Binance Suspends Withdrawals After Suspected $5.9 Billion Hack as $3 Billion Is Frozen

The world’s largest cryptocurrency exchange has halted the movement of customer money while it investigates what may become the biggest digital-asset theft ever recorded. Binance said deposits and withdrawals were temporarily suspended as its teams carried out security checks, froze funds and worked with law enforcement, after unusually large transfers were spotted leaving wallets linked to the exchange on Thursday, October 29, 2026. The pause affects the core plumbing of a platform used by millions of traders, and it arrived without a reopening date.

What is known so far is therefore split into two very different piles: a set of confirmed company actions, and a set of much larger figures produced by outside analysts that Binance itself has not confirmed. That gap matters, because the frozen total, the outflow total and the eventual loss total are three different numbers, and treating them as the same thing would mislead readers. Binance hack $5.9 billion frozen October 2026.

What Happened on October 29

First Transfers Spotted

Observers tracking public blockchain records noticed very large amounts of cryptocurrency moving out of addresses associated with Binance during Thursday afternoon. The transfers spanned several networks rather than a single chain, and the speed of the movement drew attention quickly, with one receiving address reportedly collecting billions of dollars in value within less than an hour. Analysts and traders shared the flows in real time, which meant the story spread across trading desks and social platforms before the company had published a detailed explanation.

The pattern itself was unusual enough to raise an alarm. Large, rapid transfers from exchange-linked wallets are not routine, and the combination of size, speed and multiple assets suggested something other than normal customer withdrawals. That public visibility is a feature of blockchains: transactions can be watched as they happen, even when the identity of the people behind them remains hidden. It also explains why estimates began circulating so quickly, long before any official loss figure existed.

Binance Suspends Deposits and Withdrawals

Binance then confirmed a potential security issue and said all deposits and withdrawals were temporarily suspended as a precaution. The company said its teams were conducting security checks, freezing funds and working with law enforcement, and it promised to share a full post-mortem once the investigation was complete. In a later message, co-founder Yi He said user funds were safe and that Binance would cover all hacking losses, while urging users to rely only on official channels for updates.

The suspension is a blunt but understandable step. Freezing the entry and exit points limits further movement while investigators trace what happened, and it prevents a rush of withdrawals from compounding the confusion. At the same time, it leaves ordinary users unable to move their own assets until the company is satisfied its systems are secure, which is why the absence of a reopening timetable has become one of the most closely watched details of the incident.

How Large Is the Suspected Theft

Estimates From Analysts

Outside estimates have clustered around the high single billions of dollars, but they have not agreed on a single figure. Blockchain intelligence firm Chainalysis put the amount stolen at about $5.912 billion at the time of theft, while other tallies reported at least $5.57 billion across Ethereum, Bitcoin and Tron, and some early reporting placed the suspected theft in a range between about $1.7 billion and $5.7 billion. The spread reflects different methods, different cut-off times and different decisions about which transfers count as part of the incident.

Those figures should be read as analyst estimates, not as Binance’s own accounting. The company has repeatedly said it will only share confirmed figures, and it has not published a total loss number. Until it does, every large number in circulation carries an important qualifier: it is an estimate based on observed transfers, and it has not been verified as the final amount taken, recovered or lost.

Why Totals Differ

Totals differ partly because the incident touched several blockchains at once, and partly because not every flagged transfer is necessarily part of the theft. On-chain monitoring can show that assets left a wallet, but it cannot by itself prove who controlled the receiving wallet or whether a particular transfer was malicious, routine or an internal move. Analysts must therefore make judgements about which addresses to include, and different firms make different judgements.

Timing adds another layer of uncertainty. Some tallies were taken while transfers were still being tracked, so later updates added or removed amounts as new data arrived. Price movements also matter, because a holding measured in tokens can change in dollar value between the moment it moves and the moment it is counted. For readers, the safest approach is to treat the range as the story: the suspected theft is very large, and its exact size remains unconfirmed.

What Has Been Frozen So Far

Tether and Circle Freezes

The clearest confirmed progress has come from stablecoin issuers, which have the technical ability to freeze specific tokens. Tether reported freezing more than $1.567 billion in USDT, while Circle reported freezing more than $800 million in USDC in coordination with law enforcement. Together, those two actions account for the bulk of the frozen total reported so far, and they illustrate a key difference between stablecoins and other cryptocurrencies.

Stablecoins issued by a central company can be blacklisted at the issuer level, which stops the frozen tokens from moving further even if they sit in an attacker’s wallet. That power does not extend to Bitcoin or Ether in the same way, which is why the frozen total will always be smaller than the outflow total when a large share of the moved assets are native cryptocurrencies. A freeze is therefore a containment step, not yet a recovery.

Other Issuers and Networks Join

Other firms have since added their own freezes to the total. Binance co-founder Yi He credited Ripple with freezing roughly $200 million, while World Liberty Financial reported freezing about $27 million in its USD1 stablecoin plus a smaller amount of its WLFI token, working with custodian BitGo. The Arbitrum Security Council also executed a transaction to freeze about $30.5 million linked to the incident, involving tens of millions of ARB tokens and thousands of Ether.

Binance itself reported that the verified total frozen had reached $2.54 billion, and then updated that figure to around $3 billion within about ninety minutes, saying the total could rise as tracing continued. That rising verified total is the company’s own number, and it is distinct from the analyst estimates of the amount taken. Frozen assets are not the same as returned assets, and the path from a freeze to any return to users has not yet been explained in detail.

What Binance Has Said

User Funds and Losses Pledge

Binance’s public messages have stressed two points above all others: user funds remain safe, and the company will cover all losses. Co-founder Yi He repeated that pledge in a post on X, saying deposits and withdrawals were temporarily suspended while security checks, fund freezes and law-enforcement work continued, and promising a full post-mortem once the investigation was complete. Chief executive Richard Teng made a similar point, describing a potential security issue and saying he wanted to be direct that user funds remained safe.

The pledge matters because it shifts the immediate financial question away from individual users and onto the company’s balance sheet. If Binance does absorb the loss, customers may not bear the direct cost of the theft, even if they face a period of frozen access. The company has also pointed to an emergency fund in earlier communications, although the precise mechanism for covering any loss in this case has not been set out in the updates published so far.

What Binance Has Not Confirmed

Just as important is what Binance has not said. It has not confirmed a final loss figure, identified an attacker, described the entry point, or given a date for reopening deposits and withdrawals. Its corporate account has avoided the words hack and exploit in its own updates, even as a senior executive used the word exploit in a separate post, a difference in language that has itself been noted by observers following the incident closely.

The company has also not published technical findings explaining how the incident occurred. Reports have mentioned a possible wallet-delegation manoeuvre and, separately, a possible misuse of private keys rather than a theft of keys, but neither account has been confirmed by Binance as the established cause. Until the post-mortem appears, any explanation of the method should be treated as a reported possibility, not as a settled fact.

How the Money Moved

Across Ethereum, Bitcoin and Tron

The reported outflows were spread across the major networks where Binance holds large balances. Early breakdowns described billions of dollars on Ethereum, more than a billion dollars in Bitcoin and hundreds of millions on Tron, plus smaller amounts on other networks. One Ethereum transaction was reported to have swept away a very large quantity of Ether and stablecoins together, which helps explain why a single address could accumulate billions of dollars in value so quickly.

That multi-chain pattern complicates both tracing and freezing. Each network has its own tools, its own issuers and its own rules, so investigators must coordinate across several ecosystems at once. It also means that a single headline total hides a more fragmented reality: some assets can be frozen by their issuers, some can be traced but not frozen, and some may already have moved through further addresses or conversion steps before they were identified.

Wallet Delegation Reports

One line of reporting has focused on a wallet holding an extraordinary amount of money and on a small number of code changes that may have altered how that wallet could be used. The idea, as reported, is that a delegation step allowed an outside party to move funds that would normally require the wallet owner’s approval, turning a single point of weakness into a very large outflow. That account has been widely repeated, but it remains a reported theory rather than a confirmed finding from Binance.

A separate suggestion, attributed to a blockchain security firm, is that the incident involved misuse of private keys rather than their theft. The distinction matters for prevention: a stolen key points to a breach of storage or access, while misuse points to how an authorised key or permission was used. Both theories, if either is confirmed, would raise difficult questions about internal controls at one of the world’s largest exchanges, and both remain unconfirmed for now.

Market Reaction

Bitcoin, Ether and Liquidations

The incident coincided with sharp moves across the wider cryptocurrency market, with Bitcoin and Ether falling and leveraged positions being closed out in large numbers. Data cited in market coverage showed more than $1.1 billion in liquidations across the network in twenty-four hours, including hundreds of millions in Bitcoin and Ether positions alone. Liquidations happen when traders using borrowed money are forced to close positions as prices move against them, and a sudden shock can trigger a cascade of such closures.

It is important not to attribute every market move to a single cause. The incident arrived during a period of broader market weakness, and futures in traditional markets were also under pressure. Even so, the timing and scale of the Binance news made it a central factor in trading sentiment, and the suspension of withdrawals at the largest exchange added a practical reason for traders to reassess their exposure until more information emerged.

Comparison With the Bybit Hack

If the current estimates hold, the Binance incident would dwarf the previous largest known cryptocurrency theft, the 2025 Bybit hack, in which about $1.5 billion was taken in an attack later linked by investigators to North Korean-linked hackers known as Lazarus. Chainalysis’s estimate for Binance is roughly four times that figure, which is why the incident has been described as potentially the largest cryptocurrency theft on record.

The comparison also highlights how the industry’s defences have, and have not, changed. The Bybit case showed that even a major exchange could be breached at scale, and it led to intense scrutiny of wallet security and approval processes. A larger incident at Binance would suggest that those lessons have not fully closed the gap, although it is too early to say whether the two cases share a method, an actor or a common weakness.

Risks for Users Now

Scam Warnings

Binance has warned users to ignore unofficial links and messages asking for account details, and that warning deserves emphasis. Moments of confusion around a major exchange are prime territory for scammers, who create fake support accounts, phishing pages and recovery schemes promising to unlock frozen funds for a fee. No legitimate recovery process will ask users to send cryptocurrency to an unknown address or to share passwords or recovery phrases.

Users should therefore treat any message claiming to offer early withdrawals, compensation or a special recovery window with extreme scepticism, and should check information only through Binance’s official channels. The same caution applies to social media posts that claim to show the attacker’s wallet or to offer a way to trace personal funds: public blockchain data is real, but interpretations of it can be wrong, and scammers exploit that uncertainty.

What Users Should Check

For most users, the practical position is a waiting one. Account balances may still be visible even while withdrawals are suspended, but the ability to move funds will remain blocked until Binance confirms its systems are secure. Users who need to plan around that pause should avoid making decisions based on rumours about a reopening time, because no such time has been announced.

It is also worth checking whether any personal exposure extends beyond Binance itself. The company has said the incident did not affect Binance.US, which operates separately, and that distinction matters for users who hold accounts on both platforms. Anyone who reused passwords, shared recovery phrases or clicked links during the confusion should review their account security independently, rather than assuming the exchange-wide suspension covers every risk.

What Remains Unconfirmed

Investigation and Reopening

The investigation is still at an early stage, and several of the most important questions remain open. Law enforcement, issuers, blockchain intelligence firms and industry partners are working together to trace and freeze additional assets, according to Binance, but no timetable has been given for either the investigation or the resumption of normal service. The company’s promise of a full post-mortem is therefore the next major milestone to watch.

That post-mortem will need to answer questions that the current updates do not: how the incident began, which systems were affected, whether any customer data was compromised, and what controls will change as a result. Until those answers appear, the story remains one of confirmed actions and unconfirmed totals, and readers should be wary of any account that presents the full picture as already known.

Recovery and Accountability

The final question is how much of the moved money can actually be recovered, and who ultimately bears any shortfall. Freezing about $3 billion is a significant containment achievement, but it is not the same as returning funds, and the frozen stablecoins will need a legal and technical process before they can be moved back. Assets that cannot be frozen, particularly Bitcoin and Ether, may prove much harder to retrieve if they have already been moved or converted.

Accountability is equally unresolved. No attacker has been named, no arrests have been reported in connection with the incident, and no regulatory findings have been published. Binance’s pledge to cover losses may limit the direct financial harm to users, but regulators, partners and customers are likely to ask harder questions about how such a large outflow could occur at the world’s largest exchange. Those answers, like the final loss figure, remain unconfirmed.

Comments

comments