Binance Faces Potential $5.7 Billion Crypto Hack

The crypto world woke up Thursday morning, October 29, 2026, to reports that Binance, the world's largest cryptocurrency exchange, was investigating a potential security breach that could result in losses of up to $5.7 billion — which would make it the largest crypto heist in history.

What happened

The first alerts came from anonymous blockchain detectives on X. A researcher known as Spreek posted a screenshot showing massive transfers leaving one of Binance's hot wallets — labeled "Binance 14" — and flowing into a newly created external account. Within 17 minutes, two batches of transfers totaling approximately $3.3 billion had left the exchange's wallets.

The first batch, at 04:24 UTC, moved 167,464 ETH (about $388 million), 1.615 billion in USDT and more than 60 other tokens. The second, 17 minutes later, transferred $780 million in USDC. Both went to the same receiving address. The gap between the two transfers is short enough to suggest a single operator or automated process.

Notably, the transfer was triggered by a wallet funded exclusively through Tornado Cash, the cryptocurrency mixing service used to obscure the origin of funds. This choice of infrastructure is unusual for legitimate wallet maintenance but standard for laundering activity.

Binance's response

Binance confirmed it was aware of a "potential security issue" and was "actively investigating." The exchange temporarily suspended withdrawals on multiple networks as a precaution. In a statement, the company assured that "user funds are completely safe."

Changpeng Zhao, Binance co-founder (who no longer manages the exchange but is its largest shareholder), posted on X that the activity "does look like a hack" and reported that Tether and Circle had frozen approximately $971 million and $823 million, respectively, in stablecoins linked to the incident. Zhao said he expected "all user funds will be fully covered" but did not explain how the company intended to absorb the loss.

The role of stablecoin issuers

The swift action of Tether and Circle was crucial. Both issuers can block specific addresses on their networks. Tether froze over $1.567 billion in USDT linked to the potential exploit, while Circle, the issuer of USDC, locked more than $800 million in USDC. In total, approximately $2.36 billion in stablecoins were frozen.

Paolo Ardoino, CEO of Tether, wrote on X: "Protecting the industry and our partners is our main priority." Jeremy Allaire, CEO of Circle, said the company would be "closely tracking" the reports and working in coordination with law enforcement.

This centralized freeze capability is one of the most controversial features of stablecoins: though presented as decentralized assets, centralized issuers can unilaterally freeze specific funds in response to suspected crimes.

Market impact

The market reacted with panic. Bitcoin plunged below $79,000, down about 2.6% over 24 hours. Ether lost roughly 3%. Binance's own token (BNB) was hit hardest, falling approximately 7% to around $699. Monero, the privacy-focused cryptocurrency, jumped 6% — echoing the 51% spike it posted after a $333 million Bitcoin theft in April 2025, when hacked funds were expected to be laundered through Monero.

Historical context

If confirmed, this incident would surpass by more than three times the previous record crypto theft: the Bybit attack in February 2025, which resulted in the loss of approximately $1.5 billion and was attributed to North Korean hackers. Binance itself had been the victim of a 2019 hack, losing 7,000 BTC (about $78 million at the time), but recovered all funds through its SAFU (Secure Asset Fund for Users), an emergency fund created from a 2018 meme.

What makes this incident particularly concerning is the uncertainty around the attacker's identity. No group has claimed responsibility, and Binance has not mentioned receiving any correspondence from the hackers — a pattern seen in 2025 attacks, where state-linked organizations often negotiated the return of funds in exchange for a share of the ransom.

What's next

At this point, Binance has not confirmed any impact on user funds. The most optimistic scenario is that this was an internal maintenance transfer triggered by compromised credentials — something the company described as "a security issue" without characterizing it as a theft. The worst-case scenario is that assets are being drained continuously, potentially in real time.

The blockchain community will continue monitoring the chain for signs that funds have been moved to decentralized exchanges or converted into privacy coins — the final typical step before hacked funds become irretrievable.

Sources: TechCrunch, CoinDesk, Cointelegraph

✓ Independent sources cross-checked and verified before publishing