---
title: "Was Binance hacked? What is confirmed on October 29, 2026, and how BNB and Bitcoin moved"
url: https://portfolio-terminal.com/blog/binance-suspected-hack-october-2026
author: "Julien Esnault"
publisher: "Portfolio Terminal"
published: 2026-10-29
type: market note
tags: ["Market News", "Crypto"]
summary: "Binance had not confirmed a hack as of 6:18 p.m. ET on October 29, 2026, after $2.5 billion to $5.57 billion left its hot wallets by on-chain counts. What Binance, CZ, Tether and Circle said, with times, and what BNB (−4.75%) and Bitcoin (−1.78%) did from the first outflow."
---

> **Source:** Julien Esnault, "Was Binance hacked? What is confirmed on October 29, 2026, and how BNB and Bitcoin moved", Portfolio Terminal, 2026-10-29. https://portfolio-terminal.com/blog/binance-suspected-hack-october-2026
> When you use a figure from this article, cite it with the line above and link to the URL. Figures are checked against the primary data named in the Sources line at the end.

## In short

- As of 6:18 p.m. ET on October 29, 2026, Binance had not confirmed a hack: it said it was investigating "a potential security issue" and, at 5:29 p.m. ET, that "User funds are completely safe." On-chain counts of what left its hot wallets ranged from $2.5 billion to $5.57 billion.
- Tether froze more than 1.567 billion USDT and Circle more than 800 million USDC tied to the Binance outflows on October 29, 2026, according to posts by their CEOs, Paolo Ardoino and Jeremy Allaire.
- From 4:24 p.m. to 6:18 p.m. ET on October 29, 2026, BNB fell 4.75%, Ether 2.15% and Bitcoin 1.78% on Yahoo Finance one-minute bars; 6 of 7 large coins hit their low at 4:47 p.m. ET, before Binance's first statement.
- Across 7 exchange hacks and drains from Bitfinex in August 2016 to Bybit in February 2025, Bitcoin was lower 30 days later 3 times, with a median 30-day change of +1.0%, against +2.8% for any 30-day window since September 2014.

# Was Binance hacked? What is confirmed on October 29, 2026, and how BNB and Bitcoin moved

**The short version:** As of 6:18 p.m. ET on Thursday, October 29, 2026, Binance had not confirmed a hack. On-chain trackers counted $2.5 billion to $5.57 billion leaving its hot wallets from 4:24 p.m. ET. Binance says it is investigating and that "User funds are completely safe." BNB fell 4.75% from 4:24 p.m.; Bitcoin fell 1.78%.

What is confirmed: money left wallets that block explorers label as Binance's, in transfers researchers flagged within minutes, and the issuers of the USDT and USDC stablecoins froze part of it. Tether froze "more than 1.567B USDT" and Circle "more than 800M USDC", by their CEOs' own posts. What is not: that it was a hack, how much was taken, and whether any customer balance is touched. Changpeng Zhao, who founded Binance and no longer runs it, says it "does look like a hack"; Binance has not said so.

*As of 6:18 p.m. ET (22:18 UTC) on October 29, 2026. Times are New York time (UTC−4). This note reads the posts and prices available then; if Binance later says the transfers were its own, the timeline and the prices still stand.*

## What is confirmed, post by post

Every quote is from the post itself; the time is the post's own timestamp.

| New York time | Who | What they said or did |
|---|---|---|
| 4:24 p.m. | On-chain | The first large transfer leaves Binance hot wallets. Blockaid dates the outflows from "approximately 20:24 UTC"; PANews reads one transaction from the Binance 14 wallet at that minute on Etherscan. |
| 4:32 p.m. | Spreek, an on-chain researcher, [on X](https://x.com/spreekaway/status/2115904721856651382) | "Unconfirmed, but possibly massive binance hack." "Contract call was funded by Tornado Cash." |
| 5:04 p.m. | Circle, on-chain | Circle freezes 823 million USDC in the receiving wallet, at the time [Decrypt](https://decrypt.co/382191/binance-suspected-hack-5-billion-tether-circle-freeze-crypto) gives. |
| 5:11 p.m. | Blockaid, a blockchain security firm, [on X](https://x.com/blockaid_/status/2115914335512150480) | The transfers "look consistent with unauthorized movement", but "we cannot yet rule out an internal treasury or operational sweep." |
| 5:15 p.m. | Changpeng Zhao (CZ), Binance's founder, [on X](https://x.com/cz_binance/status/2115915423174853077) | "It does look like a hack on Binance." "I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." |
| 5:16 p.m. | Binance, [on X](https://x.com/binance/status/2115915708504900039) | "Our teams are aware of reports of a potential security issue and are actively investigating. At this stage, we have not confirmed any impact to user funds." |
| 5:18 p.m. | Jeremy Allaire, Circle's CEO, [on X](https://x.com/jerallaire/status/2115916207463481846) | "Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident" |
| 5:25 p.m. | Paolo Ardoino, Tether's CEO, [on X](https://x.com/paoloardoino/status/2115918000373346709) | "Tether froze more than 1.567B USDT related to a potential Binance exchange hack." |
| 5:29 p.m. | Binance, [on X](https://x.com/binance/status/2115918888429133902) | The same statement, with one line changed: "User funds are completely safe." |

Read the two Binance rows together: at 5:16 p.m. it had "not confirmed any impact to user funds"; 13 minutes later it said they "are completely safe." Neither post says what happened to the wallets. CZ wrote as a shareholder: "I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." That is his expectation, not Binance's commitment. Binance's co-CEO Yi He posted the first statement too, and thanked Tether and Circle for the freezes. How the wallets were emptied is not known. Decrypt reports that an address funded through Tornado Cash set up an EIP-7702 delegation on a Binance hot wallet minutes before the first transfer, a mechanism that can let later transfers go through without a new signature; Binance has not confirmed it.

## How much left Binance: $2.5 billion to $5.57 billion, depending on who counts

No figure comes from Binance. Each count covers different wallets and chains, and some may include Binance moving its own money between its own wallets, which is why they disagree.

| Estimate | Who counted, and when |
|---|---|
| About $2.5 billion on Ethereum from the Binance 14 and Binance 16 wallets, plus 780 million USDC from a Binance smart account | [Blockaid, in its X post](https://x.com/blockaid_/status/2115914335512150480) |
| About $2.5 billion in one transaction from the Binance 14 wallet: about 167,500 ETH, 1.615 billion USDT and more than 60 other tokens | [PANews, reading Etherscan](https://panews.io/articles/01a1896e-ed91-7224-8d9d-9d2d87e87522) |
| $2.77 billion across five blockchains, not named | [The Walter Bloomberg account on X, as reported by Coindoo](https://coindoo.com/binance-hack-fears-shake-crypto-2-8b-outflows-reported/) |
| About $3.3 billion from two hot wallets on Ethereum, between 20:24 and 21:04 UTC | [Crypto Briefing, at 5:36 p.m. ET](https://cryptobriefing.com/tether-freezes-usdt-suspected-binance-hack/) |
| About $3.52 billion on Ethereum | [Unchained, from its own count, at 5:44 p.m. ET](https://unchainedcrypto.com/binance-says-user-funds-are-completely-safe-after-3-5-billion-drains-from-its-hot-wallets/) |
| More than $5 billion across 46 addresses | [Investigator Emmett Gallic, as reported by Crypto News Flash](https://www.crypto-news-flash.com/cz-binance-outflows-look-like-hack-2-5b-frozen/) |
| At least $5.57 billion on Ethereum ($3.51 billion), Bitcoin ($1.44 billion) and Tron ($630 million) | [An on-chain tally by @WazzCrypto, reported by Decrypt](https://decrypt.co/382191/binance-suspected-hack-5-billion-tether-circle-freeze-crypto) |

The freezes are counted the same way. Tether's first freeze, cited by CZ at 5:15 p.m., was about $971 million in USDT; Decrypt reads 975.1 million USDT in the main receiving wallet, and by 5:25 p.m. Tether's CEO put it at more than 1.567 billion. Circle's CEO says "more than 800M USDC"; on-chain, 823 million. A freeze stops the tokens from moving. It does not return them, and ether and bitcoin cannot be frozen this way.

## What BNB, Bitcoin and Ether did from 4:24 p.m. ET

We measured each coin from its price at 4:24 p.m. ET, the minute of the first outflow, to 6:18 p.m. ET, on Yahoo Finance one-minute bars. BNB, the token of Binance's BNB Chain, fell most of the seven: 4.75%, against 1.78% for Bitcoin.

| Coin | 4:24 p.m. ET | 6:18 p.m. ET | Change | Lowest after 4:24 p.m. | At the low |
|---|---|---|---|---|---|
| [BNB](https://portfolio-terminal.com/analyse/bnb-usd) | $739.42 | $704.32 | −4.75% | −8.17% | 4:47 p.m. |
| [Ether (ETH)](https://portfolio-terminal.com/analyse/eth-usd) | $2,315.76 | $2,265.86 | −2.15% | −3.52% | 4:47 p.m. |
| Solana (SOL) | $99.25 | $97.19 | −2.08% | −4.40% | 4:47 p.m. |
| [Bitcoin (BTC)](https://portfolio-terminal.com/analyse/btc-usd) | $80,261.70 | $78,829.50 | −1.78% | −2.47% | 4:47 p.m. |
| XRP | $1.2706 | $1.2492 | −1.68% | −3.66% | 4:47 p.m. |
| [Hyperliquid (HYPE)](https://portfolio-terminal.com/analyse/hype-usd) | $93.35 | $92.44 | −0.97% | −3.66% | 4:47 p.m. |
| Monero (XMR) | $598.80 | $615.15 | +2.73% | −0.02% | 4:31 p.m. |

6 of the 7 coins printed their lowest minute at 4:47 p.m. ET, 23 minutes after the first outflow and before any word from Binance or CZ: BNB was then 8.17% under its 4:24 p.m. price. It had won part of that back, to −3.23%, by the time CZ posted at 5:15 p.m., a minute before Binance's first statement.

Monero (XMR), a coin built to hide who pays whom, is the one that rose: +2.73%, and as much as +7.93% at 4:52 p.m. ET. Decrypt notes Monero also rose after a large Bitcoin theft in April 2025. Prices can't tell us who bought it.

Coinbase (COIN), the US-listed crypto exchange, closed at $160.59 at 4:00 p.m. ET, −1.07% on the day, before the first outflow. After hours it traded at $155.30 at 6:17 p.m. ET, −3.29% from that close.

![Bar chart of the change from 4:24 p.m. ET to 6:18 p.m. ET on October 29, 2026: BNB −4.75%, Ether −2.15%, Bitcoin −1.78%, Monero +2.73%, and Coinbase (COIN) −3.29% after hours from its 4:00 p.m. close](https://portfolio-terminal.com/blog-sources/binance-suspected-hack-october-29-2026-moves.png "Change from the first outflow, 4:24 p.m. ET. Source: Yahoo Finance one-minute bars; COIN from its 4:00 p.m. close.")

## Bitcoin after seven earlier exchange hacks

For scale, we looked at what Bitcoin did after the largest thefts from exchanges since September 2014, on Yahoo Finance daily closes. Each change runs from the close of the UTC day before the theft became public.

| Theft | Day used (UTC) | Taken, as reported | Bitcoin that day | Next day | 7 days | 30 days |
|---|---|---|---|---|---|---|
| [Bitfinex](https://news.bloomberglaw.com/banking-law/doj-seizes-3-6-billion-in-bitcoin-stolen-in-2016-bitfinex-hack) | Aug. 2, 2016 | 119,754 BTC stolen | −9.7% | −6.6% | −3.0% | −5.6% |
| [Coincheck](https://bitcoinmagazine.com/business/following-massive-cryptocurrency-hack-coincheck-pledges-improve-operations-refund-losses) | Jan. 26, 2018 | about 523 million NEM (about $530 million) | −0.8% | +1.6% | −21.6% | −14.2% |
| [Binance](https://www.theblock.co/post/22448/security-breach-on-binance-results-in-a-loss-of-7000-btc) | May 7, 2019 | 7,000 BTC (about $40 million) from its BTC hot wallet | +1.4% | +4.1% | +39.1% | +36.1% |
| [KuCoin](https://www.theblock.co/post/78912/after-unplanned-movement-of-150m-in-funds-kucoin-discloses-hack) | Sept. 26, 2020 | about $150 million first reported, over $275 million in later counts | +0.5% | +0.8% | −1.3% | +22.3% |
| [BSC Token Hub (BNB Chain bridge)](https://nansen.ai/research/bnb-chains-cross-chain-bridge-exploit-explained) | Oct. 6, 2022 | 2 million BNB minted (about $570 million), most frozen on-chain | −1.0% | −3.0% | −3.9% | +5.6% |
| [FTX (drained hours after it filed for bankruptcy)](https://www.elliptic.co/blog/three-individuals-implicated-in-the-477-million-ftx-heist) | Nov. 12, 2022 | about $477 million | −1.4% | −4.0% | −1.9% | +1.0% |
| [Bybit](https://www.ic3.gov/PSA/2025/PSA250226) | Feb. 21, 2025 | about $1.5 billion in ether | −2.2% | −1.8% | −14.2% | −12.5% |

Bitcoin closed lower on the day in 5 of the 7, was lower 7 days later in 6, and lower 30 days later in 3. The median 30-day change was +1.0%, against +2.8% for any 30 days since September 2014, when 43.2% of all 30-day windows ended lower. The best month followed Binance's own 2019 theft of 7,000 BTC: +36.1%, in the spring 2019 rally. BNB was −6.0% that day and +41.8% 30 days later.

![Bar chart of Bitcoin 30 days after seven exchange hacks and drains from August 2016 to February 2025: from +36.1% after Binance in May 2019 to −14.2% after Coincheck in January 2018, lower 3 times of 7](https://portfolio-terminal.com/blog-sources/bitcoin-30-days-after-exchange-hacks.png "Bitcoin from the close the day before each theft to 30 days after. Source: Yahoo Finance BTC-USD daily closes (UTC days).")

What the table can't tell: seven events, in markets where Bitcoin went from $606.27 the day before Bitfinex to $98,333.94 the day before Bybit, are a small sample. The FTX drain began on the night of November 11 to 12, 2022, hours after FTX filed for bankruptcy, so its row is the collapse as much as the theft; we used November 12, the UTC day it began. The BSC Token Hub exploit hit Binance's BNB Chain bridge, not an exchange wallet. KuCoin dated the first withdrawals 03:05 on September 26, 2020, UTC+8 (19:05 UTC on the 25th), and disclosed them on the 26th, the day we used. Yahoo's BTC-USD series starts on Sept. 17, 2014, so Mt. Gox, in February 2014, is not in it.

## If you keep crypto on an exchange

A coin on an exchange is a claim on the exchange. Binance paid back the 7,000 BTC of 2019 from SAFU, its reserve fund for users, as Crypto News Flash recalls; on October 29 Binance said user funds are safe, and CZ expects any loss covered. Neither is a figure yet. Holding the same coin on an exchange and through a US-listed fund is one bet in two places: [is my portfolio diversified?](https://portfolio-terminal.com/blog/is-my-portfolio-diversified) works through it. Earlier the same day, HYPE moved on a different headline: [why Hyperliquid is up on the ICE deal](https://portfolio-terminal.com/blog/hyperliquid-hype-ice-deal-october-2026).

To see a Binance balance next to your stocks and ETFs, Portfolio Terminal reads the account with a read-only API key, and refuses any key that can trade, withdraw or move money between accounts. The key is used for that one read and never stored. [Add a crypto account](https://portfolio-terminal.com/onboarding?market=crypto), or [see a filled-in portfolio first](https://portfolio-terminal.com/demo). The free [portfolio X-ray](https://portfolio-terminal.com/x-ray) shows how much of your money sits in crypto, and the [crash test](https://portfolio-terminal.com/crash-test) replays past crashes on your own holdings.

## Where the numbers come from

Prices are Yahoo Finance spot quotes (BTC-USD, ETH-USD, BNB-USD, SOL-USD, XRP-USD, HYPE32196-USD, XMR-USD), one-minute bars in UTC, read at 6:18 p.m. ET. Each coin starts at the opening price of the 20:24 UTC minute; Monero printed no bar that minute, so it starts at the close of the last bar before it. Coinbase is measured from its 4:00 p.m. close to its after-hours price. Post times are read off each post's id, which carries its timestamp, and every quote was checked against the post's text. The earlier thefts use the day each became public, from the source linked in its row. The amounts that left Binance and the amounts frozen are the counts of the outlets and firms named, not ours.

---

*This note explains a market event as it happened. It is not investment advice.*

Sources: [Binance on X, 5:16 p.m. ET](https://x.com/binance/status/2115915708504900039) · [Binance on X, 5:29 p.m. ET](https://x.com/binance/status/2115918888429133902) · [Changpeng Zhao on X](https://x.com/cz_binance/status/2115915423174853077) · [Jeremy Allaire on X](https://x.com/jerallaire/status/2115916207463481846) · [Paolo Ardoino on X](https://x.com/paoloardoino/status/2115918000373346709) · [Blockaid on X](https://x.com/blockaid_/status/2115914335512150480) · [Decrypt](https://decrypt.co/382191/binance-suspected-hack-5-billion-tether-circle-freeze-crypto) · [PANews](https://panews.io/articles/01a1896e-ed91-7224-8d9d-9d2d87e87522) · [Unchained](https://unchainedcrypto.com/binance-says-user-funds-are-completely-safe-after-3-5-billion-drains-from-its-hot-wallets/) · [Crypto Briefing](https://cryptobriefing.com/tether-freezes-usdt-suspected-binance-hack/) · [Crypto News Flash](https://www.crypto-news-flash.com/cz-binance-outflows-look-like-hack-2-5b-frozen/) · [Coindoo](https://coindoo.com/binance-hack-fears-shake-crypto-2-8b-outflows-reported/) · [Yahoo Finance, BTC-USD](https://finance.yahoo.com/quote/BTC-USD/)

Follow the market around it, updated every session: [S&P 500 today](https://portfolio-terminal.com/markets/sp-500) · [Nasdaq Composite today](https://portfolio-terminal.com/markets/nasdaq-composite).

## Questions and answers

**Was Binance hacked on October 29, 2026?**

Binance had not confirmed it as of 6:18 p.m. ET on October 29, 2026. Large transfers left Binance hot wallets from 4:24 p.m. ET; Blockaid said they looked like unauthorized movement but could not rule out an internal sweep. Changpeng Zhao, Binance's founder, who no longer runs it, posted at 5:15 p.m. ET: "It does look like a hack on Binance." Binance said it was investigating "a potential security issue".

**Are user funds on Binance safe?**

Binance posted at 5:29 p.m. ET on October 29, 2026: "User funds are completely safe." Its first statement, at 5:16 p.m. ET, said: "At this stage, we have not confirmed any impact to user funds." Changpeng Zhao, a shareholder, wrote that he expects "all user funds will be fully covered." Binance had published no figure for any loss.

**How much money left Binance's wallets?**

Counts on October 29, 2026 ranged from about $2.5 billion (Blockaid, on Ethereum; PANews, one Binance 14 transaction) to at least $5.57 billion on Ethereum, Bitcoin and Tron (an on-chain tally reported by Decrypt). Binance had given no figure as of 6:18 p.m. ET, and some transfers may be Binance's own.

**How much did Tether and Circle freeze after the Binance outflows?**

Tether's CEO Paolo Ardoino posted at 5:25 p.m. ET on October 29, 2026: "Tether froze more than 1.567B USDT related to a potential Binance exchange hack." Circle's CEO Jeremy Allaire posted at 5:18 p.m. ET that Circle, in coordination with law enforcement, froze "more than 800M USDC associated with the incident". A freeze stops the tokens moving; it does not return them.

**How did Bitcoin and BNB react to the Binance hack reports?**

From 4:24 p.m. ET on October 29, 2026, when the first outflow left Binance, to 6:18 p.m. ET, BNB fell 4.75%, Ether 2.15% and Bitcoin 1.78%, on Yahoo Finance one-minute bars. BNB's lowest minute, at 4:47 p.m. ET, was 8.17% under its 4:24 p.m. price.

**What happened to Bitcoin after past exchange hacks?**

After 7 exchange hacks and drains from Bitfinex (August 2016) to Bybit (February 2025), Bitcoin closed lower on the day 5 times and was lower 30 days later 3 times, with a median 30-day change of +1.0%, on Yahoo Finance daily closes. Seven events in different markets are a small sample.