October 29, 2026 (UTC): Binance said its teams were aware of reports of a potential security issue and were actively investigating. It said user funds were completely safe. The company has not confirmed a breach. On-chain analysts estimate suspicious outflows from Binance hot wallets at between about $3.3 billion and $5.8 billion, depending on the method. BreachHistory will add a catalog entry only once Binance or an authority confirms a breach.
Binance is one of the largest crypto exchanges. Its hot wallets are internet-connected wallets used for day-to-day withdrawals, so a large movement out of them is an early signal of either a theft or a large internal transfer. On-chain data shows where funds move, but not why they moved. That is why the figures below differ so widely.
What has been reported so far
- 21:29 UTC: Binance posted that it was investigating and that user funds were completely safe. It did not confirm a breach.
- Early estimate: the on-chain firm Blockaid put suspicious outflows from Binance hot wallets at about $3.3 billion across Ethereum, Arbitrum and Avalanche.
- Wallet tracing: the analyst Spreek tracked about $3.55 billion moved into a single unlabelled wallet.
- Upper estimate: Conor Grogan of Coinbase said the total could be as high as $5.8 billion, as reported by The Block.
- Stablecoin freezes: Tether and Circle reportedly froze about $1.79 billion in USDT and USDC on-chain. Tether’s CEO, Paolo Ardoino, later said more than 1.567 billion USDT had been frozen, as reported by The Block. The two figures have not been reconciled.
- Lending markets: Aave reportedly froze its lending markets as a precaution, according to on-chain data. Aave has not issued a statement.
- Former CEO: Changpeng Zhao said they no longer manage Binance.com and expect user funds to be fully covered, as reported by The Block.
Verified and unverified
- Company statement: Binance is investigating a potential security issue and says user funds are safe. It has not confirmed a breach, the amount, or the cause.
- Reported, not company figures: all outflow totals, wallet tracing, freezes and the Aave action come from on-chain analysts and reporting, not from Binance.
- Unverified: whether a breach occurred, the final amount, who is behind it, whether any user balances were affected, and how users would be covered.
Why the numbers differ
On-chain estimates depend on which wallets are attributed to Binance and which transfers are counted as outflows. Internal rebalancing, transfers between exchange-controlled wallets, and frozen balances can all look like losses from the outside. A stablecoin freeze is an action taken by the issuer, not proof that funds were stolen. Until Binance publishes a reconciliation, the range from $3.3 billion to $5.8 billion should be treated as a spread of estimates, not a loss figure.
Who may be affected
- Binance users with balances or open positions. The company says user funds are safe, but no independent audit or reconciliation has been published as of this post.
- Users of DeFi lending markets such as Aave, if they hold positions there. The reports describe a precautionary freeze only, and no loss on that platform has been reported.
- Anyone contacted by a "support" account claiming to handle the incident, recovery or compensation.
What to do
- Use only official Binance channels. Open the app or type the address yourself. Do not follow links from direct messages, replies or unexpected "support" accounts.
- Never share a seed phrase, password or 2FA code. Anyone asking for one is attempting theft, whatever the reason they give.
- Do not send funds to any address you are told will "secure" or "refund" your balance.
- Review your account now. Check recent withdrawals and logins, change your password, use an authenticator app rather than SMS, and revoke any API keys you do not use.
- Wait for a confirmed statement before acting on any claim about balances, compensation or withdrawal limits.
Other breach reports circulating today
Several other reports appeared the same day. We have not verified them, and none is a catalog entry.
- Florida Department of Education: a breach reported to affect about 4.9 million people (a databreaches.net headline), and another report describing Social Security numbers for about 5 million people. The figures differ, and we could not find the department’s own notice.
- US Department of Homeland Security: one report describes more than 20,000 employees affected, and another more than 41,000. We could not find a DHS statement, so the count is unconfirmed.
- Moldova: a report says the president called a security meeting after a major data breach. The Electronic Governance Agency breach of public digital services is already in the catalog. We could not confirm the meeting.
Sources and sourcing note
- Binance statement, 21:29 UTC, October 29, 2026, as relayed in the reporting supplied for this post
- Blockaid on-chain estimate; analyst Spreek wallet tracing; Conor Grogan (Coinbase) estimate; Tether CEO Paolo Ardoino; Changpeng Zhao: all as reported by The Block
Sourcing note: at the time of writing, independent searches found no other coverage of this event. The figures above come from the reporting supplied for this post and have not been independently verified. This post will be updated when Binance publishes a confirmed statement.