (SOL) | $99.25 | $97.19 | −2.08% | −4.40% | 4:47 p.m. |
| Bitcoin (BTC) | $80,261.70 | $78,829.50 | −1.78% | −2.47% | 4:47 p.m. |
| XRP | $1.2706 | $1.2492 | −1.68% | −3.66% | 4:47 p.m. |
| Hyperliquid (HYPE) | $93.35 | $92.44 | −0.97% | −3.66% | 4:47 p.m. |
| Monero (XMR) | $598.80 | $615.15 | +2.73% | −0.02% | 4:31 p.m. |
6 of the 7 coins printed their lowest minute at 4:47 p.m. ET, 23 minutes after the first outflow and before any word from Binance or CZ: BNB was then 8.17% under its 4:24 p.m. price. It had won part of that back, to −3.23%, by the time CZ posted at 5:15 p.m., a minute before Binance's first statement.
Monero (XMR), a coin built to hide who pays whom, is the one that rose: +2.73%, and as much as +7.93% at 4:52 p.m. ET. Decrypt notes Monero also rose after a large Bitcoin theft in April 2025. Prices can't tell us who bought it.
Coinbase (COIN), the US-listed crypto exchange, closed at $160.59 at 4:00 p.m. ET, −1.07% on the day, before the first outflow. After hours it traded at $155.30 at 6:17 p.m. ET, −3.29% from that close.
Bitcoin after seven earlier exchange hacks
For scale, we looked at what Bitcoin did after the largest thefts from exchanges since September 2014, on Yahoo Finance daily closes. Each change runs from the close of the UTC day before the theft became public.
| Theft | Day used (UTC) | Taken, as reported | Bitcoin that day | Next day | 7 days | 30 days |
|---|---|---|---|---|---|---|
| Bitfinex | Aug. 2, 2016 | 119,754 BTC stolen | −9.7% | −6.6% | −3.0% | −5.6% |
| Coincheck | Jan. 26, 2018 | about 523 million NEM (about $530 million) | −0.8% | +1.6% | −21.6% | −14.2% |
| Binance | May 7, 2019 | 7,000 BTC (about $40 million) from its BTC hot wallet | +1.4% | +4.1% | +39.1% | +36.1% |
| KuCoin | Sept. 26, 2020 | about $150 million first reported, over $275 million in later counts | +0.5% | +0.8% | −1.3% | +22.3% |
| BSC Token Hub (BNB Chain bridge) | Oct. 6, 2022 | 2 million BNB minted (about $570 million), most frozen on-chain | −1.0% | −3.0% | −3.9% | +5.6% |
| FTX (drained hours after it filed for bankruptcy) | Nov. 12, 2022 | about $477 million | −1.4% | −4.0% | −1.9% | +1.0% |
| Bybit | Feb. 21, 2025 | about $1.5 billion in ether | −2.2% | −1.8% | −14.2% | −12.5% |
Bitcoin closed lower on the day in 5 of the 7, was lower 7 days later in 6, and lower 30 days later in 3. The median 30-day change was +1.0%, against +2.8% for any 30 days since September 2014, when 43.2% of all 30-day windows ended lower. The best month followed Binance's own 2019 theft of 7,000 BTC: +36.1%, in the spring 2019 rally. BNB was −6.0% that day and +41.8% 30 days later.
What the table can't tell: seven events, in markets where Bitcoin went from $606.27 the day before Bitfinex to $98,333.94 the day before Bybit, are a small sample. The FTX drain began on the night of November 11 to 12, 2022, hours after FTX filed for bankruptcy, so its row is the collapse as much as the theft; we used November 12, the UTC day it began. The BSC Token Hub exploit hit Binance's BNB Chain bridge, not an exchange wallet. KuCoin dated the first withdrawals 03:05 on September 26, 2020, UTC+8 (19:05 UTC on the 25th), and disclosed them on the 26th, the day we used. Yahoo's BTC-USD series starts on Sept. 17, 2014, so Mt. Gox, in February 2014, is not in it.
If you keep crypto on an exchange
A coin on an exchange is a claim on the exchange. Binance paid back the 7,000 BTC of 2019 from SAFU, its reserve fund for users, as Crypto News Flash recalls; on October 29 Binance said user funds are safe, and CZ expects any loss covered. Neither is a figure yet. Holding the same coin on an exchange and through a US-listed fund is one bet in two places: is my portfolio diversified? works through it. Earlier the same day, HYPE moved on a different headline: why Hyperliquid is up on the ICE deal.
To see a Binance balance next to your stocks and ETFs, Portfolio Terminal reads the account with a read-only API key, and refuses any key that can trade, withdraw or move money between accounts. The key is used for that one read and never stored. Add a crypto account, or see a filled-in portfolio first. The free portfolio X-ray shows how much of your money sits in crypto, and the crash test replays past crashes on your own holdings.
Where the numbers come from
Prices are Yahoo Finance spot quotes (BTC-USD, ETH-USD, BNB-USD, SOL-USD, XRP-USD, HYPE32196-USD, XMR-USD), one-minute bars in UTC, read at 6:18 p.m. ET. Each coin starts at the opening price of the 20:24 UTC minute; Monero printed no bar that minute, so it starts at the close of the last bar before it. Coinbase is measured from its 4:00 p.m. close to its after-hours price. Post times are read off each post's id, which carries its timestamp, and every quote was checked against the post's text. The earlier thefts use the day each became public, from the source linked in its row. The amounts that left Binance and the amounts frozen are the counts of the outlets and firms named, not ours.
This note explains a market event as it happened. It is not investment advice.
Sources: Binance on X, 5:16 p.m. ET · Binance on X, 5:29 p.m. ET · Changpeng Zhao on X · Jeremy Allaire on X · Paolo Ardoino on X · Blockaid on X · Decrypt · PANews · Unchained · Crypto Briefing · Crypto News Flash · Coindoo · Yahoo Finance, BTC-USD
Follow the market around it, updated every session: S&P 500 today · Nasdaq Composite today.
#market-news#crypto
Keep reading
cite: Julien Esnault, “Was Binance hacked? What is confirmed on October 29, 2026, and how BNB and Bitcoin moved”, Portfolio Terminal, 2026-10-29. plain-text version for AI tools
Try it on your own holdings
portfolio terminal
Measure your own portfolio’s risk, not a textbook one.
Import your positions from any broker and see your volatility, beta, drawdown and correlations every morning.
Wall Street in 60s, every morning. What’s in it
One short email before the open. Unsubscribe anytime.