Binance Investigates Suspected $5.7 Billion Hack

Binance is investigating a suspected multibillion-dollar security breach after large transfers emptied assets from exchange-labelled wallets on October 29. Tether and Circle have separately announced freezes totalling more than $2.367 billion in stablecoins linked to the incident, while Binance says customer funds are safe. A widely circulated $5.7 billion estimate has not yet been reconciled into a final loss figure by the exchange. Binance statement, Tether statement, Circle statement.

The $5.7 billion figure comes from CoinDesk’s developing coverage, which cites holdings tracked through Arkham Intelligence. CoinDesk describes the event as the largest crypto hack to date. Binance’s own public statement is more limited: it acknowledges reports of a potential security issue and an active investigation, without specifying the amount stolen, the affected infrastructure or the cause.

The distinction matters for customers and businesses relying on the exchange. Assets moved out of a wallet, balances attributed to an attacker, funds frozen by an issuer and money ultimately recovered are separate measures. The available evidence supports serious concern about a breach, but does not yet establish the exchange’s eventual financial loss or any customer shortfall.

An Ethereum transaction provides a concrete record of the scale. At 20:24:23 UTC on October 29, equivalent to 21:24:23 CET, a transaction moved approximately 167,464.25 ETH and 1.615 billion USDT from the address labelled “Binance 14” to an address now labelled “Binance Hot Wallet Exploiter 2” by Etherscan. The same transaction records transfers of 63 ERC-20 tokens, including RLUSD, wrapped staked ETH, Tether Gold, UNI and USD1. View the transaction on Etherscan.

The receiving address is 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c. Etherscan’s transaction record verifies the transfers; its exploit labels provide the explorer’s attribution. Neither the labels nor this single transaction establish the complete amount affected across other wallets and blockchains.

Blockchain researcher Spreek was among those raising the alarm. In an initial public alert, the researcher described a Binance wallet being drained into a new externally owned account and said the initiating contract call was funded through Tornado Cash. The alert explicitly marked the incident as unconfirmed. That observation is relevant to tracing the activity, but does not establish how the person initiating the transfers obtained access or identify the attacker.

Binance subsequently said its security teams were urgently reviewing the available information and would provide verified updates through official channels. It also cautioned customers against unofficial links, messages and requests for account information. The statement included the assurance that “User funds are completely safe,” but did not set out a recovery plan or explain the financial resources behind that assurance. Read Binance’s statement.

Founder Changpeng Zhao, known as CZ, went further in his own public response: “It does look like a hack on Binance.” He said customer funds were safe and expressed an expectation that they would be fully covered. Zhao also explicitly noted that he no longer manages Binance.com and was speaking as a shareholder. His remarks support the assessment that the transfers are suspicious, while leaving the exchange responsible for explaining the incident and any arrangements to protect customers.

The stablecoin issuers’ responses provide the clearest figures for containment so far. Tether chief executive Paolo Ardoino said the company had frozen more than 1.567 billion USDT associated with a potential Binance exchange hack. Circle chief executive Jeremy Allaire separately said more than 800 million USDC had been frozen in coordination with law enforcement. Ardoino’s announcement, Allaire’s announcement.

Those issuer figures imply more than $2.367 billion frozen at the tokens’ intended dollar value. They also supersede the earlier amounts cited by CZ, who referred to approximately $971 million at Tether and $823 million at Circle. A freeze is a containment step: neither issuer’s statement says the assets have already been returned to Binance. It would therefore be premature to subtract the frozen total from the $5.7 billion headline and present the remainder as a confirmed loss.

The reports may also have implications for decentralised lending. In a separate on-chain observation, researcher MonetSupply said the suspected Binance exploiter appeared to have borrowed approximately 20,000 wrapped ETH through Aave against USDT collateral. The report raises a further question about where assets went after leaving the exchange. It does not, on its own, establish that Aave has suffered a loss or that the protocol’s contracts were compromised.

Markets reacted before the financial impact was clear. In its October 29 report, updated at 22:11 UTC, CoinDesk described bitcoin trading around $78,800, down approximately 3%, with ether down 4%, BNB down 6.7% and AAVE down 8%. These are the article’s reported snapshot figures, rather than current quotations or a measure of losses caused solely by the incident. CoinDesk market coverage.

For fintech companies using exchanges for custody, conversion or settlement, the developing incident highlights several distinct operational questions. A statement that customer balances are protected does not, by itself, describe withdrawal availability, settlement timing or the status of every connected service. The public Binance statement reviewed for this report does not provide those details, and this report has not independently tested deposits or withdrawals.

The combination of wallet tracing, issuer freezes and reported lending activity also shows why recovery requires more than one headline number. Each stage needs its own evidence: which transfers were unauthorised, which addresses remain under the suspected attacker’s control, which assets cannot currently move, and which funds have actually returned to their owner. Reporting all four as a single loss total would obscure the position of both Binance and its customers.

As of the reporting cutoff, the sources reviewed did not establish the attacker’s identity, the initial point of compromise, a complete list of affected wallets or a final accounting of unrecovered assets. Binance’s next substantive disclosure will be needed to explain the scope of the breach, any service restrictions and how its customer-fund assurance will be implemented. The $5.7 billion estimate should remain attributed to external reporting until that accounting is available.

Fintech Garden reviewed the cited public statements and Ethereum transaction; the full Arkham-based estimate has not been independently reconciled across all chains.