Binance Pauses Withdrawals as Up to $5.6 Billion Leaves Its Wallets

Binance suspended withdrawals on multiple networks on the evening of Thursday 29 October 2026, after a run of transfers moved billions of dollars out of wallets the exchange controls. The company said it was investigating a "potential security issue" and that user funds were "completely safe." By early Friday, blockchain analysts had tagged dozens of addresses, Tether and Circle had frozen more than $2.38bn between them, and no one had published a confirmed loss figure.

Related reading: S&P Global Leads a $110 Million Extension of Kaiko's Series B · FCA Names Seven Crypto Activities That Will Need UK Authorisation.

What Binance has confirmed

Binance is the world's largest cryptocurrency exchange by trading volume, and its public statements describe an investigation, not an incident report. A spokesperson, Ross O'Leary, told TechCrunch the exchange had "temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure." The company also said its security teams were "reviewing all relevant information with urgency" and would post updates through official channels once it had verified information. It warned users about scams, unofficial links and requests for account details.

Changpeng Zhao, who stepped down as CEO in 2023 and remains Binance's largest shareholder, was less guarded. "It does look like a hack on Binance," he wrote on X. In the same thread he said "User funds are safe!" and that, as a shareholder, he expected all user funds would be "fully covered." He gave no explanation for the coverage claim, and he no longer runs the company.

Binance's statement and CZ's posts set the boundaries of what is established. Binance has not confirmed that the transfers were unauthorised, how they happened, what was taken, or whether the drain has stopped.

The $5.6 billion measures wallets, not losses

The on-chain trail was assembled in public, mostly by people outside Binance. StarPlatinum, a crypto journalist, traced about $2.53bn moving out of a wallet labelled "Binance 14" across 64 tokens. A second Binance wallet sent about $174.4m to the same destination 24 seconds later, and a third transfer of 780m USDC took the reported total to about $3.48bn, according to BleepingComputer.

Arkham Intelligence went further. It grouped 55 addresses under an entity labelled "binance-hacker-1029" and put their combined holdings at about $5.78bn: roughly $1.77bn in USDT, $1.44bn in bitcoin, $876m in ether and $823m in USDC. BleepingComputer notes that this is the value of assets across the tracked wallets, not a confirmed stolen amount. Etherscan separately labelled the first receiving address "Binance Hot Wallet Exploiter 2" with "Exploit" and "Heist" tags; one address held about $2.27bn.

A third compilation, credited to Watcher Guru and published by TechStartups, put the total near $5.61bn. Its breakdown ran to bitcoin at $1.45bn, USDT at $1.57bn, USDC at $823m, ether at $875m, Tron's TRX at $234m, and smaller positions in XAUT, WBETH and RLUSD. That is an estimate assembled from wallet contents, not an audited figure.

The Wall Street Journal reported that hackers "appeared to have plundered at least $1.7 billion." TechCrunch reported that crypto watchers put the drain at $2bn or more, with some estimates upwards of $5.7bn, and added that "it's possible that the theft is ongoing." Both floors sit far below the wallet totals.

The gap between $1.7bn and $5.78bn comes from what is being counted. The Wall Street Journal's figure is an estimate of what was taken. The $3.48bn follows transfers out of Binance wallets. The $5.78bn counts everything in the 55 addresses analysts tied to the cluster, and the $5.61bn is a separate compilation of wallet contents. None is a statement of confirmed loss.

Why hot wallets hold so much

A hot wallet is one whose keys sit on a machine connected to the internet. That is what lets an exchange send withdrawals without a person signing each transaction, which is why the same wallet can hold a working balance large enough to settle a day of customer activity. The convenience is also the weakness. A key that a server can reach is a key that an attacker who reaches the server can use.

Large outflows are ambiguous in the first hours. A big transfer to a fresh address can be housekeeping, a custody change or a theft. What made this look different was the sequence: a transfer spanning 64 tokens, a second one 24 seconds later, and destinations with no prior history. Analysts read that pattern as a drain, though Binance has not described it as one.

The reassurance Binance has offered rests on a separate distinction. Customer balances are records on the exchange's ledger, not coins set aside in a named wallet. A hot wallet can be emptied while the ledger still shows every customer whole, and covering the gap becomes a question of what other assets the exchange holds.

Freezes stop the money moving

The most concrete numbers of the night came from the stablecoin issuers. Tether froze more than $1.567bn in USDT, chief executive Paolo Ardoino said on X. Circle froze more than $800m in USDC, chief executive Jeremy Allaire said on X, coordinating with law enforcement. Reuters put the two freezes at more than $2.38bn combined.

Tether and Circle issue their tokens, so they control the contracts that record who holds them. When an issuer freezes an address, the balance stays on the ledger but cannot move. Binance co-founder Yi He said Ripple froze roughly $200m as well, according to TechStartups.

The first freeze figures were revised within hours. CZ's first post put Tether's at about $971m and Circle's at about $823m. Tether's later number was more than $1.567bn, roughly $600m higher.

The freezes apply only to stablecoins. Bitcoin and ether do not have an issuer who can block a balance, so the $1.44bn in bitcoin and $876m in ether that Arkham tracked could not be frozen the same way. That asymmetry shapes how much of a haul can be made unspendable, and how quickly.

A freeze contains funds without recovering them. The attacker cannot spend a blocked balance, and the customer has not received it. Returning it would take an issuer decision, a legal process or both. No statement cited here sets out which route applies, or when.

"It does look like a hack on Binance." — Changpeng Zhao, Binance founder and largest shareholder, 29 October 2026

Bybit is the scale, SAFU is the gap

The nearest precedent is Bybit. In February 2025, about $1.4-1.5bn was stolen from that exchange, the largest confirmed crypto heist on record, and the FBI attributed it to North Korean hackers. If the Binance figure is confirmed in the billions, it would exceed Bybit. That is a statement about scale, not about mechanism: neither the facts published so far nor Binance's statements say who is behind this, or how they got in.

Binance's Secure Asset Fund for Users, the exchange's emergency reserve, is the other number to hold beside those estimates. The Wall Street Journal put SAFU at about $1.2bn. That is smaller than most of the loss estimates circulating, and less than a quarter of Arkham's $5.78bn.

The comparison is not a solvency calculation. SAFU is one reserve, not the company's balance sheet, and the loss itself is unconfirmed. But it does sharpen the question behind CZ's promise of full coverage. A reserve of $1.2bn cannot absorb a $5bn hole on its own. Binance has not said what else would.

What account holders can and cannot do

Anyone with a balance on Binance cannot move it to another wallet while the relevant network is paused. That is the practical meaning of the restriction, and it is why advice to move coins elsewhere is useless in the first days of an incident like this. The pause does not by itself mean the balances are lost; it means they cannot leave while it lasts.

What account holders can do is narrower. They can use Binance's official channels rather than links in replies and direct messages, since the exchange has warned users to beware scams, unofficial links and requests for account information. They can keep their own records of balances and transaction histories. They can avoid posting account details or balances in public threads, where they make easy targets. And they can check whether they are on Binance.com or Binance.US, because the American platform said it was unaffected.

They cannot verify the reserves themselves, and they cannot force a withdrawal through a paused network. For users in the United States, the separate Binance.US platform is the relevant one. For everyone else, the withdrawal pause is Binance's to lift.

Caveats

• No confirmed total. Binance has not published a loss figure. The $1.7bn, $3.48bn, $5.61bn and $5.78bn numbers come from a newspaper, a transfer trail, a third-party breakdown and a wallet cluster, in that order.
• No confirmed vector or attacker. There is no forensic timeline, no attribution and no confirmation that the transfers were unauthorised rather than an internal move.
• The drain may not be over. TechCrunch reported that the theft could still be ongoing. Nothing cited here establishes that it has stopped.
• Some of the total may never have been stolen. Some funds are frozen, some may be recovered, and some addresses may hold assets that were never Binance's.
• "User funds are safe" is a statement, not an audit. Binance and CZ have both said it. Neither has published the reconciliation that would support it.
• Polymarket is a separate incident. Polymarket briefly halted trading the same day after a third-party software compromise, and researchers traced about $2m in user funds.

The withdrawal halt is the only operational step Binance has confirmed. Everything else, including the size of the loss and whether it was a theft at all, remains open. Binance had not said when withdrawals would resume. The addresses analysts are watching remain visible on public ledgers, and the balances in them can still change.

Cover image: Changpeng Zhao at the Web Summit in Lisbon, November 2022. Photo by Web Summit, CC BY 2.0, via Wikimedia Commons. The photo predates the 2026 incident.