Binance Investigates Potential Security Issue as Trackers Put Related Outflows Near $5.7 Billion
By Crypto Wire
October 29, 2026
Binance says it is investigating a “potential security issue” after on-chain trackers flagged multi-billion-dollar outflows from exchange-linked wallets into a newly watched receiving account. In an official X post this afternoon Pacific, the exchange said user funds are “completely safe,” that security teams are reviewing the reports with urgency, and that updates will come only through official Binance channels. That is the desk’s first verified company statement — investigation acknowledged, impact on customers still not independently confirmed in that same post.
Founder Changpeng Zhao (@cz_binance), who says he no longer manages Binance.com, went further in his own post: “User funds are safe! It does look like a hack on Binance.” He credited rapid stablecoin freezes he put at roughly $971 million from Tether and $823 million from Circle, and said that as a shareholder he expects all user funds to be fully covered. Treat CZ’s “looks like a hack” line as his characterization, not a completed forensic report, and treat the freeze figures he cited as his snapshot — issuer posts a few minutes later carried higher or rounded totals of their own.
Tether CEO Paolo Ardoino said the firm “froze more than 1.567 billion USDT related to a potential Binance exchange hack.” Circle CEO Jeremy Allaire said Circle, “in coordination with law enforcement,” has “frozen more than 800 million USDC associated with the incident” and will keep supporting the investigation. Those issuer freezes are the clearest recovery-rail receipts so far: they do not prove final customer losses, but they do show both major dollar stablecoin issuers moving blacklists while the exchange investigates.
On the funds-trail side, CoinDesk, citing Arkham Intelligence, reported a new externally owned account holding more than $5.7 billion across assets after the suspected drain — including nearly $1.5 billion in bitcoin, about $900 million in ether, and roughly $1.4 billion in USDT and USDC combined. Decrypt separately tallied about $5.57 billion leaving Binance-linked wallets across Ethereum, Bitcoin, and Tron, and described an early Ethereum move that included a large ETH transfer plus dozens of token transfers into a brand-new address. Numbers are still moving as freezes land and as reporters refresh Arkham and explorer screens; the Rug Room’s job is to hold the trail to named sources, not to invent a final stolen total.
Secondary effects are already visible beyond the exchange perimeter. CoinDesk reported the suspected exploiter borrowed about 20,000 WETH (~$44 million) on Aave using stolen USDT as collateral — a classic post-drain laundering path if confirmed. Markets sold the headline: bitcoin slipped back toward the high-$78,000s, ether fell several percent, BNB underperformed with a mid-single-digit drop, and AAVE traded softer on the lending exposure. Ethereum gas also spiked into the high tens and low hundreds of gwei during the afternoon congestion window, which is why some NFT desks — including FREEDZ — publicly told holders to wait on non-urgent burns and transfers until fees settle.
What remains unproven in public primary sources is the exact privilege path into Binance’s hot wallets. Decrypt’s developing write-up discusses a possible EIP-7702 delegation against a Binance-labelled wallet minutes before a large Ethereum outflow, citing researcher commentary that delegated code can authorize later transfers without another signature. That is a hypothesis attached to explorer timing, not a closed case. Until Binance publishes a verified incident report — compromised key, insider, frontend injection, or something else — collectors should treat mechanism claims as provisional and avoid phishing “recovery” links that always follow exchange headlines.
For NFT and crypto readers, the practical recovery checklist is narrow. Watch official Binance channels for a confirmed user-fund impact statement. Watch Tether and Circle freeze ledgers for whether the blacklisted balances stay frozen or get clawed further. Watch the receiving EOA and any Aave debt positions for further hops. And ignore third-party DMs claiming to “refund” or “whitelist” wallets after a Binance hack — that social layer is usually the second attack.
What to watch on-chain next: the next confirmed hop out of the Arkham-flagged receiving wallet cluster, and whether Binance posts a verified incident report that states customer balances were or were not hit.
Bottom line: Binance is investigating a potential security issue while Arkham-linked tallies put related outflows near $5.7 billion and Tether/Circle freeze more than $1.8 billion in stablecoins — user-fund impact still awaits a verified exchange incident report.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
