What was said about the suspected Binance incident on 29 October 2026
Public reports that evening described large outflows from Binance hot wallets. The exchange, its founder and the stablecoin issuers did not use the same words, and the amounts did not match.
On 29 October 2026, blockchain analysts flagged large transfers out of wallets associated with Binance during a window of roughly forty minutes, starting around 20:24 UTC. The receiving addresses were described as newly created, and part of the activity was linked in public reporting to Tornado Cash.
This note records what the public statements said that night. It is not a post-mortem. Binance said the investigation was still open.
What Binance and its founder said
Changpeng Zhao, who no longer runs the exchange, wrote on X that the outflows looked like a hack and that, as a shareholder, he expected user funds to be covered in full. That message landed before the company's first post.
Binance's own post on X went up at 21:16 UTC. FinanceFeeds reviewed the edit history: the first text said an impact on user funds was not confirmed; a later edit, at 21:29 UTC, said user funds were completely safe. The company still described the event as a potential security issue under investigation.
Yi He, co-founder, posted later that user funds were safe, that Binance would cover hacking losses, and that deposits and withdrawals were suspended while the team ran security checks, froze funds and worked with law enforcement. She asked people to wait for a post-mortem and to use only official channels.
Why the public figures do not match
CoinDesk reported a theft above 5 billion dollars, with an address holding about 5.7 billion across bitcoin, ether and stablecoins, and bitcoin trading back near 79,000 dollars. Other outlets put the flow between about 2.5 and 3.5 billion. Those are competing public estimates, not a Binance balance sheet.
CoinDesk also reported that Tether's Paolo Ardoino said more than 1.57 billion dollars of USDT had been frozen, and that Circle's Jeremy Allaire said more than 800 million dollars of USDC had been frozen. A freeze is a control on a token contract. It is not, by itself, a statement of how much left the exchange.
Who is affected while the investigation is open
Customers were told withdrawals and deposits were paused. Anyone who holds funds on the venue depends on that pause ending against a verified ledger, not against a social-media edit. Aave was mentioned in market coverage as a protocol that could feel the move in collateral; that is a market risk, separate from whether Binance customer balances are intact.
The other audience is everyone receiving a direct message. A paused withdrawal is when fake support accounts ask for a seed phrase, a reset code or a 'verification' signature. The official instruction that night was to ignore unofficial links and messages.
What to verify, and what operators should already have
For an account holder: open the exchange only from a bookmark or the official app, not from a link in a reply. Wait for the post-mortem Binance said it would publish. Do not send a phrase or a signature to someone offering to 'unlock' the withdrawal. The patching version for this report is not a wallet build. Binance did not name one. The control they stated was the halt on deposits and withdrawals while checks ran.
For an operator who runs hot wallets of their own: the useful controls are dull and already known. Cap what a hot wallet can hold, allowlist destinations, delay large withdrawals, and require an out-of-band confirmation that does not travel in the same tool that builds the transaction. None of that reconstructs this incident. It is the set of limits that keeps one compromised signer from emptying a treasury.
CoinDesk's market report and FinanceFeeds' reading of the edited Binance post are the public record used here. Both were published on 29 October 2026.
https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets
Frequently asked questions
Did Binance confirm a hack on 29 October 2026?
The company's posts that night called it a potential security issue under investigation. Zhao called it a hack. Yi He said user funds were safe and that hacking losses would be covered. A full post-mortem had not been published when this note was written.
How much was taken?
Public estimates that evening did not agree. CoinDesk described holdings above 5 billion dollars. Other reports put the flow nearer 2.5 to 3.5 billion. Treat those as analyst estimates until Binance publishes a figure.
What should a customer do?
Use only the official app or a bookmarked site, ignore messages that ask for a seed phrase or a signature, and wait for the post-mortem. Withdrawals were suspended while checks were running.