In this article5 sections
Wallets linked to Binance moved an estimated $5.8 billion to $5.9 billion in a suspected security breach on October 29, 2026, according to U.Today, with Tether and Circle freezing more than $2.5 billion in stablecoins as the market sold off. Former Binance CEO Changpeng Zhao, who remains a shareholder, wrote that it did look like a hack but that customer funds were safe.
The shape of the event echoed earlier exchange failures in scale, but not in outcome: unlike past incidents where stolen assets moved freely, a large share of the proceeds was halted within hours by stablecoin issuers acting alongside law enforcement.
Also readCircle Sold Binance $100M in Shares Under Five-Year USDC Deal
Key facts
- Blockchain analytics firm Glassnode tracked initial suspicious transfers worth $5.3 billion, including about $1.66 billion in USDT, 17,985 BTC valued near $1.45 billion, and $767 million in USDC, with XRP moving first, then SOL, BTC and others.
- Coinbase senior director Conor Grogan put the outflow at $5.8 billion, while U.Today cited total suspicious outflows close to $5.9 billion; Glassnode reported that Binance’s BNB balance was untouched.
- Tether froze more than 1.567 billion USDT, per CEO Paolo Ardoino, and Circle froze over $800 million in USDC in coordination with law enforcement, per CEO Jeremy Allaire; Binance later said total frozen assets reached $2.54 billion.
- Zhao said he expected all user funds to be fully covered, and wrote in a post on X that the figure could rise beyond an analyst estimate of about $1 billion in remaining exposure.
- If the highest estimates hold, the incident is the largest crypto hack on record, ahead of the roughly $1.5 billion Bybit loss in February 2025 that was linked to North Korean hackers.
How the reports differ
The accounts disagree on totals and on confirmation. Coinpedia reported that Binance confirmed it was hacked, citing a forensic analysis by security firm Blockaid that identified two hot wallets, “Binance 14” and “Binance 16,” and listed $1.6 billion in USDT, $62.6 million in RLUSD, $450 million in ETH, $800 million in USDC, 6.19 million UNI and 2.26 million LINK among the assets taken. Bitcoin Magazine, by contrast, noted that Binance had made no official confirmation of a breach at the time of its report, and quoted co-founder Yi He saying the company was aware of reports of a potential security issue and was investigating.
Bitcoin Magazine also reported Blockaid as investigating $3.3 billion in suspicious outflows from Binance hot wallets across Ethereum, Arbitrum and Avalanche, and said researcher Spreek flagged the activity, which reportedly included a transfer through a contract call allegedly funded by Tornado Cash. Coinpedia described the pattern as a hot wallet key compromise similar to a recent attack on Bitget, pointing to DPRK actors.
Also readBlumenthal Report: 84% of 846 Iran-Linked Wallets Used USDT
On the size of the freezes, Bitcoin Magazine put the combined total at roughly $1.8 billion to $2.4 billion depending on reports, while Binance’s later update put it at $2.54 billion. Coinpedia estimated the unrecoverable amount at about $3.5 billion.
Market reaction
Bitcoin slid below $79,000 as the reports spread. Bitcoin Magazine recorded a 24-hour low of $78,177.37 after a high of $81,890 around midday, with trading volume of about $26.14 billion and a market cap near $1.58 trillion. Coinpedia said 3.13% of the total crypto market cap was wiped out, leaving $2.63 trillion.
Altcoins took heavier losses in Coinpedia’s figures: XRP fell 6.03% to $1.24, BNB dropped 7.13% to $702.54, UNI lost 13.19%, LINK 7.59%, Ethena 14.4%, Pepe 11.41% and Aave 10.4%. Aave froze its lending markets to stop the suspected attacker from borrowing unfreezable assets, according to both Coinpedia and Bitcoin Magazine.
Both Binance.US and Bybit said their platforms were unaffected, with Bybit stating that trading and withdrawals remained available.
Why it matters
The episode tests whether stablecoin issuers can act as a de facto circuit breaker for stolen funds, and how quickly. A large share of the assets was stopped before it could be laundered, which changes the economics of exchange-level theft compared with earlier cases. Holders of assets deposited on Binance, and users of DeFi markets that touch the exchange’s flows, face the most immediate exposure while the total loss figure is still being revised.
What to watch
Binance has said the investigation is ongoing and that the frozen total could rise, so the next marker is the exchange’s formal account of the cause and the final reconciled loss figure. Neither Binance nor law enforcement had released a formal explanation as of the reports.
This article reports market figures from October 29, 2026. Crypto prices are volatile and this is not financial advice.
Sources: U.Today, Bitcoin Magazine, Coinpedia
