Binance hack: withdrawals paused as billions leave its hot wallets, and Binance says user funds are safe

Late on Thursday evening, people who keep crypto on Binance found they could not move it out. The world’s largest crypto exchange paused withdrawals on several networks after billions of dollars in coins left its wallets. Its founder put it plainly on X at 21:15 UTC: “It does look like a hack on Binance.”

This is a developing story. Binance says user funds are “completely safe”. But if early estimates hold, the Binance hack could be the largest theft from a crypto exchange on record.

The first hours of the Binance hack, in official words

Binance’s first statement, in its final form at 21:29 UTC on 29 October, said its teams were “actively investigating” reports of “a potential security issue” and that user funds were “completely safe”. It warned people to ignore unofficial links and requests for account details. At 22:33 UTC it added: “Withdrawals will resume as soon as the security issue is fully resolved.”

Binance spokesperson Ross O’Leary told TechCrunch withdrawals were “temporarily suspended” on multiple networks “as a precautionary measure”. Founder Changpeng Zhao (CZ), who no longer runs Binance but is its largest shareholder, wrote that he expects “all user funds will be fully covered”.

Stablecoins are crypto tokens meant to stay worth one US dollar, and the companies behind them can freeze them. Circle’s CEO, Jeremy Allaire, said at 21:18 UTC that Circle had frozen more than 800 million USDC “in coordination with law enforcement”. Tether’s CEO, Paolo Ardoino, said at 21:25 UTC that Tether had frozen more than 1.567 billion USDT. Together, that is about $2.4 billion locked.

How much was taken is still an estimate

Binance has not said how much it lost. The coins left its hot wallets: the internet-connected wallets an exchange uses for everyday withdrawals. Most customer money usually sits in offline “cold” storage.

Crypto watchers quoted by TechCrunch say at least $2 billion was drained. CoinDesk reports estimates from $1.7 billion up to $5.7 billion, the top figure based on wallet data from the tracker Arkham. The crypto researcher Molly White has said that higher figure is likely too high, Gizmodo reported.

For scale, the previous record was about $1.4 billion taken from Bybit in February 2025, which the FBI blamed on North Korea. How the Binance attackers got in is not known, and no one has been named. Rumour: some on-chain researchers suspect a stolen wallet key; Binance has not confirmed any method.

Is Binance safe for you right now?

As of 00:56 UTC on Friday 30 October, withdrawals were still paused and Binance had posted no newer update. Paused is not the same as gone, and Binance says your balance is safe. A few calm steps help (general good practice, not financial advice):

• Don’t panic-sell. Selling during a fall can lock in a loss the pause itself did not cause.
• Follow only official channels: the Binance app and Binance’s verified X account.
• Ignore “recovery” and “refund” offers. No real support agent will ask for your password, 2FA code or seed phrase (the secret words that control a wallet).
• When withdrawals return, check that 2FA is on and set a withdrawal address allowlist, so coins can only go to addresses you approved.

Scammers follow every big breach. We saw it after the Capcom data breach and the Quest Diagnostics data breach: fake messages often reach more people than the attack itself.

Why the freezes and reserves matter more than the headline number

There is real good news here. Binance paused quickly and pointed users to official channels. Tether and Circle froze billions within hours. In our reading, that is faster than most past exchange hacks.

Binance also has room to absorb a loss. CoinDesk, citing the data site DefiLlama, says it held about $144 billion before the attack. It runs SAFU, an emergency fund of about $1 billion in bitcoin, though it has not said whether it will use it. There is a precedent: in May 2019, hackers took about 7,000 bitcoin from Binance; it said SAFU would cover the loss and reopened withdrawals about a week later.

The hard part is the gap between “funds are safe” and the details: no figure, no cause, no timeline yet. The freezes also remind us that stablecoins can be frozen by the company behind them. That helps catch thieves, but it is a form of central control. On balance, the likelier outcome is that customers are made whole. Trust will depend on how openly Binance explains what went wrong.

Watch for a full incident report, a date for withdrawals, and whether the frozen $2.4 billion comes back. Until then, the safest move is the least dramatic one: wait, watch the official app, and say no to anyone offering to help you get your money out.