Binance Hot Wallet Hack, Oct 29: Are User Funds Safe?

On the evening of October 29, 2026, an estimated $3.3–3.55 billion in ETH, USDT, USDC and other tokens left Binance hot wallets, mostly on Ethereum, within about 40 minutes; the widest counts reach $5.8 billion. Tether says it froze more than 1.567 billion USDT and Circle more than 800 million USDC; on-chain data show about $1.79 billion frozen in total. As of publication, Binance has not confirmed a hack and says it is investigating.

Not to be confused with the planned Binance Ethereum wallet maintenance a day earlier, covered in our note on the October 28 wallet maintenance.

What Binance has officially said

Binance posted on X that its teams are "aware of reports of a potential security issue and are actively investigating," adding: "At this stage, we have not confirmed any impact to user funds," according to Decrypt. Co-founder and Chief Customer Service Officer Yi He wrote on X: "We are aware of reports of a potential security issue and we are actively investigating," promised updates only through official channels and warned users about scam links, according to The Block. As of about 21:00 UTC Binance had not announced a withdrawal suspension, per The Crypto Times.

Both stablecoin issuers have now spoken. Tether CEO Paolo Ardoino said at about 21:25 UTC that Tether froze "more than 1.567B USDT" related to a potential Binance exchange hack, adding: "Protecting the industry and our partners is our main priority" (The Block, Crypto Briefing). Circle CEO Jeremy Allaire said Circle, "in coordination with law enforcement," froze more than 800 million USDC associated with the incident. The Block cites on-chain data showing about $1.79 billion frozen in total; the gap with the issuers' own figures has not been explained yet.

What is visible on-chain

Etherscan labelled the receiving addresses "Binance Hot Wallet Exploiter". How the signature for the delegation was obtained has not been published, and we will not guess. If you want to understand the mechanism in general terms, see our explainer on malicious EIP-7702 delegations.

Why the totals differ

The higher figures include Bitcoin and Tron flows whose link to the incident, rather than routine exchange activity, is not established. FinanceFeeds arrives at a similar ~$3.3 billion for Ethereum hot wallets. According to Unchained, about 200 million more USDT moved into the frozen address at 21:44 UTC and the Binance 14 delegation was still in place a few minutes later. On-chain data also show Aave freezing lending markets so the attacker could not borrow against the funds; Aave has not issued a statement, per The Block.

What third parties are saying

Binance founder Changpeng Zhao wrote on X around 21:15 UTC that "it does look like a hack on Binance" and that user funds are safe. He also wrote: "I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." His earlier freeze estimate of about $971 million USDT, reported by Crypto Briefing, has since been superseded by Tether's own figure.

Are your funds on Binance safe right now?

Nobody outside Binance can answer that with certainty yet. The official position is that no impact on user funds has been confirmed; the 2019 precedent, when Binance covered a 7,000 BTC hot wallet loss from its SAFU fund, is history, not a promise. What you can do is reduce what depends on that answer:

1. Log in only by typing the address yourself or via the official app; ignore links in emails, DMs and ads.
2. Check that your balance and open orders look right, and turn on a withdrawal address allowlist.
3. If you plan to withdraw to your own wallet, check the network and the address character by character.
4. Treat any "compensation" or "refund" message as phishing until Binance announces it on its own site.

Our step-by-step guide on what to do with funds on an exchange after a hack goes further. If you need to swap coins after moving them to your own wallet, you can use the exchange, for example BNB to USDT. Swaps are subject to our AML policy, and a transaction can be stopped if the funds look suspicious.