Billions of Dollars in Suspicious Transfers Prompt Binance to Review Potential Security Issue
Key Facts
Binance said it was reviewing information related to a potential security issue, affirming that user funds were safe, as on-chain data showed large transfers through wallets linked to the platform. The company did not confirm a breach or specify a financial loss, so the published figures remain measurements of observed flows and analytical estimates, not a final tally of missing funds. Reuters quoted a Binance statement saying its teams were reviewing relevant information "urgently," while The Block reported that analytics firms were investigating transfers out of hot wallets. Estimates varied depending on the scope of the transfers and how they were calculated, from amounts observed on-chain to estimates of assets that may have moved among multiple wallets. The developments came Thursday, October 29, 2026, as BNB fell more than 5.5% at the time The Block published its report.
Data tracked by analyst Spreek showed about $3.55 billion in transfers into an unidentified wallet by the time of publication, after which about $900 million of those assets was moved to other wallets. The figure describes funds observed moving on-chain and does not by itself prove that the entire amount left Binance's custody or was lost. In a separate estimate, Conor Grogan, Coinbase's director and product lead, said the amount could reach $5.8 billion. The report attributed the figure to Grogan as an estimate, not as an announcement by Binance about the scale of its losses. Blockaid also said it was investigating about $3.3 billion in suspicious transfers out of Binance hot wallets across the Ethereum, Arbitrum and Avalanche networks. The figures measure different things: transfers to an unidentified wallet, an overall estimate, and outgoing movements under investigation.
The freezing of stablecoins was another focus in developments around the incident. On-chain data showed that Tether and Circle together froze assets worth $1.79 billion in USDT and USDC in a wallet that had received billions of dollars from Binance hot wallets. Tether CEO Paolo Ardoino later said the company had frozen more than 1.567 billion USDT. Reuters reported a different aggregate figure, saying Tether and Circle had frozen more than $2.38 billion in stablecoins after Binance announced it was investigating a potential issue. Binance co-founder Yi He also said Ripple had frozen about $200 million. These figures come from different reports and statements, and the freeze alone does not establish that the assets were recovered or that the final loss has been determined. The freezes indicate that some of the observed funds could no longer be moved through the stablecoins concerned, according to the sources.
Former Binance founder Changpeng Zhao commented on the incident, saying he no longer managed Binance.com but expected, as a shareholder, that user funds would be fully covered. He said: "I no longer manage Binance.com, but I expect, as a shareholder, that user funds will be fully covered." His statement distinguishes his former role in managing the platform from his position as a shareholder, and sets out his expectation regarding coverage of the funds. The Binance statement quoted by Reuters said only that user funds were safe and that its teams were reviewing the information; it did not confirm a breach or announce losses of a specified amount. Separately, Binance.US said it was unaffected by the security incident, and Reuters described it as a trading platform separate from Binance. Binance.US's statement about its status therefore does not directly apply to the ongoing Binance.com investigation.
The platform's background highlights the scale of the user base that may be following developments in the investigation, without implying that all users were affected. Reuters said Binance's website states that it has more than 335 million registered users worldwide; that figure refers to registered users and is not a count of people affected by the transfers. Binance had published an announcement on October 28 about maintenance of its Ethereum network wallet, according to its official support announcements list. But the maintenance announcement does not establish a link to the suspicious transfers, and the report provided no evidence connecting the two. In the latest guidance to users cited in The Block's report, Yi He said Binance would post updates through its official channels after verifying the information. She warned users about unofficial links and messages and requests for account information, as the investigation into the potential security issue continued.