Binance Suspected Hack Hits $5.7bn in Crypto
Binance, the world’s largest cryptocurrency exchange by trading volume, is investigating a suspected hack after crypto assets worth about $5.7 billion moved out of wallets linked to the exchange. The exchange has paused deposits and withdrawals while its security teams check what happened.
The Binance suspected hack first surfaced on Thursday, October 29, when on-chain trackers flagged large, unexplained outflows from Binance-linked wallets on the Ethereum, Bitcoin and Tron networks. Binance said its teams were aware of reports of a potential security issue and were reviewing the matter urgently. It has not yet confirmed how much, if anything, was stolen from customer funds.
That gap between the on-chain figures and Binance’s own statement is the central fact of this story so far. The $5.7 billion figure comes from Arkham Intelligence, which tallied assets held in wallets it linked to the attacker, and Arkham itself stressed that the wallet balance is not a confirmed loss figure. Chainalysis later put its estimate at roughly $5.9 billion in value at the time of the theft.
Binance suspected hack: what the trackers show
The breakdown reported across trackers tells a consistent story about scale, even where the totals differ slightly. About $3.51 billion moved on the Ethereum network, according to one on-chain tally, along with about $1.44 billion in Bitcoin, equal to 18,270 coins, and about $630 million on Tron. CoinDesk reported that the linked wallet held nearly $1.5 billion in Bitcoin and $900 million in Ether, plus roughly $1.4 billion in USDT and USDC combined.
The linked wallet has since moved assets through decentralised platforms, according to Arkham data.
A suggested attack route involving an Ethereum upgrade known as EIP-7702 remains unconfirmed, and Binance has not confirmed how the attacker obtained any signatures.
Billions frozen as Tether and Circle act
Stablecoin issuers moved quickly to freeze part of the funds. Tether said it froze more than $1.57 billion in USDT linked to the incident, while Circle said it froze more than $800 million in USDC. Binance separately said $2.54 billion in assets linked to the incident had been frozen so far, and that the figure could rise as more funds are traced.
Readers should treat these freeze figures with care, because they cover different scopes. One tally of specific wallets put the Tether and Circle freezes at about $1.8 billion combined, while CoinDesk put the two issuers’ combined freezes at more than $2.3 billion including Ripple’s separate $200 million freeze.
Binance co-chief executive Yi He said customer losses would be covered and that user funds were safe. She said deposits and withdrawals were temporarily suspended while the team conducted security checks, froze funds and worked with law enforcement, and promised a full post-mortem once the investigation is complete. Founder Changpeng Zhao, who no longer manages Binance but remains a shareholder, said the activity looked like a hack on Binance and that he expected all user funds to be fully covered. Zhao added that the loss might be a bit higher than first reported, but that the company would cover it.
Why the sums matter, and what they do not prove
If the incident is confirmed as a hack, it would become the largest crypto theft on record, ahead of the roughly $1.5 billion stolen from Bybit in February 2025. That comparison explains why the story moved markets so fast. Bitcoin fell about 4.8 percent to near $77,000, Ether fell 5.7 percent, and Binance’s own BNB token fell about 8 percent, while the privacy-focused coin Monero rose about 6 percent.
Scale also cuts the other way. Binance held roughly $144 billion in assets on its platform before the incident, according to DefiLlama data cited by CoinDesk, so the suspected theft would amount to about 4 percent of those holdings. Its Secure Asset Fund for Users, set up in 2018 to protect customers during security breaches, holds roughly $1 billion in Bitcoin, although Binance has not confirmed whether it plans to use that fund for this incident.
Two claims in early coverage remain unproven and should not be repeated as fact. The investigator ZachXBT and the security firm Blockaid said North Korea was likely behind the hack, but Binance has not named an attacker.
