Changpeng Zhao helped start Binance. People call him CZ. He left the chief executive job in 2023. On Oct. 29 a Binance wallet lost $2.8 billion. One single move did it. The wallet is a hot wallet. A hot wallet holds coins ready for fast trades. At 9:15 p.m. UTC, CZ posted on X. He said user funds are safe. He said it reads as a hack on Binance.

He thanked two firms first. Tether froze $971 million. Circle froze $823 million. Both firms make stablecoins. A stablecoin is a coin priced to match the dollar. A freeze stops a thief from moving the coin. CZ left day to day control of Binance.com in 2023. He still owns a piece of it. He said he expects full cover for users.

The tally kept climbing fast. Across three chains, the hole hit $5.57 billion. Ethereum lost $3.51 billion. Bitcoin lost $1.44 billion, about 18,270 coins. Tron lost $630 million. BNB is Binance's own coin. It dropped 6.3 percent in 35 minutes. It fell from $738.90 to $692.32. Before Oct. 29, the biggest exchange hack was Bybit's, near $1.5 billion.

CZ's post earned 19,817 likes within hours. That crowd beats most football stadiums. People want a familiar face to say the money is safe. CZ left the top job three years ago. He still carries the trust Binance built around his name. That split tells you something true about crypto today. A founder can step down from a title. The public keeps trusting the person more than the paperwork. Money moves fast in this market. Faith in a name moves slower.

Binance itself used softer words that night. It spoke of a potential issue first. CZ spoke of a hack right away. Watch which version Binance settles on next.

Paolo Ardoino runs Tether. Tether makes a stablecoin called USDT. A stablecoin is a coin priced to match the dollar. On Oct. 29 a big sum left Binance fast. The outflow ran from 8:24 to 9:04 p.m. UTC. That is 40 minutes. At 9:25 p.m. UTC, Ardoino posted on X. He said Tether froze more than $1.567 billion USDT. He tied the freeze to a suspected Binance hack. He said protecting partners comes first. He told people to stay safe.

A freeze locks coins in place. The coins sit at one address. A thief can hold frozen coins. A thief loses the power to spend them. Circle runs a rival stablecoin, USDC. Circle froze $823 million the same evening. Together the two firms locked close to $2.4 billion. That sum stopped moving within an hour. Binance's own hot wallet lost $2.8 billion in one single move. That wallet carries the name Binance 14.

The numbers around this hack grew all night. On-chain trackers put the full suspected loss at $5.57 billion. That spans three blockchains at once. Bitcoin's price felt the shock too. It now trades near $78,854, per CoinGecko. That marks a sharp drop from the week before.

Ardoino's post pulled in 7,413 likes. It drew 863 replies and quotes. Crypto people lean on firms like Tether at moments like this. A stablecoin promises a steady price. Tonight it also became a brake on theft. Two private firms, Tether and Circle, moved faster than any single government did. They froze billions before regulators said a word. That says something plain about crypto today. The industry built its own safety net first. Readers should ask who holds that power next time trouble hits. Tonight it sat with two company chiefs. A court stayed silent throughout.

Spreek studies crypto wallets for a living. People call this work on-chain research. At 8:24 p.m. UTC on Oct. 29, a Binance wallet moved fast. At 8:32 p.m. UTC, Spreek posted the first public alarm. He wrote that Binance's wallet looked drained. The coins went to a brand new address. He called it an EOA. An EOA is a plain wallet with a single owner. He said the mover used Tornado Cash first. Tornado Cash hides where coins start their trip.

The method used a newer Ethereum rule, EIP-7702. That rule lets a plain wallet behave as a small program for one transaction. Binance's wallet signed with its own key. That detail matters a lot. It means the key itself may have leaked. In one move, the wallet sent out 167,464 ETH. That stash alone was worth about $388 million. The same transfer carried $1.6 billion in USDT too. The attacker set up the delegation three minutes before the drain. Binance calls this wallet Binance 14.

Spreek's post spread within minutes. It earned 6,232 likes. It drew 822 reposts and 639 replies. News outlets and other traders quoted his words for hours after. He spotted the pattern eight minutes after the drain began. Big exchanges rarely pay network fees through a mixer like Tornado Cash. That single clue tipped him off early.

Most crypto users had barely heard his name before Thursday. Spreek works alone, apart from any company or newsroom. A lone researcher beat Binance's own staff to the story. He also beat every major news outlet to it. That gap says something plain about crypto today. Trust here often starts with a stranger reading a blockchain in real time. Readers waited on Binance for confirmation. Binance stayed quiet the longest of anyone that night.

Binance is the world's biggest crypto exchange. At 9:16 p.m. UTC on Oct. 29, its account posted on X. The first line said teams were checking an issue. That version skipped any promise about user funds. Binance edited the post two more times. The edits took 13 minutes in all. By 9:29 p.m. UTC, the wording had shifted. The final line said, "User funds are completely safe." The early hedge about funds was gone.

Binance's co-founder Yi He posted a close match seven minutes earlier. She also called it a possible issue. Binance stuck with soft words that night. Changpeng Zhao, Binance's founder, chose a harder word. He called the event a hack in plain terms.

The size of the loss kept growing. On-chain trackers found $3.51 billion gone on Ethereum. Bitcoin losses hit $1.44 billion, near 18,270 coins. Tron lost $630 million more. Across three chains, the total passed $5.57 billion. That stands as crypto's biggest single exchange hack on record. The old record was Bybit's $1.5 billion loss.

Binance's post drew 4,423 likes. It pulled 561 replies and 333 reposts. People read every word in a moment like this. A firm moving from a hedge to a flat promise tells a story. The first draft may have felt too risky to leave up. Crypto firms often write fast in a live crisis. Speed can cost a firm its care with words. Binance chose comfort over a careful hedge within minutes. That choice says something plain about crypto today. A promise made in a rush still counts as a promise. Readers should watch for the full count Binance owes next. That count needs real numbers in place of soft words.

Polymarket lets people bet on real world events. One user picks an outcome and risks cash on it. On Oct. 29 its website had a problem. The front end is the part users see and click. A bad script slipped into that front end. At 6:15 p.m. UTC, the account World posted on X. It warned that Polymarket's front end may be hacked. It said trading sat in cancel-only mode. Cancel-only means a trader cancels old orders only. New orders stop going through.

The bad script ran from 5:50 to 5:56 p.m. UTC. A helper tool called a relayer also got paused. A relayer sends trades to the blockchain for users. Pausing it stops new trades cold. Polymarket named the real cause soon after. A vendor called DebugBear had been compromised. DebugBear's code touched Polymarket's site by mistake.

Investigators traced about $2.5 million to one wallet. Close to 28.6 million POL tokens moved through it. The Block later put the loss near $2.65 million. Trading came back online at 7:05 p.m. UTC. Polymarket promised to repay every trader hurt by the breach. A similar breach hit Polymarket back in June. A vendor compromise cost traders about $3 million that time too.

World's post reached 176 likes. It drew 47 replies and quotes. The same night, Binance faced a far bigger scare. Two platforms people trust with real money both wobbled within hours. Crypto services often lean on small vendors users rarely see. One bad script at one small firm can freeze a major market. That gap says something plain about crypto today. Few people outside a company ever read that code line by line. Billions in trades move through work only a handful of engineers check.

A researcher posts under the name Officer's Notes. At 9:46 p.m. UTC, they posted a long note on X. They pointed to a wallet they called Binance 16. Other trackers had named a different wallet, Binance 14. Even expert trackers disagreed on which wallet broke first. The note said the hack began with an EIP-7702 delegation. That rule lets a plain wallet run code for one trade. The note said Binance's own signing key leaked.

By their count, Tether and Circle froze near $2.3 billion. They said the thief still borrowed 20,000 WETH on Aave. WETH is Ether wrapped to work inside lending apps. Their running total read $3.5 billion gone on Ethereum alone. With Bitcoin and Tron added in, their number hit $5.64 billion.

Other trackers landed close by. Decrypt's own count put the suspected total at $5.57 billion. Aave froze its Avalanche lending markets the same night. About 1.81 million AVAX sat tied to the case. The freeze blocked the thief from using stolen coins as collateral. Binance's own coin, BNB, now trades near $701.67, per CoinGecko. Bitcoin sat near $78,854 that same hour, per the same source. Both prices sit well under where they stood a day before.

This post earned 142 likes. It drew only 13 replies and quotes. That crowd ran far smaller than CZ's crowd. Yet this small post helped shape the whole story that night. Big accounts waited on small accounts to run the math first. Binance stayed slow with hard numbers of its own. Strangers on X filled that gap within the hour. That gap says something plain about crypto today. Trust goes to whoever shows their work the fastest. A clear chain of proof outweighs a title.