Binance’s $5.6B “wallet shuffle” has crypto sleuths reaching for the red button 🧨

More than $5.6 billion in crypto left wallets linked to Binance across three blockchains on October 29, 2026, prompting Tether and Circle to freeze nearly $1.8 billion in suspected stolen stablecoins as the world’s largest cryptocurrency exchange investigated a potential security breach. One on-chain tally placed total outflows at at least $5.57 billion, including $3.51 billion on Ethereum, $1.44 billion in 18,270 $BTC and $630 million on Tron, while a later analysis estimated approximately $5.643 billion: $3.528 billion from Ethereum, $1.449 billion from Bitcoin and $628 million from Tron, plus about $38 million across Arbitrum, Optimism and Base.

Binance said its teams were aware of reports of a potential security issue and were actively investigating. “We have not confirmed any impact to user funds,” the company posted on X. “Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.” Users reported withdrawals stuck in processing, and the exchange urged customers to avoid unofficial links and requests for account information.

On-chain data showed the largest Ethereum transaction occurred at 20:24 UTC, when a wallet labeled Binance 14 transferred 167,464 $ETH and 63 tokens, including 1.615 billion USDT, to a newly created address. Binance 16 sent another 28,005 ETH to the same address 24 seconds later. Three minutes before the first transaction, a wallet funded through Tornado Cash submitted an EIP-7702 delegation for the Binance hot wallet, allowing delegated code to authorize later transfers without another signature; the method used to obtain the required signature remains unknown.

Within 15 minutes, the receiving address forwarded 195,460 ETH, worth roughly $440 million or $450 million depending on the cited valuation, to another new address. Circle said it froze more than 800M USDC, with the reported amount near $823 million, while Tether CEO Paolo Ardoino said more than 1.567 billion USDT was frozen. Earlier reports cited Tether freezes of approximately $971 million or 975.1 million USDT, although one on-chain blacklist registry showed a 971.1 million USDT request as pending execution.

Changpeng Zhao said the activity appeared to be a hack and expected all user funds to be fully covered. “It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m),” the Binance co-founder wrote on X. By the October 30, 00:30 UTC update, the total value of assets withdrawn, the involvement of customer funds and the cause of the unauthorized activity had not been fully verified.