TL;DR: Binance is investigating what could turn into the largest crypto exchange hack ever recorded, after on-chain trackers flagged suspicious outflows worth up to $5.8 billion from the exchange’s hot wallets on October 29. Tether and Circle have already frozen more than $1.5 billion in stablecoins tied to the suspected exploit, and Aave moved to block the attacker from borrowing against stolen funds. Binance says user money is safe and has not confirmed a breach, but the numbers involved already dwarf February 2025’s $1.5 billion Bybit hack, which until now held the record.
Something went very wrong inside Binance’s wallet infrastructure on Thursday. Blockchain analytics firm Arkham Intelligence tagged 55 addresses under a new entity it labeled “binance-hacker-1029,” tracking roughly $5.78 billion in combined holdings across bitcoin, ether, and the stablecoins USDT and USDC. That figure is the number making headlines, but it’s worth being precise about what it actually represents: value sitting in wallets analysts have linked to the incident, not a confirmed amount stolen from the exchange.
The on-chain trail is still being pieced together in real time, and different trackers are reading it differently. Crypto journalist StarPlatinum flagged a transfer of roughly $2.53 billion across 64 tokens from a wallet labeled “Binance 14,” followed 24 seconds later by $174.4 million moving out of a second Binance-linked wallet. Security firm Blockaid, separately, says it’s investigating about $3.3 billion in suspicious outflows from Binance hot wallets spread across Ethereum, Arbitrum, and Avalanche. One suspected exploiter address on Etherscan, tagged with both “Exploit” and “Heist” labels, was holding north of $2.2 billion at last check.
None of those numbers quite match each other, which is normal for a hack that’s still unfolding. What they agree on is the scale. Even the more conservative estimates put this well past anything the exchange has dealt with before.
Binance says funds are safe, stops short of calling it a breach
A Binance spokesperson told reporters the company is “aware of reports of a potential security issue and are actively investigating,” adding that “user funds are completely safe” and that updates would come through official channels once the company has verified what happened. Binance co-founder and chief customer service officer Yi He posted a near-identical statement on X, and used the moment to warn users against scammers who might exploit the confusion with fake support links or requests for account details. That’s a smart instinct. Every major hack produces a second wave of phishing attempts aimed at panicked users, and this one will be no exception.
Changpeng Zhao, the exchange’s founder and former CEO, weighed in from the sidelines. “I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered,” he wrote on X, crediting Tether and Circle for moving quickly to freeze suspect funds. It’s a notable statement precisely because of what it doesn’t say: Zhao stopped short of confirming a hack happened at all, which tells you Binance’s internal picture is still incomplete hours after the outflows started.
Stablecoin issuers and Aave moved fast
The most consequential response so far came from the companies that control the stablecoins involved. Tether CEO Paolo Ardoino said on X that his company had frozen more than 1.567 billion USDT connected to the suspicious wallets, while Circle CEO Jeremy Allaire said Circle had frozen over $800 million in USDC. Combined, that’s somewhere north of $2.3 billion taken out of the attacker’s reach before they could cash out, depending on which snapshot of on-chain data you’re looking at.
Lending protocol Aave reportedly froze its markets to stop the attacker from using the stolen assets as collateral to borrow additional funds, a tactic that’s become a common second move for exploiters once an initial heist is public. If confirmed, that’s a meaningful save. A hacker who can borrow against stolen crypto effectively launders it through a legitimate protocol while the original funds sit untouched, and cutting that path off early limits how much damage the exploit can ultimately do.
This is the part of the story that’s genuinely new compared to past exchange hacks: stablecoin issuers now have the technical ability to freeze specific addresses, and they used it within hours. Five years ago, an exploit at this scale would have simply meant the funds were gone. Now there’s at least a fighting chance that a meaningful chunk gets clawed back before it’s laundered through mixers or bridged to chains where tracing gets harder.
How this compares to crypto’s worst hacks
If any of the headline figures here get confirmed as actual stolen funds, this would surpass the Bybit hack from February 2025, where North Korean state-linked hackers made off with $1.5 billion, previously the largest confirmed theft in crypto’s history. That comparison is doing a lot of work in how this story is being covered right now, and it’s worth treating with some caution. Binance has not confirmed how much, if anything, was actually stolen, how the breach occurred, or whether this was an external attack at all rather than an internal error or a wallet misconfiguration that triggered a cascade of automated alerts.
BNB, Binance’s own token, dropped more than 5.5% as the news spread, which tells you the market isn’t waiting for official confirmation either. Crypto traders have learned to treat “investigating suspicious outflows” as a euphemism worth pricing in immediately, a lesson earned through years of exchanges downplaying incidents before eventually admitting the scope was worse than first described.
What to watch next
The next 24 to 48 hours matter more than anything written about this incident today. Binance’s past playbook, and the exchange industry’s broadly, is to go quiet while forensics teams work, then issue a detailed postmortem once the picture is clear. Watch for three things: whether Binance confirms an actual theft figure rather than letting on-chain speculation fill the void, whether any additional exchanges or protocols disclose related exposure, and whether law enforcement or blockchain forensics firms attribute the attack to a known group. The Bybit hack was traced to Lazarus Group within days. If this one gets attributed that fast, it’ll tell security researchers a lot about how the attacker moved and how prepared trackers like Arkham and Blockaid have gotten since.
There’s also a quieter story here about how far on-chain monitoring has come. A decade ago, a hack like this would have been a rumor for days before anyone had real numbers. Here, independent firms were tracking tagged wallets, estimating outflows, and publishing dollar figures within hours. The same on-chain infrastructure increasingly used to track stablecoin flows tied to AI agent payments is what’s letting researchers reconstruct this exploit in near real time. That transparency cuts both ways for Binance. It means the world is watching exactly how fast, and how completely, the exchange makes users whole.
The bottom line
Treat the $5.8 billion figure as a ceiling, not a confirmed loss, until Binance says otherwise. What’s already clear is that the response machinery around crypto hacks has matured considerably since Bybit. Stablecoin issuers freezing funds within hours and a lending protocol locking down before the attacker could borrow against stolen assets are real progress, not just damage control theater. Still, “trust us, funds are safe” from an exchange that hasn’t yet explained what happened is not where this story should end. If you’re holding meaningful balances on Binance, this is a reasonable moment to review your own security setup, including the kind of network-level monitoring tools covered in guides on analyzing traffic for suspicious activity, rather than waiting for the official postmortem to tell you it’s fine.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
