Billions Left Binance in Minutes. Are Customer Funds Safe?

On October 29, 2026, at 20:24 UTC, 167,464 ETH, worth about $388 million by Etherscan's valuation, left a wallet labeled Binance 14 in a single transaction. Binance has not used the word hack, has not named a loss or a cause, and has not given figures to back its claim that user funds are safe. That gap between what the blockchain shows and what the exchange says explains most of what follows.

The transaction also sent 63 tokens, among them roughly $1.6 billion in USDT, to a newly created address. A second wallet, Binance 16, followed 24 seconds later with 28,005 ETH to the same receiving address.

Binance acknowledged a security incident, not a hack, and said user funds are safe. Changpeng Zhao, the founder and largest shareholder, who no longer runs the company, was blunter and said the transfer looks like a hack, before Binance had said anything. Tether blacklisted the receiving address at 00:01, and Circle froze USDC three minutes later.

Nobody agrees yet on how big the theft was. Totals run from an Etherscan-based figure above $2 billion, reported by a news site, to at least $5.57 billion in one on-chain tally. TechCrunch relays an unconfirmed estimate above $5.7 billion and adds that the theft may be ongoing. In our read, something real happened, the size is unsettled, and the safety of customer funds currently rests on Binance's word until it publishes figures.

How the drain appears to have worked

Exchanges keep part of their crypto offline in cold wallets and the rest in liquid hot wallets that pay out to users. Stealing a hot wallet's keys can therefore drain much of an exchange's funds, which is why hot-wallet incidents are the usual shape of exchange thefts. On-chain data points to this pattern here, since the sending and receiving addresses were tagged by Etherscan as a Binance hot wallet exploiter.

The mechanism appears to be EIP-7702, a feature of Ethereum since the Pectra upgrade in May 2025 that lets a single signature hand wallet control to a contract. On-chain data reported by FinanceFeeds shows Binance 14 was switched to run the attacker's contract code at 20:20 UTC. About three minutes before the first transfer, an address funded by Tornado Cash submitted the authorization. How the attacker got the signature is still unclear. Binance has also not said how an outside address could trigger withdrawals from its hot wallets.

Blockaid, a Web3 security firm, offered a trial-and-error picture of the attack. The attacker apparently could not determine the wallet's current nonce and submitted 50 authorizations in one transaction, and only one took effect, which Blockaid suggests was a coincidence because the hot wallet was still broadcasting. The contract involved was unverified and limited withdrawals to designated operator addresses, which suggests the attacker prepared the target before moving funds.

The funding trail is contested. Several reports say the triggering address was funded only by three Tornado Cash deposits of roughly 0.1 ETH on October 28 and 29, 2026, while Binance normally pays fees from its own labeled wallets. Coindoo, however, cites Etherscan's own record as listing the suspect address as funded by Binance 14. If the route holds, it likely points to a key-management or operational weakness rather than a smart-contract bug, a reading that fits a review paper's argument that human, operational and design flaws chain together in many incidents.

The money then moved fast. The receiving address did not exist before October 29, 2026, and within 15 minutes it forwarded 195,460 ETH, around $450 million, to another fresh address. Unlike stablecoins, ETH cannot be frozen by an issuer.

Why the numbers do not agree

The headline figures are gross movements measured on-chain, not a settled loss. Tallies differ in which chains and tokens they count, and the sources say they have not been reconciled. Adding them up would count the same assets twice.

Estimate	Source type
More than $2 billion	Etherscan data via a news report
About $2.53 billion	Market alert feed
$2.77 billion across five chains	On-chain data via news report
About $2.8 billion	News report
More than $3 billion	Etherscan data via a news report
About $3.3 billion	News report
Up to $3.55 billion across six chains	Trackers
At least $5.57 billion	Decrypt on-chain tally
Above $5.7 billion	Unconfirmed estimates

The highest tally is the least comparable. It adds Ethereum, Bitcoin and Tron movements, with about $3.51 billion on Ethereum alone. Coindoo says the Ethereum transfers are already counted in the $2.77 billion figure and are not additional losses, so the gap between the low and high tallies may partly be scope.

Freezes cut the likely net loss, but the freeze totals differ too. Tether froze about $1.56 billion according to TechCrunch, or more than 1.567 billion USDT by its CEO Paolo Ardoino's account, and Circle's USDC freeze is put at more than $800 million by its CEO and near $823 million by Zhao. Combined estimates run from about $1.79 billion to about $2.4 billion, and FXStreet cites a lower split of $971 million and $873 million. Frozen USDT and USDC are not lost for good, but ETH and Bitcoin that left are another matter. A news report puts roughly $700 million in USDT and $445 million in ETH as moving on before or outside the freeze.

Zhao's own estimate sits well below the on-chain tallies. One report has him putting the actual loss at possibly slightly above $1 billion and fully covered, another that the loss after freezes might exceed an estimated $1 billion. Neither is a Binance figure. Even a stray label can mislead: Whale Alert flagged about 7.8 trillion PEPE tokens, valued at about $37 million, moving from an address labeled Binance Hack 2026, yet Binance has not confirmed it.

Binance says funds are safe, but offers no proof

Binance's official wording changed twice in 13 minutes. The first post went up at 21:16 UTC and said Binance had confirmed no effect on user funds. The next said user funds are completely safe. One news outlet advises treating the statement as a holding line until figures are published. Until then, "funds are safe" is probably best read as a claim, not a verified fact.

Reports on the withdrawal pause conflict. A Binance spokesperson told TechCrunch that withdrawals were temporarily suspended on multiple networks as a precaution. Yet no suspension had been announced as of 03:15 IST on October 30, 2026, while users reported withdrawals stuck at processing. Another outlet reports that withdrawals will resume once the issue is fully resolved, with no time given. The on-record statement is the stronger evidence of a pause, but no source gives a duration.

A pause does not by itself mean customer money is gone. Binance halted all transactions for one week after its 2019 breach and pledged to reimburse customers from an emergency fund, and Bitget completed a phased resumption of withdrawals on October 2, 2026.

Several basic questions remain open. Binance has issued no loss figure, cause, withdrawal status or compensation plan. No independent forensic findings from firms such as Chainalysis, Mandiant, SlowMist or Arkham explain how the key or delegation was compromised. No regulator or law-enforcement reaction has surfaced, and no named independent expert has assessed whether customer funds are at risk. Binance has not said whether it will use its SAFU reserve.

Markets and rivals react

The market punished the news within the hour. BNB fell as much as 9%, and CoinGecko data put it at $703.10 at 22:07 UTC, down 6.9% over 24 hours. Futures liquidations reached $629 million within an hour, $607 million of it in long positions.

The wider market fell too, though the sources give slightly different price levels. Bitcoin dropped below $79,000 and Ethereum under $2,240 in the minutes after the first transfer, one report said, while another had Bitcoin under $78,500 and Ether under $2,250. One news report put liquidations at $627.7 million in one hour, with $344.8 million of it on Binance. The gaps reflect different snapshot times, not a real disagreement.

The reach is global because Binance is. The company reported over 320 million users in July 2026 and $11.4 trillion in first-half 2026 trading volume, and the funds spread across five to six blockchains including Ethereum, Bitcoin and Tron. The outflow also coincided with a broad market decline, so how much of the drop the hack caused is hard to separate from the rest.

How this compares with past exchange hacks

The gross figures would exceed Bybit's, though they are unreconciled. Bybit's February 2025 hack of about $1.5 billion is the largest exchange theft on record, and the FBI attributed it to North Korea. Another outlet gives the Bybit figure as $1.4 billion, a gap of rounding between outlets. Bybit confirmed its breach within hours and published reserve figures, but recovered only $48.4 million, and customer funds were covered. Binance's slower, shifting statements stand in contrast to that speed of confirmation.

Bitget's September 2026 case is the closest recent parallel for what a pause can mean. It lost $387.5 million, revised up from an initial $351.6 million, and said attackers exploited a vulnerability in a third-party security product to forge withdrawal commands. Withdrawals resumed in phases and were fully restored on October 2, 2026. Binance's own 2019 breach, about 7,000 BTC or around $40 million, led it to halt all transactions for one week and reimburse customers from its emergency fund. A pause is therefore not evidence that customer money is gone.

Freeze speed is where this case differs most. At Bitget only about $318,000 could be frozen because stablecoins were swapped into Ether within minutes, while here Tether and Circle froze roughly $1.8 billion. That suggests the attacker's speed in converting assets, not just the size of the theft, shapes what comes back.

Older cases show the range of endings. Mt. Gox lost about 850,000 BTC in 2014 and went bankrupt, with repayments only from 2024. Bitmart lost almost $200 million in December 2021 and froze customer transactions for three days. In 2021, Poly Network's thief returned all $600 million, a rare exception.

Binance can probably take the hit, but not the larger estimates

Binance's cushion is the SAFU fund, created on July 3, 2018 and funded with 10% of all trading fees. It holds about 15,000 BTC, and the dollar value depends on the day: about $1 billion in one report, about $1.18 billion in another. Binance has committed to top the fund up whenever it falls below $800 million, but it keeps sole discretion over its use, and the fund is not equivalent to FDIC insurance. Its only disclosed deployment was the 2019 hack.

Against Binance's size, the loss looks survivable. DefiLlama address data put its customer assets at about $144 billion, so the suspected loss is just under 2% of that. Zhao has also said shareholders stand ready to cover users, though that is his statement, not a Binance commitment. The framing probably understates the pressure: the reserve alone would not cover the larger estimates, so recovery depends on freezes, Binance's balance sheet or shareholder support. For an ordinary account holder, the small share of assets is reassuring, but the reserve is discretionary and no formal guarantee.

Binance also carries legal baggage. The US Department of Justice is reportedly investigating whether Binance violated sanctions on Iran, and in February 2026 US newspapers reported that at least four compliance investigators were fired or suspended after raising concerns about $1.7 billion in payments. Binance denies wrongdoing, and an investigation is not a charge. Zhao's October 2025 pardon followed a 2023 conviction that cost Binance $4.3 billion in fines.

Recovery from the thieves will be slow whatever Binance does. Most exchange hackers are not caught, and Europol describes building a solid case as a long, slow process. Exchanges without an emergency fund often go out of business after a hack, which Binance's reserve at least guards against.

What users should do now

Binance has not asked users to move funds. Its only instruction is to stay alert for scams and distrust unofficial links, messages or requests for account information. Updates will come through official channels, so WhatsApp or Telegram offers to release Binance funds should be ignored.

Scams tend to spike during incidents like this one. General precautions include relying on official channels only, enabling anti-phishing and two-factor protections, and avoiding moves driven by rumor. Exposure differs by holder: people with assets on the exchange depend on its solvency and on whether SAFU or shareholders cover losses, self-custody holders are not directly affected, and active traders face withdrawal delays and liquidation-driven volatility. Whether to withdraw is a personal risk judgment, and this is not investment advice.

Where this is heading

The likelier path is a loss Binance can absorb, but that depends on facts it has not yet given. The downside scenario is that losses prove larger than disclosed or touch customer balances, leading to prolonged restrictions, withdrawal runs and regulatory intervention. It becomes more likely if Binance keeps avoiding a figure or a cause.

Regulatory fallout will likely include calls for proof-of-reserves and custody-control standards, landing on a company already under a reported Department of Justice probe. The size of the response depends on whether customers lose money, and a quick, transparent post-mortem would blunt it. Recovery beyond the freezes is uncertain, and full returns like Poly Network's in 2021 are rare.

Four indicators will probably show which scenario is unfolding: a Binance statement with a loss figure and cause, a date for resuming withdrawals, any draw on SAFU, and independent forensic findings on how the hot wallet was taken over. Exchange outflows, BNB and the tone of regulators are the market-side signals to watch.

This article is general information, not financial advice. Figures come from the sources listed below and may have changed; consider your own situation or a licensed adviser before acting.

Edit:

BREAKING: World's largest crypto exchange Binance hacked with over $5.6 billion stolen:

• $1.45 billion $BTC

• $875 million $ETH

• $234 million $TRX

• $50 million $XAUT

• $1.57 billion $USDT

• $823 million $USDC

• $75 million $WBETH

• $88.5 million $RLUSD

+ $447.5 million additional cryptocurrencies

This is the largest hack in crypto history.

Kaynaklar 19Yahoo Finance, FinanceFeeds, tech-ish ve 16 kaynak daha

1. Yahoo Finance (Oct 29, 2026). Is Binance Being Hacked? $2 Billion Outflow Puts Customer Funds in Question. Lockridge Okoth
2. FinanceFeeds (Oct 29, 2026). Binance Hack: Statement Edited Twice to Say Funds Are Safe. Tobi Opeyemi Amure
3. tech-ish (Oct 29, 2026). Binance pauses withdrawals after more than USD 3 billion leaves its hot wallets in a suspected hack - tech-ish. The Analyst
4. TechCrunch (Oct 29, 2026). Binance pauses withdrawals as hackers suspected of stealing billions in crypto | TechCrunch. Zack Whittaker
5. FinanceFeeds (Oct 29, 2026). Suspected Binance Hack Drains $3.3B From Hot Wallets as Tether, Circle Freeze $1.8B
6. NBC News (Dec 17, 2021). Crypto exchanges keep getting hacked, and there's little anyone can do. Kevin Collier
7. cryptoticker.io (Oct 29, 2026). Biggest Crypto Hacks in History: Is Binance No. 1?. Dennis Weidner
8. TechFlow (Oct 29, 2026). Binance Suspected of Being Hacked for at Least $5.57 Billion Across Three Public Blockchains
9. Cyber Kendra (Oct 29, 2026). Binance Hack: $3.3B Left Hot Wallets, $1.79B Frozen - Cyber Kendra
10. TechFlow (Oct 29, 2026). Blockaid: Binance Hot Wallet Suspected of Being Targeted by 7702 Authorization Attack
11. Coindoo (Oct 29, 2026). Binance Hack Fears Shake Crypto: $2.8B Outflows Reported. Kosta Gushterov
12. arXiv (Jul 27, 2025). SoK: Root Cause of $1 Billion Loss in Smart Contract Real-World Attacks via a Systematic Literature Review of Vulnerabilities. Hadis Rezaei, Mojtaba Eshghie, Karl Anderesson, Francesco Palmieri
13. Crypto Impact Hub (Oct 14, 2026). Q3 2026 Crypto Losses Hit $1.26B, Bitget Hack Leads. Crypto Impact Hub
14. FXStreet (Oct 29, 2026). Breaking: Binance potentially hacked for $2.77 billion. Michael Ebiekutan
15. news.az (Oct 29, 2026). Has Binance been hacked following a $2B outflow?. Ulviyya Salmanli
16. Wikipedia (Oct 29, 2026). Binance
17. BlockchainReporter (Oct 29, 2026). Binance Hack: CZ Says Funds Safe After $2.5B Outflow. Ogwu Emmanuel
18. Gizmodo (Sep 22, 2026). Feds Reportedly Investigating Crypto Titan Binance Over Iran Sanctions. Tom McKay
19. FinanceFeeds (Oct 16, 2026). Binance SAFU Fund: 7,000 BTC Hack, $800M Floor Explained. Damilola Esebame

Son güncelleme: 30 Eki 2026. Bu yazı bu kaynaklardaki haber ve verilere dayanıyor; metindeki bağlantılar en önemlilerine gider.