Binance investigates suspected theft that could reach $5.8 billion

What Binance confirms, and what it does not

On 29 October 2026, the Binance exchange told Bleeping Computer that it was investigating a possible security incident. The amounts mentioned could reach up to $5.8 billion in digital assets. If confirmed, the theft would far exceed the Bybit heist: $1.5 billion stolen in February 2025 by North Korean hackers, which remains the largest confirmed cryptocurrency theft to date.

One caveat matters here. On the evening of 29 October, when the source was published, Binance had not confirmed that the transfers were unauthorised, how the incident happened, or the total value of the assets that may have been stolen. This article relies on a single press source, which brings together official statements and analyses published on X. You should therefore read every figure below as unconfirmed.

Hot wallets drained to a brand-new address

For now, the only known details of how this happened are the traces visible on the blockchain. Several Binance hot wallets, meaning wallets kept online to process day-to-day operations, transferred large amounts to an Ethereum address created shortly beforehand.

A journalist who covers cryptocurrencies published an analysis of these transactions on X. According to that analysis, a Binance wallet known as “Binance 14” first sent around $2.53 billion, spread across 64 tokens. A second Binance wallet reportedly transferred $174.4 million 24 seconds later. According to an update to the same analysis, a third wallet then sent 780 million USDC to the same address, which would bring the total to around $3.48 billion.

The blockchain explorer Etherscan labelled the initial receiving address “Binance Hot Wallet Exploiter 2” and tagged it “Exploit” and “Heist”. It is still unknown, however, how whoever made these transfers obtained the ability to carry them out.

Funds traced, and partly frozen

The analytics platform Arkham Intelligence is tracking 55 addresses, grouped under the entity “binance-hacker-1029”, which together hold around $5.78 billion. That total breaks down into roughly $1.77 billion in USDT, $1.44 billion in bitcoin, $876 million in ether and $823 million in USDC. This is the value of everything held by the tracked addresses, not an amount known to have been stolen from Binance.

Stablecoin issuers reacted quickly. Tether announced it had frozen more than $1.567 billion in USDT linked to the incident. Circle froze more than $800 million in USDC and says it is working with law enforcement. In total, more than $2.3 billion in assets linked to the incident are now frozen.

What this means for customers

Binance says its users’ funds are entirely safe. It says its security teams are urgently reviewing all available information, and it promises updates on its official channels as soon as it has verified facts. Binance’s founder, no longer in charge of the exchange as the post itself points out, wrote on X that the incident looked like a hack and that users’ funds were expected to be fully covered.

Until those facts arrive, the most practical advice comes from Binance itself: watch out for scams, ignore links and messages that do not come from its official channels, and never share your account details with anyone. The exchange is explicitly asking its customers to stay vigilant during this period of uncertainty.

Until Binance officially confirms what happened, the only established figure is the amount of frozen funds. Everything else rests on the transactions visible on the blockchain.