Skip to main content
boxmining
Menu

Binance Hack: What a ~$6B Hot Wallet Drain Means for Bitcoin, BNB and Holders

Michael GuMichael Gu
7 min read
News
Bitcoin and BNB marks beside a fractured teal vault spilling ore-copper fragments onto mineral paper
Contents

Binance just faced what on-chain firms are calling the largest crypto theft in history — roughly $5.7 to $5.9 billion pulled from exchange hot wallets on October 29, 2026. Bitcoin slid toward the mid-$70,000s, BNB got hit harder, and stablecoin issuers raced to freeze billions before the attacker could cash out everything.

Here is the full picture so far: what moved on-chain, what Binance and CZ said, how much got frozen, why the Aave trick matters, who investigators think did it, and what it means if you hold crypto.

What happened

Late on October 29 (evening UTC / early morning October 30 HKT), trackers watched multiple Binance.com hot wallets send huge amounts of crypto to a brand-new Ethereum address with no prior history.

On-chain reporter StarPlatinum laid out the first clear sequence:

  • At 20:24:23 UTC, the wallet labeled Binance 14 moved about $2.53 billion across 64 tokens.
  • 24 seconds later, a second Binance hot wallet sent another ~$174 million to the same destination (follow-up).
  • Later, a third Binance hot wallet path involved 780 million USDC into the same story — pushing early totals into the multi-billion range and, as more wallets were tagged, into the ~$5.6–5.9B zone.

Early assets out of that first blast included large piles of USDT, ETH, RLUSD, wBETH, XAUt, UNI, ENA, PEPE, LINK, USD1, and more.

Glassnode said it “looks like” Binance was hacked for around $5.3 billion, with the largest pieces about $1.66B USDT, 17,985 BTC (~$1.45B), and $767M USDC, plus ETH and many smaller tokens. Arkham stood up a tracked entity for the attacker (70 addresses verified; holdings cited around ~$5.7–5.8B, including large BTC/ETH/USDT/USDC piles). Chainalysis estimated about $5.912 billion stolen at the time of the theft — nearly four times the ~$1.5 billion Bybit hack in February 2025. Different firms are measuring slightly different things (outflow estimates vs tagged holdings); treat the range as ~$5.3–5.9B, not one locked number.

Binance has not published a root-cause post-mortem yet. Deposits and withdrawals on Binance.com were temporarily suspended. Binance.US said it was not affected: it is “a separate, independent platform,” with “customer funds and services … secure and operating normally.”

Binance, CZ, and Yi He: “User funds are safe”

Binance’s first official line was that teams were investigating a potential security issue and that “user funds are completely safe” (@binance).

Co-CEO Yi He and the main @binance account later went further: Binance will cover all hacking losses, deposits and withdrawals stay paused while security checks and freezes continue, and a full post-mortem is coming. Yi He also thanked World Liberty / USD1 for freezing about $27 million USD1 and roughly $2 million in WLFI.

Changpeng Zhao (CZ), who no longer runs Binance.com but remains a major shareholder, was blunt on X:

“User funds are safe! It does look like a hack on Binance… as a shareholder, I expect all user funds will be fully covered.”

(CZ; he later added that the loss “might be a bit higher” than some early ~$1B net estimates but will be covered.)

That messaging is the center for holders: spot balances on Binance are being treated as a company liability to make whole, not as “you’re rekt, sorry.” Trading and transfers are disrupted while they lock things down.

The freeze race: Tether, Circle, and friends

This is where the story stops being “everything is gone.”

  • Tether CEO Paolo Ardoino: froze more than $1.567 billion USDT tied to the potential Binance hack.
  • Circle CEO Jeremy Allaire: froze more than $800 million USDC, coordinating with law enforcement.
  • World Liberty / USD1: ~$27M USD1 frozen (plus WLFI).
  • Ripple: said it was freezing attacker RLUSD holdings.
  • ZachXBT: Arbitrum Security Council froze about $30.5 million; he later put total frozen above $2.83 billion (thread, update).
  • Binance official update: verified frozen total around $3 billion (@binance); earlier they clarified $2.54B when $1.8B figures were circulating. BBC also reported ~$3B frozen with partners, with room to rise.

CZ publicly thanked Tether and Circle early; Brian Armstrong said Coinbase was blocking sends to compromised wallets and offering help. Bybit’s Ben Zhou said Bybit was unaffected and stood with Binance.

Takeaway: centralized stables can be bricked fast. That saved a huge chunk — but not the whole bag.

The DeFi twist that went viral

One of the posts that circulated fast — @BalaiBB — explained why “we froze the stables” is not the end of the movie.

The attacker reportedly deposited stolen USDT into Aave, borrowed ETH against it, and walked with an asset issuers cannot freeze the same way. CoinDesk, citing Arkham, said the exploiter borrowed at least 20,000 WETH (~$44 million) against stolen USDT. If the loan is never repaid, the frozen collateral may sit while the ETH is already gone.

StarPlatinum’s updates also described large USDT → ETH conversions and DeFi moves while freezes were landing. Lookonchain later said the hacker finished dumping UNI, ENA, PEPE, LINK, AAVE, ONDO, and WLD into about 70,480 ETH (~$158 million) — more selling pressure into already-shaken markets.

So the honest frame is: freezes recovered a lot; smart routing into ETH and DeFi recovered less.

Market reaction: BTC, ETH, BNB

As the alerts hit:

  • Bitcoin fell on the order of ~5%, back toward the mid-$70,000s. CoinDesk’s updated snapshot put BTC near ~$76,500–$77,000 (−4.8%); early panic posts also showed a wick below ~$78,500.
  • Ethereum dropped roughly ~5–6% (CoinDesk ~$2,184 / −5.7%).
  • BNB was worse — about −8% on CoinDesk (~$702), with some reports toward ~10% — because the brand risk sits on Binance’s token.
  • AAVE was cited down about 11% (CoinDesk), fitting the DeFi-borrow narrative.

Liquidations spiked: market accounts and news aggregators put ~$600 million+ in leveraged longs wiped in roughly half an hour during the BTC dump (widely reported; not independently audited here). Altcoins in the stolen pile (PEPE, ENA, UNI, LINK, etc.) faced extra dump risk as the attacker swapped into ETH. Glassnode also noted some smaller tokens were heavily or fully drained from Binance balances in the same window.

Analyst 0xngmi argued Binance’s custody scale (~$144B) means even a ~$1B residual after freezes is a balance-sheet hit, not an insolvency event — which lines up with CZ’s “we’ll cover” posture. Treat that as analysis, not audited proof.

Who did it?

Not confirmed by Binance.

Investigator ZachXBT said it is “likely Lazarus Group (DPRK)” — the same North Korea–linked ecosystem blamed for the Bybit heist (reply). CoinDesk wrote that ZachXBT and Blockaid said North Korea was likely behind it; Blockaid CEO Ido Ben-Natan also told CoinDesk this is “the biggest crypto hack in history.” A separate Blockaid/Cointelegraph line of reporting points at EIP-7702 authorization abuse / signing-infrastructure misuse rather than a simple stolen private key — and Binance has not confirmed either the DPRK label or the exact method. Until a post-mortem or indictment, label DPRK as investigator attribution, not fact.

How they got hot-wallet control (compromised keys, signing stack, insider, malware, other) is still unknown.

What it means if you hold crypto

  1. On Binance.com: Official line is funds are safe and losses will be covered. Withdrawals may stay off until they finish checks. Use only official Binance channels — phishing always spikes after a hack headline.
  2. Price risk is real: Even with a solvent exchange, fear + forced dumps still move BTC, ETH, BNB, and alts that were in the stolen set.
  3. Stablecoins are not “cash with no politics”: Issuers can and will freeze. That protected users here; it also shows who has the kill switch.
  4. DeFi is the escape hatch: Collateralized borrows into unfreezable assets are now part of every big-hack playbook.
  5. Size context: If Chainalysis’s ~$5.9B holds, this dwarfs Bybit 2025. Industry coordination (Tether, Circle, L2 security councils, rival CEXs) was faster and wider than in earlier eras — and still incomplete.

Open questions

  • Exact stolen vs tagged holdings totals as Arkham/Chainalysis refine numbers.
  • Final recoverable amount after freezes, freezes that come late, and ETH already moved.
  • Root cause and whether other chains/wallets are still at risk.
  • Timeline for reopening deposits/withdrawals and the promised post-mortem.
  • Whether law enforcement confirms Lazarus / DPRK.

Sources

Official / primary X

On-chain / investigators

Press

Sources checked October 30, 2026 (HKT). Numbers are still moving; Binance has not published a root-cause post-mortem. Hero: generated illustration with catalog Bitcoin and BNB Chain marks for editorial identification.

Share

Found this useful?

Share it with someone who'd want to read it.

X (Twitter)FacebookLinkedIn

Related