Binance Confirms $2.54 Billion Frozen Amid Probe Into Possible Security Issue

Key Facts

Binance said it was investigating reports of a possible security issue, confirming that user funds were "completely safe" without confirming that a theft had occurred. About two hours after its initial disclosure on October 29, it announced that verified frozen funds totaled $2.54 billion. The company said the total could rise as it continued tracking and freezing additional assets. By contrast, Glassnode estimated that assets worth about $5.3 billion had flowed out of the exchange, based on on-chain data. Binance did not comment on that estimate, which measures the value of assets that left the platform, while its figure covers frozen funds it had verified. Whether a breach occurred and the scale of any losses remained unresolved in the available data.

Binance temporarily suspended deposits and withdrawals while conducting security checks, freezing funds and cooperating with law enforcement, according to the Associated Press, citing the company. The exchange said withdrawals would resume once the security issue was fully resolved, without giving a timetable. The suspension meant customers were temporarily unable to deposit or withdraw assets through the platform during the checks. Binance said user funds were safe but did not announce a final estimate of losses or the number of accounts that may have been affected. Its assurance that funds were safe was not accompanied by an announcement that the investigation had ended. The stated course of action remained to continue the review and cooperate with law enforcement.

Stablecoin issuers announced that they had frozen balances they said were linked to the incident. Tether said it had frozen nearly $1.57 billion, while Circle reported freezing more than $800 million. Reuters quoted Yi He as saying that Ripple had frozen about $200 million. These announcements show issuers' role in halting the movement of specific balances, but they are not estimates of losses incurred by Binance or its customers. The figures also cannot automatically be added to Binance's $2.54 billion total, as the disclosure did not specify whether the amounts overlapped. Binance said the frozen funds it had verified could increase as tracking continued.

Bitcoin fell as the news spread, dropping 3.2% to below $79,000 on the evening of October 29, according to the Associated Press. It closed at $77,991.89 that day, then ended the October 30 session at $77,123.82, according to EL7 data. These closing prices place the market move in the period after Binance announced it had opened an investigation. The figures alone do not prove that the security issue was the sole cause of the decline. The available data did not establish that the move reflected confirmed losses at the exchange or among its customers. These prices also do not provide an independent estimate of the incident's financial impact.

Changpeng Zhao said the incident "looks like a hack," but reiterated that user funds were safe, adding that he expected them to be covered in full as a shareholder, although he no longer runs Binance. The exchange has more than 335 million registered users worldwide, according to its website, as cited by Reuters; that figure describes its registered user base and does not identify how many were affected. Binance.US, a separate exchange, said it was not affected by the security issue. The possible incident comes in a market that has previously seen major thefts: in February 2025, the Federal Bureau of Investigation accused hackers linked to North Korea of stealing about $1.5 billion in Ethereum in an attack on Bybit. That context does not establish whether funds were stolen from Binance or the scale of any damage.

On October 30, Binance said it would cover all losses resulting from the issue and publish a full review of the incident after the investigation concluded. The company did not specify when the review would be published or estimate the losses it might cover. It had said deposits and withdrawals were temporarily suspended during the checks, freezing of funds and cooperation with law enforcement, and that withdrawals would resume once the security issue was resolved. The resumption of service is therefore tied to resolving the issue, while its timing remains unannounced. The company's update and post-investigation review remain the main information customers are awaiting on the incident's scope and the handling of any losses.