The story in brief
- Binance says it is investigating a potential security issue after trackers reported about $5.6bn in gross outflows on 29 October. A spokesperson told Gizmodo customer funds are completely safe.
- Tether and Circle have frozen more than $2.3bn in stablecoins, according to PANews. Frozen is not the same as returned, and the gross outflow figure is not a confirmed customer loss.
- The cause, any customer impact and any compensation process are unconfirmed. Open Binance directly, secure your login and ignore unsolicited recovery offers.
What happened at Binance?
Late on 29 October 2026 UTC, blockchain trackers began flagging unusually large transfers out of wallets associated with Binance, the world's largest crypto exchange by trading volume. Decrypt reported at least $5.57bn in outflows across Ethereum, Bitcoin and Tron within hours, and described the activity as a suspected hack.
The first Ethereum transaction identified by Decrypt was recorded at 20:24 UTC. It moved 167,464 ETH alongside 63 token transfers, including about 1.615bn USDT. The transaction is publicly visible on Etherscan. We link to it as a public record, not as an attribution of who controlled the receiving address.
Binance's first public statement described a potential security issue that it was investigating, and said impact on user funds had not been confirmed. That wording matters: an investigation is not a confirmed breach.
How much money is involved?
The figures are moving, and they measure different things. PANews reported a tally of about $5.643bn in gross outflows as of 05:22 Beijing time on 30 October (21:22 UTC on 29 October). It broke that down by network:
- Ethereum: about $3.528bn
- Bitcoin: about $1.449bn
- Tron: about $628m
- Arbitrum, Optimism and Base combined: about $38m
What is confirmed, and what is not?
These are third-party on-chain tallies, not an audited figure from Binance. Gizmodo noted that headline totals above $5bn may be an overestimate. Money moving between addresses is not, by itself, a final loss calculation. Nothing in the sources reviewed establishes a net customer loss.
Researchers cited by Decrypt linked the activity to an EIP-7702 delegation that preceded the transfers. EIP-7702 is an Ethereum feature that lets an account delegate actions to code. How the authorising signature was obtained is unknown. This is an early line of inquiry, not a confirmed cause and not a demonstrated flaw in Ethereum itself.
No source reviewed confirms a leak of customer personal data, a number of affected users, the root cause or a compensation mechanism. We will not fill those gaps with guesses.
What does a stablecoin freeze mean?
Stablecoin issuers can block specific tokens at addresses they flag. Early counts in Decrypt put freezes at about 975.1m USDT and 823m USDC, roughly $1.8bn. Gizmodo later reported Tether's chief executive saying more than 1.567bn USDT had been frozen, with Circle at about $823m. PANews' later tally put total frozen stablecoins at no less than $2.316bn.
The reports use different times and scopes, so their freeze figures should not be added together or treated as one reconciled total. A freeze restricts movement of the affected tokens. It does not return them to Binance or to any customer, and the sources reviewed do not establish a process for returning them.
Is this the largest crypto hack ever?
Only if the outflows are confirmed as theft at something close to the reported scale. Decrypt and Gizmodo both compare it to the Bybit incident in February 2025, which involved about $1.5bn and is widely described as the largest crypto theft to date. Until Binance or investigators confirm what was taken, a record claim is conditional.
Binance founder Changpeng Zhao, who no longer runs the exchange, said publicly that the activity looked like a hack and that he expected losses to be covered. That is his view, not an independent guarantee or a formal Binance compensation commitment.
What should Binance customers do now?
While the investigation continues, watch for scams that exploit the news as well as unexpected activity in your account. These are account-security steps, not advice to buy, sell or keep funds on an exchange:
- Open Binance directly. Use the official app or a typed address. Do not follow links from messages, social posts or search ads about the incident.
- Check your account. Review transaction history, logged-in devices, withdrawal address lists and API keys. Remove anything you do not recognise.
- Secure your login and email. Use a unique password and app-based two-step verification on both Binance and the email account linked to it.
- Never share secrets. No genuine support agent needs your seed phrase, private key, password or one-time codes.
- Do not sign recovery transactions. Ignore anyone offering to recover, refund or protect your funds through a wallet connection or signature request.
- Document anything unusual. Screenshot unexpected activity and report it through Binance's official support channel inside the app.
Should you move crypto into self-custody?
Moving coins to your own wallet swaps one set of risks for another. Exchange custody depends on the platform's security. Self-custody depends on yours: a lost seed phrase, a malicious approval or a phishing site can be irreversible, with no support desk to call. It is a personal decision, not a blanket fix, and making it in a hurry during a scam wave raises the chance of mistakes.
Why scammers follow incidents like this
Binance's spokesperson specifically warned customers about scams and unofficial links. Large, public incidents create perfect cover for fake support accounts, cloned recovery portals and messages that claim your account was affected. A real incident does not make any follow-up message genuine.
Check your exposure
A ProtectMyData scan checks known exposure linked to an email address you submit. It cannot see wallet balances, trace transactions or recover coins, and it cannot tell you whether you were affected by this incident.
Binance response
Binance's initial statement described a potential security issue under investigation, without confirmed impact on user funds. In an update quoted by Gizmodo on 29 October (18:35 US Eastern time), a spokesperson said customer funds were completely safe, the investigation was continuing, and customers should be cautious of scams and unofficial links.
Timeline
Delegation precedes the transfers
Researchers cited by Decrypt link an EIP-7702 delegation to the activity. How the signature was obtained is unknown.
First large Ethereum outflow
A transaction moves 167,464 ETH and 63 token transfers, including about 1.615bn USDT, according to Decrypt and the public Etherscan record.
Binance confirms an investigation
The exchange describes a potential security issue and says impact on user funds is not confirmed. Decrypt tallies at least $5.57bn in outflows and about $1.8bn in early stablecoin freezes.
Outflow tally reaches about $5.643bn
PANews cites this cutoff, 05:22 Beijing time on 30 October, for gross outflows across Ethereum, Bitcoin, Tron and layer-2 networks. It also reports at least $2.316bn in stablecoins frozen. Not independently audited.
Spokesperson says funds are safe
Gizmodo's report, updated at 18:35 US Eastern time, quotes Binance saying customer funds are completely safe and warning about scams. Tether's chief executive reports more than 1.567bn USDT frozen.
How we checked this report
How we checked this report
This report was prepared on 29 October 2026 UTC (30 October in Australia) from Decrypt, Gizmodo and PANews. We also link the public transaction record cited by Decrypt. Binance statements are quoted as reported by those outlets, not from an interview with us. Outflow and freeze totals are attributed to their publishers and have not been independently audited by us.
We have not attributed the activity to any actor, and we do not repeat unverified per-token dollar lists circulating on social media. Figures will change as investigators publish.
Update notes
30 October 2026 (AEDT): First report prepared from Decrypt, Gizmodo and PANews, with a link to the transaction record cited by Decrypt. Outflow totals attributed; cause, customer impact and compensation marked unconfirmed.
Questions readers ask
Was Binance hacked?
Binance says it is investigating a potential security issue. Trackers and several outlets describe a suspected hack, but as of our reporting the exchange had not confirmed theft or a cause.
Did customers lose $5.6bn?
No source establishes that. About $5.6bn is a third-party tally of gross outflows, not net customer losses, and more than $2.3bn in stablecoins has reportedly been frozen.
Is my personal data affected?
No source reviewed reports a leak of customer personal data. Be wary of messages claiming otherwise, especially ones asking you to verify your identity or connect a wallet.
Will Binance cover losses?
Founder Changpeng Zhao said he expected losses to be covered, but he no longer runs the exchange. Binance had not described a compensation process in the sources reviewed.
Should I withdraw my crypto now?
We do not give investment advice. Withdrawing in a hurry can expose you to phishing and wallet mistakes. Check your account directly and follow official Binance updates.
Sources
- Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 BillionDecrypt, 29 October 2026
- Binance Investigating Possibly Massive HackGizmodo, Updated 29 October 2026, 18:35 ET
- Data: Outflows in suspected Binance breach may reach $5.6 billion, involving Bitcoin and TronPANews, 29 October 2026 UTC, citing a 05:22 Beijing-time tally on 30 October
- First identified Ethereum outflow transactionEtherscan, public blockchain record, 29 October 2026, 20:24 UTC
- Report a scamScamwatch, Australian National Anti-Scam Centre, Practical reporting guidance
- Report fraudUS Federal Trade Commission, Practical reporting guidance
Published 29 October 2026. Last checked and updated 29 October 2026. We do not link to attacker material.
