Binance Suspected Hack: Billions Drained From Hot Wallets as Withdrawals Suspended

By TaazaPulse News Desk · Published: 30 October 2026 · TaazaPulse News Desk

Binance, the world's largest cryptocurrency exchange, is investigating what its founder has called a suspected hack after billions of dollars in crypto left its hot wallets on Thursday night, forcing the exchange to suspend withdrawals while stablecoin issuers raced to freeze the stolen funds. Binance itself has not used the word "hack" and has not confirmed how much was taken, but it says user funds are completely safe and that withdrawals will resume once the security issue is fully resolved. The incident, which unfolded in about forty minutes on the evening of 29 October 2026, is already being described by crypto analysts as potentially the largest exchange theft on record — though that claim, like every loss figure circulating so far, remains an estimate, not a confirmed total.

The first public sign came from on-chain trackers, which spotted abnormal outflows from wallets labelled as belonging to Binance. At 20:24 UTC on Thursday — 01:24 PKT on Friday morning in Pakistan — a wallet labelled "Binance 14" on the Etherscan blockchain explorer sent out about 167,464 ether, worth roughly $388 million, plus about 1.615 billion USDT and more than 60 other tokens in a single transaction. Within minutes, two further Binance hot wallets moved funds to the same destination, including roughly 28,000 ether and about $823 million in USDC. Hot wallets are the internet-connected wallets an exchange uses to process day-to-day withdrawals; the bulk of customer balances is meant to sit in offline cold storage, which is why the distinction matters for what happens next.

Binance's first statement, posted on X at about 21:16 UTC, said its teams were aware of reports of a potential security issue and were actively investigating. An early version of the statement said the exchange had not confirmed any impact on user funds; within minutes it was revised to say user funds were completely safe. Binance co-founder and former chief executive Changpeng Zhao, known as CZ, went further than the company statement in a post on X: "User funds are safe! It does look like a hack on Binance," he wrote, adding that he no longer manages Binance.com but, as a shareholder, expects all user funds to be fully covered. Binance co-chief executive Yi He later said deposits and withdrawals were temporarily suspended as a precaution while the team conducted security checks, froze funds and worked with law enforcement, and that Binance Alpha trading was also temporarily suspended. No timetable for resumption has been given.

How the money left, according to on-chain researchers

Researchers tracking the wallets say the attack used a feature of Ethereum called EIP-7702, introduced in the network's Pectra upgrade in May 2025. The feature lets an ordinary wallet temporarily delegate control to a piece of smart-contract code. In this case, the Binance 14 wallet was pointed at a contract deployed by the attacker, and that contract then swept the wallet's contents out in one transaction. The receiving address had been created only the day before, and researchers say it was funded through Tornado Cash, a mixer that obscures the origin of crypto, with small deposits on 28 October. The speed of the drain — the main wave of Ethereum transfers was over within about forty minutes — is part of why analysts treated it as an attack rather than ordinary withdrawal traffic: the funds were pushed onward within minutes of arriving, across several blockchains, instead of sitting in a customer's wallet.

None of this has been confirmed by Binance, which has not described a cause, named an attacker, or said whether it received any communication from whoever moved the funds. That gap between what the blockchain shows and what the exchange has confirmed is the central uncertainty of the story so far. The transfers themselves are public and verifiable on Etherscan; who controlled the keys, and how an outside address came to trigger withdrawals from Binance's own wallets, is not yet established. Until Binance publishes its own account, every explanation of the mechanism should be read as researchers' reconstruction, not as the exchange's finding.

The freeze race: $2.54 billion stopped, the rest still moving

What is confirmed is the scale of the freeze response, because the stablecoin issuers announced it themselves. Tether chief executive Paolo Ardoino said on X that the company froze more than $1.567 billion in USDT linked to the incident. Circle co-founder and chief executive Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement. Binance later said $2.54 billion of funds had been frozen in total as of Thursday evening, a figure it said may rise. Yi He also said Ripple helped halt the movement of $200 million. Stablecoins can be frozen this way because they are centrally issued: Tether and Circle can blacklist an address, while ether and bitcoin have no equivalent off switch, which is why the unfrozen portion — largely ether — is the part investigators expect to be hardest to recover.

How big was it? Every figure is an estimate so far

Readers will see very different numbers attached to this story, and they are not all measuring the same thing. The most conservative on-chain counts put at least $2 billion leaving Binance's hot wallets. Counts of the Ethereum transfers alone put $3.3 billion to $3.5 billion moving in roughly forty minutes. The highest cross-chain tallies, including bitcoin and Tron transfers, reach $5.7 billion to $5.8 billion — but analysts themselves caution that those totals count the balances sitting in wallets tagged as linked to the attacker, which is not the same as a confirmed amount stolen, and some of the wallets counted may be unrelated. The Wall Street Journal was reported as putting the figure at at least $1.7 billion. After the freezes, one outside estimate put the net loss at around $1 billion; CZ replied that the loss might be a bit higher than that, but said it will be covered. TaazaPulse is reporting the range, not a single headline figure, because Binance has confirmed none of them — and because the difference between gross outflows, frozen funds and net loss is exactly where misleading headlines are made.

If even the middle estimates are confirmed, this would surpass the previous largest crypto exchange theft: the $1.5 billion Bybit hack of February 2025. That comparison is already appearing in coverage, but it too depends on a confirmed total that does not yet exist. What is not in doubt is the market reaction. Bitcoin fell 3.2 percent on Thursday evening to below $79,000, according to the Associated Press, and crypto analysts reported more than $600 million in liquidations within an hour as leveraged positions were wiped out. Binance's own token, BNB, and the wider market fell with it, in a reminder that an incident at the largest exchange moves the whole market even when the exchange insists customer balances are safe.

What it means for users — including in Pakistan

The keyword trended in Pakistan overnight, and the practical question for users here is the same as everywhere else: can I withdraw, and is my balance safe? As of this report, withdrawals on Binance.com remain suspended, with no resumption time announced; Binance says they will resume as soon as the security issue is fully resolved. Binance.US, a separately operated platform, has said it is not affected and that its services are operating normally. Binance has told users that their funds are completely safe and that it will cover losses, but it has published no figures to back that assurance yet, and its statement has already been revised twice — a reason to treat the reassurance as a holding position until the exchange publishes its own accounting of what was taken and what was recovered.

Binance's own warning is worth repeating exactly, because incidents like this reliably attract impersonators: users should be cautious of scams and should not trust unofficial links, messages or requests for account information. Anyone offering on WhatsApp or Telegram to "unlock" frozen Binance funds is not Binance. Genuine updates will come through Binance's official channels, and no legitimate support agent will ask for a password, a seed phrase or a payment to release funds. A separate incident on the same day — prediction market Polymarket briefly pausing trading after a third-party software compromise involving about $2 million — is unrelated to Binance and should not be folded into its totals, though it added to a chaotic day for crypto platforms.

What happens next

Three things will decide how this story ends. First, Binance's own investigation: a confirmed loss figure, a cause, and an account of how the wallets were compromised. Second, the freeze and recovery effort: whether the $2.54 billion already frozen grows, and whether any of the unfrozen ether can be traced before it passes through mixers. Third, the resumption of withdrawals — in full, in phases, or network by network — which is the moment users will be able to judge for themselves whether the "funds are safe" assurance held. Until then, the honest summary is this: a very large, fast-moving outflow from the world's biggest exchange has been confirmed by the blockchain and by the stablecoin freezes; the exchange calls it a potential security issue under investigation; its founder calls it a hack and promises full coverage; and the final number, the cause and the timeline are all still unknown. This is a developing story, and TaazaPulse will update it as Binance publishes verified figures.