Suspected Transfers From Binance Wallets Estimated at $2.5 Billion to $3.3 Billion
Key Facts
Binance is investigating reports of a potential security issue after large transfers were detected from wallets labeled as belonging to the platform, with estimates of flows across several networks ranging from $2.5 billion to more than $3.3 billion on October 29. The platform said it had not confirmed that customer funds were affected, then published an update saying user funds were safe. Binance has not confirmed the transfer estimates, and the reports have not established that the activity was a theft or that the platform was hacked. Changpeng Zhao, meanwhile, described what happened as "looking like a Binance hack" and thanked Tether and Circle for freezing balances linked to the incident. The contrast between the platform's caution and Zhao's description frames the event as a suspected incident under investigation, not a confirmed hack.
One report said a transaction executed at 20:24 UTC on October 29 transferred about 167,464 ETH, along with nearly $1.6 billion in USDT and other tokens, from Binance 14 to a new address. Seventeen minutes later, 780 million USDC left a wallet labeled Binance Hot Wallet 34 at 20:41 for the same recipient, according to the report. These transfers provide details about the movement of assets that raised suspicions, but do not establish whether they were internal transfers or unauthorized transactions. The report said the wallets were labeled as belonging to Binance, while the possibility of an internal transfer remained open. The figures in circulation therefore remain estimates of asset movements, not losses confirmed by the company.
On the stablecoin front, Tether's chief executive said the company had frozen more than 1.567 billion USDT linked to a potential Binance hack. Jeremy Allaire said Circle was monitoring reports of a potential exploit and had frozen, in coordination with law enforcement, more than 800 million USDC linked to the incident. Zhao also thanked the two companies, putting the amounts frozen by Tether at about $971 million and by Circle at about $823 million. Those announced figures differ from the Tether chief's estimate of the amount of USDT frozen, and none establishes that most of the total transfers were frozen. The freeze is limited to balances linked to suspected addresses and, by itself, does not reveal the fate of the other assets transferred.
Circle's policy explains that blocking an address prevents it from sending or receiving USDC, and that transfers involving a blocked address may fail, leaving balances unavailable for the duration of the block. This mechanism shows how a stablecoin issuer can disable the movement of specific balances on the network, but it does not automatically mean funds have been recovered or identify who controls the remaining transfers. According to Binance's official page, updated in February 2026, the SAFU fund held crypto assets worth about $1 billion, with the value changing according to the market. Binance says the fund was established to protect user assets and that the types of losses it may cover include losses caused by compromised login credentials due to a vulnerability or shortcomings in the company's systems or security protocols. Binance retains the authority to determine whether losses qualify for coverage, according to its official page.
Binance sets a 90-day deadline from the date of an eligible loss to submit a request to support for a SAFU payout. The company's statement published here did not say that eligible losses had been established or that the fund would be used in this incident. Binance said in an official post on October 7 that its AI-powered risk systems had helped protect more than 8 million users and prevented potential losses of about $4.6 billion during the first half of 2026; it presented those figures as the result of its general systems. In a market reaction, the report said about $628 million in cryptocurrency futures contracts were liquidated in one hour, including about $607 million in long positions. The report does not say the liquidations resulted from the suspected transfers, while Binance continues to investigate the security reports.