$5.7 billion wiped? Binance faces potentially biggest crypto hack in history

Binance faces a potential security crisis after blockchain data revealed billions of dollars in cryptocurrency moving out of wallets associated with the exchange. The reported outflows span three blockchains and could represent the largest cryptocurrency theft ever recorded if investigators confirm a breach.

The exchange has not confirmed a hack. Binance said its security teams are investigating a possible security issue and have yet to establish whether user funds suffered any losses. Former CEO Changpeng Zhao expects the exchange to cover customer funds fully, even as investigators examine suspicious transactions.

Billions flow from hot wallets

The reported outflows include approximately $3.51 billion in Ethereum-based assets, $1.44 billion in Bitcoin, and $630 million on Tron. The Bitcoin transfers involved 18,270 BTC, according to the reported figures.

Hot wallets maintain internet connectivity, allowing cryptocurrency exchanges to process withdrawals and other transactions quickly. Their accessibility makes them operationally essential, but it also creates security risks if attackers compromise their controls.

Blockchain records show that an Ethereum transaction at 20:24 UTC transferred 167,464 ETH to a newly created address. The transaction also included 63 token transfers, including approximately $1.615 billion in USDT.

Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe.

Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have… pic.twitter.com/ATR4YdzmHV

— Binance (@binance) October 29, 2026

Investigators have yet to determine how the suspicious activity began. Three minutes before the Ethereum transfer, an address funded through Tornado Cash submitted a delegation request involving a Binance hot wallet.

Tornado Cash obscures transaction trails by mixing cryptocurrency deposits and withdrawals. The delegation used EIP-7702, an Ethereum feature that allows externally owned accounts to execute smart-contract functionality temporarily.

The crucial unanswered question concerns authorization. Investigators have not established how the party behind the transaction obtained the signature required to execute the operation.

Stablecoin issuers freeze funds

Tether and Circle moved quickly to restrict some of the transferred assets. Onchain data indicated that the issuers froze approximately $1.79 billion in USDT and USDC held in a receiving wallet.

Circle froze approximately $823 million in USDC at 21:04 UTC. Tether also froze a substantial amount of USDT, although subsequent figures from its chief executive differed from earlier estimates.

Tether CEO Paolo Ardoino later said the company had frozen more than $1.567 billion in USDT. He described protecting the cryptocurrency industry and its partners as a priority.

Both issuers can blacklist specific addresses, preventing those wallets from transferring their affected stablecoins. However, that intervention does not automatically recover other assets or stop transactions involving tokens outside their control.

The reported freezes could therefore limit the potential losses without resolving the incident entirely. Investigators must still determine how much cryptocurrency remains accessible to whoever initiated the transfers.

Security teams investigate outflows

Blockchain security firm Blockaid said it was investigating approximately $3.3 billion in suspicious outflows across Ethereum, Arbitrum, and Avalanche. Its assessment adds another layer of scrutiny to the incident.

Zhao, who no longer manages Binance, addressed concerns about customer balances on X. He said he expected all user funds to receive full coverage and praised Tether and Circle for freezing assets quickly.

We are investigating a cluster of large outflows from Binance hot wallets that began at approximately 20:24 UTC on 29 October 2026. On-chain, the transfers look consistent with unauthorized movement from those wallets, but this has not been confirmed by Binance, and we cannot yet… pic.twitter.com/0V3G1K8wad

— Blockaid (@blockaid_) October 29, 2026

The decentralized lending protocol Aave also froze lending markets, according to onchain data. The action appears intended to prevent the suspected attacker from using the transferred assets to borrow additional cryptocurrency.

Neither Binance nor Aave had confirmed the full scope of the incident in the supplied information. The investigation must establish whether the transfers resulted from an exploit, compromised credentials, or another security failure.

Until investigators verify the transactions and identify the authorization method, the reported outflows remain evidence of suspicious activity rather than confirmed proof of a successful exchange hack.

Source: https://interestingengineering.com/culture/binance-biggest-crypto-hack-history