Binance Hack Drains $5 Billion as CZ Vows Coverage

Spreek Flags the Drain First

A pseudonymous analyst named Spreek saw the money move first. Binance had yet to say a word in public. “Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash,” Spreek posted at 20:32 UTC, with a screenshot of the transfer⁴.

The mechanics came together fast. An address funded through Tornado Cash, a tool that scrambles a payment's trail, had deployed a smart contract four hours earlier. At 20:21 UTC, that contract took over a Binance hot wallet. The contract used EIP-7702, an Ethereum feature that lets a normal wallet run smart-contract code for a while⁵⁹. Odysseas Lamtzidi, founder of the security firm Phylax Systems, explained the opening it left. “7702 lets a normal wallet execute delegated code. The delegation persists; that code can authorize later transfers without another signature from the wallet,” Lamtzidi said. Three minutes later, the first transfer moved out. That transfer carried 167,464 ether and 63 other tokens to a brand-new address.

CZ Moves Faster Than Binance's Own Statement

Zhao left Binance's chief executive chair in 2023. U.S. prosecutors settled charges against him that same year. He still holds a large stake in the exchange. That day, he spoke only as a shareholder. “I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered,” he wrote, one sentence after calling the outflow a hack¹.

Binance's own account posted one minute behind him. Its words moved three times in 13 minutes. The first version read: “Our teams are aware of reports of a potential security issue and are actively investigating. At this stage, we have not confirmed any impact to user funds”³. Eight minutes later, the exchange deleted that second sentence outright. Five minutes after that, it posted a third version. The new line added "User funds are completely safe" where the dropped sentence used to sit. All three versions skipped the word hack¹⁴.

Tether and Circle Freeze What They Can Reach

Stablecoin issuers moved faster than Binance's statement did. Tether chief executive Paolo Ardoino posted his own number within ten minutes of Zhao's post. “Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone,” Ardoino wrote⁷. Circle chief executive Jeremy Allaire said his firm moved in step with investigators too. “In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident,” Allaire said⁵.

That power has a limit. Tether and Circle can freeze a wallet. Each company controls the ledger entry behind its own coin. Ether follows its sender's transaction alone. Roughly $700 million in ether and USDT moved before the freezes landed, or through wallets the freezes missed. That money stayed beyond either company's grasp⁸. Coinbase senior product leader Conor Grogan tallied every chain and reached a higher figure. He put the total outflow at up to $5.8 billion⁶. Other trackers had reached $5.57 billion first⁵.

The Market Drops, Then Steadies

Ethereum carried the biggest share of the suspected outflow, $3.51 billion. Bitcoin wallets lost $1.44 billion, and Tron wallets lost $630 million⁵⁹.

Traders reacted before anyone confirmed a cause. BNB fell from $738.90 to $692.32 between 20:15 and 20:50 UTC. That is a drop of 6.3% in 35 minutes¹⁰. Leveraged positions worth $628 million closed within the same hour, adding to the slide⁹. Bitcoin slipped under $79,000 the same evening. By 23:02 UTC, bitcoin traded at $78,859 and BNB at $705.54, CoinGecko's own feed showed¹¹.

Binance has covered a loss like this before. The exchange replaced 7,000 stolen bitcoin from its SAFU reserve fund after a 2019 breach. Binance kept every customer whole that time¹⁰. Thursday's outflow might end the same way, or it might end differently. The answer rests on a cause only Binance could confirm so far. TechCrunch reported that investigators were still searching for a suspect. Binance had kept its explanation of the signing authority private¹⁵.

A Second, Smaller Hack Hit Polymarket the Same Day

Polymarket lost money on Oct. 29 too. The account world posted a warning about the prediction market within the same two hours. “BREAKING: Polymarket frontend may be hacked. Trading has been restricted to cancel-only mode and relayer actions paused. There are reports of user wallets being drained and a frontend compromise,” world wrote at 18:15 UTC¹².

Polymarket traced the cause to a vendor instead of its own code. “One of our third party providers was compromised, and we have referred this to relevant law enforcement,” the platform said¹³. Arkham's blockchain data put the loss at roughly $2.65 million. Nearly 1,000 accounts lost money. That sum ran two thousand times smaller than the amount moving through Binance's wallets the same evening. Polymarket resumed trading. The platform pledged to make affected traders whole.

By the numbers

• Binance's suspected outflow reached $5.57 billion across Ethereum, Bitcoin and Tron wallets that evening⁵.
• Coinbase's Conor Grogan put the same outflow as high as $5.8 billion once every chain was tallied⁶.
• Tether froze $1.567 billion in USDT tied to the incident, Paolo Ardoino's own count⁷.
• Circle froze $823 million in USDC the same evening, Jeremy Allaire's own count⁵.
• Three edits in 13 minutes carried Binance's account from "not confirmed" to "completely safe"³.
• BNB's price fell 6.3% between 20:15 and 20:50 UTC, before the token steadied¹⁰.
• Leveraged trading positions worth $628 million closed within one hour of the first transfer⁹.
• Polymarket traced a separate $2.65 million loss to a compromised vendor the same day¹³.

What to watch

Watch for Binance's own post-mortem. TechCrunch found one question still open: how the attacker got the hot wallet's signing authority. A SAFU repayment on the scale of 2019's would test whether Zhao's vow and Binance's balance sheet move together. Tether and Circle's next freeze reports will show how much of the $700 million gets traced and tagged. BNB's price over the coming days will say whether traders believed Thursday's reassurance, or merely paused their selling.

Sources

1. Changpeng Zhao, "User funds are safe!," post on X, Oct. 29, 2026, https://x.com/cz_binance/status/2115915423174853077
2. Binance, "Our teams are aware of reports of a potential security issue," post on X, Oct. 29, 2026, https://x.com/binance/status/2115918888429133902
3. Tobi Opeyemi Amure, "Binance Hack: Statement Edited Twice to Say Funds Are Safe," FinanceFeeds, Oct. 29, 2026, https://financefeeds.com/binance-hack-statement-edited-user-funds-safe/
4. Spreek, "Unconfirmed, but possibly massive binance hack," post on X, Oct. 29, 2026, https://x.com/spreekaway/status/2115904721856651382
5. Jose Antonio Lanz, "Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 Billion," Decrypt, Oct. 29, 2026, https://decrypt.co/382191/binance-suspected-hack-5-billion-tether-circle-freeze-crypto
6. Jason Shubnell and Yogita Khatri, "Binance investigating hack as suspicious outflows reach up to $5.8 billion," The Block, Oct. 29, 2026, https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171
7. Paolo Ardoino, "Tether froze more than 1.567B USDT related to a potential Binance exchange hack," post on X, Oct. 29, 2026, https://x.com/paoloardoino/status/2115918000373346709
8. "Tether Freezes $1.567 Billion USDT in Suspected Binance Hack," CryptoBriefing, Oct. 29, 2026, https://cryptobriefing.com/tether-freezes-usdt-suspected-binance-hack/
9. "Suspected Binance hack: up to $5.6bn drained from the crypto exchange's wallets," Kipr Inform, Oct. 29, 2026, https://www.kiprinform.com/en/news/suspected-binance-hack-up-to-5-6bn-drained-from-the-crypto-exchanges-wallets/
10. "BNB Crash After the Binance Hack: Another FTT Moment?," CryptoTicker, Oct. 29, 2026, https://cryptoticker.io/en/bnb-price-crash-binance-hack-ftt-comparison/
11. CoinGecko, "Bitcoin (BTC) and Binance Coin (BNB) simple price feed," Oct. 29, 2026, https://api.coingecko.com/api/v3/simple/price?ids=binancecoin,bitcoin&vs_currencies=usd&include_last_updated_at=true
12. world, "BREAKING: Polymarket frontend may be hacked," post on X, Oct. 29, 2026, https://x.com/world_xyz/status/2115870141456208292
13. "Polymarket resumes trading after $2.65 million exploit, says third-party provider was compromised," The Block, Oct. 29, 2026, https://www.theblock.co/news/defi/2026-10-29-polymarket-exploit-2-5-million-cancel-only-mode-432158
14. "Binance Says User Funds Are 'Completely Safe' After $3.5 Billion Drains From Its Hot Wallets," Unchained, Oct. 29, 2026, https://unchainedcrypto.com/binance-says-user-funds-are-completely-safe-after-3-5-billion-drains-from-its-hot-wallets/
15. "Binance pauses withdrawals as hackers suspected of stealing billions in crypto," TechCrunch, Oct. 29, 2026, https://techcrunch.com/2026/10/29/binance-pauses-withdrawals-as-hackers-suspected-of-stealing-billions-in-crypto/