Binance Investigates Suspected $5.57 Billion Crypto Drain as Stablecoin Issuers Freeze Funds

Table of Contents

• You might want to know


• Main Topic


• Key Insights Table


• Afterwards...

You might want to know

• What is known about the reported movement of $5.57 billion from Binance-linked wallets, and why has Binance not confirmed that a hack occurred?


• How did Tether and Circle respond, and what does the incident reveal about the limits of freezing assets across public blockchains?

Main Topic

At least $5.57 billion in cryptocurrency moved from wallets linked to Binance across Ethereum, Bitcoin, and Tron on Thursday, October 29, 2026, according to an on-chain tally cited in reports. Binance, the world’s largest cryptocurrency exchange, said it was investigating a potential security issue. The company had not confirmed that its exchange was hacked, nor had it confirmed an impact to customer funds. The cause of the transfers and the identity of whoever authorized them remained unknown.

The distinction between a large, unusual transfer and a confirmed security breach is important. Blockchain records can show transactions, addresses, token amounts, and timing, but they do not by themselves establish how access was obtained or whether an exchange’s internal systems were compromised. Binance said its security teams were reviewing relevant information and would share updates through official channels after verifying details. Until that review produces findings, the incident should be described as a suspected breach rather than a confirmed hack.

The reported funds came from Binance-linked hot wallets. Hot wallets are connected to the internet and are used by cryptocurrency services to process transactions, including customer withdrawals. Their operational role means they need to be accessible, but that accessibility also makes their security and authorization controls a central concern. A wallet label attributed to Binance does not, by itself, explain who controlled a particular transaction or how the wallet’s signing process may have been affected.

The reported tally covered multiple networks: $3.51 billion on Ethereum, $1.44 billion in 18,270 Bitcoin, and $630 million on Tron. On Ethereum, the first reported transaction occurred at 20:24 UTC. It moved 167,464 ETH along with 63 token transfers to a newly created address. Those transfers included 1.615 billion USDT, a stablecoin designed to trade at $1. The scale and speed of the movement attracted attention, but a complete explanation depended on tracing activity across networks and examining how the relevant wallet permissions were used.

One detail raised by blockchain observers involved EIP-7702, an Ethereum feature that allows an ordinary wallet to execute smart-contract code through delegation. Three minutes before the initial Ethereum transaction, an address funded through Tornado Cash submitted a delegation for a Binance hot wallet, according to the reported analysis. Tornado Cash is a cryptocurrency mixer intended to obscure the trail of payments. The exact relationship between that address, the delegation, and the later asset movements had not been established in the initial reports.

Phylax Systems founder Odysseas Lamtzidi described a potential security implication of the feature: delegated code can remain in place and may authorize later transfers without requiring another signature from the wallet. That observation offers one possible technical avenue for investigators to examine, but it does not prove that EIP-7702 was exploited or establish how the required signature was obtained. The crucial unresolved question is how the authorization was created and whether the transfers resulted from compromised credentials, a wallet configuration, or another mechanism.

Stablecoin issuers responded by restricting funds at the receiving address. Tether froze 975.1 million USDT, while Circle froze 823 million USDC in the same main receiving wallet at 21:04 UTC. Together, the reported freezes amounted to about $1.8 billion. Tether issues USDT, and Circle issues the rival stablecoin USDC. Both companies can block designated addresses from transferring their tokens, giving them a response option that differs from the treatment of many decentralized assets.

Circle chief executive Jeremy Allaire said the company was tracking reports of a potential exploit involving Binance and had frozen more than 800M USDC in coordination with law enforcement. He also said Circle would continue supporting the investigation. These steps can prevent specified stablecoins from moving from a blocked address, but they do not recover every asset involved in a suspected incident. They also do not identify the person responsible or resolve how the transfers were initiated.

The response took place while funds were reportedly moving quickly. Reports said an additional $800M could still be eligible for freezing, while investigators and issuers continued to assess activity. Any such estimate is dependent on the assets’ location, type, and transaction status. Even when a token issuer can block a specific address, assets may be split, exchanged, bridged, or routed through other services, complicating efforts to follow and restrict them. The reported $1.8 billion freeze therefore represented a significant intervention, not a conclusion to the investigation.

Market prices also moved during the news. Bitcoin fell below $79,000 and was down about 2.6% over 24 hours. BNB, Binance’s own token, declined about 7% to roughly $699. Monero, a privacy-focused coin designed to obscure transaction details, rose about 6% to $637. The report compared that move with Monero’s rise of as much as 51% after a $333 million Bitcoin theft in April 2025. These price changes describe market behavior during a period of uncertainty; they do not establish that any particular asset was used in the suspected breach.

The reported scale would place the incident among the largest cryptocurrency thefts if investigators confirm that it was a hack. Binance previously lost 7,000 Bitcoin, worth about $40 million, in a 2019 hack. The $5.57 billion tally would be more than triple the roughly $1.5 billion Bybit heist in February 2025, described in the reports as the previous record. Comparisons of this kind depend on what assets are ultimately confirmed as stolen, whether any are recovered, and how values are calculated. The initial tally is therefore a measure of reported movement, not a final accounting of losses.

Several issues remain open: whether Binance customer assets were affected, how the relevant wallet was authorized, which transfers can be stopped or recovered, and whether the movement spans more assets or addresses than the initial tally captured. Binance’s investigation, on-chain analysis, issuer actions, and law-enforcement work may help answer those questions. Until verifiable findings are published, conclusions about the cause and total damage should remain provisional.

Key Insights Table

Afterwards...

The next stage is careful verification. Investigators will need to reconcile transactions across Ethereum, Bitcoin, and Tron, establish how wallet permissions were applied, and distinguish confirmed losses from assets that were transferred but remain recoverable. Clear public updates can help customers understand what is known without treating early estimates or technical theories as established findings. For exchanges, the episode underscores the importance of reviewing hot-wallet exposure, authorization procedures, key management, and monitoring for unusual delegations or transaction patterns.

The incident also highlights a broader question for digital-asset systems: how can rapid emergency intervention coexist with transparent, reliable safeguards? Stablecoin issuers can block tokens at designated addresses, which may help contain some losses, but such control is not available for every asset or network. Further work on cross-chain tracing, incident coordination, secure wallet design, and standards for communicating verified information could improve responses while preserving a careful distinction between an issuer’s intervention and a complete recovery.

Future research should focus on making wallet authorization easier to audit, testing delegated execution against realistic attack scenarios, and improving collaboration among exchanges, token issuers, investigators, and blockchain analysts. These efforts will not remove every risk, but they can help the industry identify unusual activity sooner, clarify what happened, and respond with better evidence when large transfers occur.