Binance, one of the world’s largest crypto exchanges, said early on Friday 30 October that a “security incident” has put about $6.3 billion in assets at stake, that roughly $3 billion has been frozen on-chain, and that deposits and withdrawals are suspended while it investigates. Forbes calls it possibly the largest crypto theft on record; for scale, the Bybit breach of February 2025 involved $1.5 billion (Forbes; Financemagnates). Bitcoin, which had been trading near $81,900 on Thursday afternoon UTC, fell to $76,301 at 02:00 UTC on Friday on Coinbase and was at about $78,390 at 07:05 UTC. The numbers below come from Binance’s own statements and from third-party trackers that do not agree with each other, so this article separates what is confirmed from what is estimated.
What happened, hour by hour (all times UTC, Thursday 29 – Friday 30 October)
| Time | Event | Source |
|---|---|---|
| 20:20–20:24 | Wallet labelled “Binance 14” delegated via EIP-7702 to an outside contract; about 167,464 ETH plus 63 other tokens move to a new address in one transaction | CryptoTicker (on-chain analysis) |
| 20:41 | About 780 million USDC leave a second linked address | CryptoTicker |
| 21:15 | Co-founder Changpeng Zhao posts on X: “It does look like a hack on Binance” and “User funds are safe!” | CryptoTicker |
| 21:18–21:25 | Circle’s Jeremy Allaire reports more than 800 million USDC frozen; Binance says it is “aware of reports of a potential security issue”; Tether’s Paolo Ardoino reports more than 1.567 billion USDT frozen | CryptoTicker |
| 22:15 | Deposits and withdrawals halt | FinanceFeeds |
| 00:52 (Fri) | Binance says the “current verified total frozen amount is around $3 billion,” up from $2.54 billion at 23:22 | FinanceFeeds |
| Early Fri | Binance statement: preliminary review points to a compromised engineer’s laptop; total impact about $6.3 billion | Forbes; Financemagnates |
What Binance has said — and what it has not
According to Forbes and Financemagnates, Binance’s statement calls the event a “security incident,” says its initial investigation points to a compromised DevOps engineer’s laptop that gave an attacker access to a service container and let it submit unauthorized withdrawals, and says it has “found no evidence of any wallet private key leak.” Binance says user funds are safe, that it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds, that it is working with law enforcement and blockchain investigators, and that it will publish an updated proof of reserves once remediation is complete. No time for reopening withdrawals has been given. FinanceFeeds adds that the corporate account has not used the words “hack” or “exploit,” that co-CEO Yi He was the first senior executive to say “exploit,” and that the first statement was edited twice within 13 minutes. Mothership reports that Blockaid, a security firm, says the attacker used a hot-wallet private key and that how it was obtained is unknown — which is not the same as Binance’s “no evidence of a key leak,” and a difference that the promised post-mortem will have to resolve.
The loss figure depends on who is counting
| Figure | What it counts | Source |
|---|---|---|
| About $2.8 billion | Ether outflow (about 167,464 ETH in the first transaction, plus later transfers) | CryptoTicker |
| About $3.3 billion | Combined outflow from Binance hot wallets on Ethereum; $3 billion frozen would be about 91% of it | FinanceFeeds; Cyber Kendra |
| At least $5.57 billion | Outflows from Binance-linked wallets across Ethereum, Bitcoin and Tron (Blockaid, as tallied by Decrypt via FinanceFeeds) | FinanceFeeds; Mothership |
| About $6.3 billion | Binance’s own estimate of “total impact”; no breakdown by asset from Binance | Financemagnates |
A breakdown circulating through Mothership, attributed to Watcher.Guru, puts about $1.45 billion of the total in bitcoin, $875 million in ether and more than $2 billion in stablecoins; Bitcoin Mastery has not been able to confirm that split from Binance or from an on-chain source, and it does not add up to $6.3 billion on its own. Treat every number here as provisional until Binance publishes its post-mortem.
Frozen is not the same as recovered
Tether (more than 1.567 billion USDT, per its chief executive), Circle (more than 800 million USDC, per its chief executive) and the Arbitrum Security Council (about $30.5 million, announced by Yi He) have frozen funds. FinanceFeeds notes that blacklisted stablecoins remain in place until the issuer reissues or burns them, usually after law enforcement or a court confirms ownership, which it says takes weeks; for now the freezes mostly reduce how much Binance must fund up front. Two details do not reconcile: Zhao’s post cites about $971 million of USDT and $823 million of USDC, while Ardoino cites more than $1.567 billion of USDT, and Cyber Kendra points out that about 195,460 ETH sit at an address no issuer can freeze. Elsewhere in the sector, FinanceFeeds says Bybit has recovered $48.4 million of its $1.5 billion loss.
The video above was published on 29 October 2026, before Binance’s fuller statement; we have not verified its claims and include it because it records how the story first spread.
How bitcoin traded
Bitcoin was not falling when the first transfers occurred; it had risen after Thursday’s 8:30 a.m. Eastern data (third-quarter GDP at 3.4% against a 3.2% consensus, September core PCE in line at 3.1% year on year; see our GDP guide) to a Coinbase high of $81,890 in the 16:00 UTC hour. The 20:00 UTC hour then opened at $80,743, touched $78,177 and closed at $78,744; that hour contains the first on-chain transfers (20:24) but precedes CZ’s 21:15 post and Binance’s 21:24 statement, so the sequence of cause and effect cannot be read from the price alone. Bitcoin closed Thursday’s UTC day at $77,780.33, down 4.3% from the $81,249.31 open, then made the low of $76,301.02 at 02:00 UTC and recovered to about $78,390 at 07:05 UTC. Ether fell from $2,356.89 at Wednesday’s close to $2,248.34 on Thursday and touched $2,170.03 on Friday. Forbes reports BNB down more than 7% and FinanceFeeds puts it at $690.43, down 8.6% over 24 hours at 00:54 UTC.
| Coinbase BTC-USD | Open | Low | Close |
|---|---|---|---|
| 29 Oct 16:00 UTC hour | 81,698.55 | 81,092.26 | 81,173.03 (high 81,890.00) |
| 29 Oct 20:00 UTC hour | 80,743.29 | 78,177.37 | 78,744.03 |
| 29 Oct 23:00 UTC hour | 78,860.64 | 77,699.00 | 77,780.33 |
| 30 Oct 02:00 UTC hour | 76,643.44 | 76,301.02 | 77,218.43 |
| 30 Oct 07:00 UTC hour (open) | 78,477.74 | 78,383.74 | 78,389.98 at pull |
Liquidation estimates conflict. CoinGlass data cited by PANews and CryptoTicker puts about $628 million of positions force-closed within an hour, roughly $607 million of them longs; KuCoin’s flash report earlier in the week cited $356 million for a separate move; and two crypto news sites headline more than $1 billion over 24 hours. We have not reconciled them and do not rely on any single one. The Crypto Fear & Greed Index stood at 30, “fear,” on one tracker (Gokhshtein). Bloomberg Intelligence analyst James Seyffart told Bloomberg, as quoted by Forbes: “It’s definitely a bad look. And this is one after another.”
What to watch next
- Whether Binance reopens withdrawals, and on what timetable; no date has been given.
- The post-mortem and the updated proof of reserves, which Binance has promised after remediation; the root-cause question (laptop compromise versus a leaked hot-wallet key) is open.
- Regulatory response: FinanceFeeds reports no agency or regulator had commented publicly at the time of its update. Our coverage of the custody rulemaking is in the SEC custody proposal.
- Friday’s Deribit monthly expiry, covered in Field Guide #68, and Monday’s ETF flow data, which will show whether US funds saw outflows; our latest flow update is here.
- The Fed: after the 28 October hold with two dissents for a hike (report), CME FedWatch showed a 79.6% probability of a December hike after Thursday’s data (Fox Business).
For readers who hold bitcoin on any exchange, our general-reference guides are how to check a crypto custodian and how to withdraw bitcoin to self-custody; neither is a recommendation to move funds, and each route has its own risks. A separate guide published today, Field Guide #70 explains how to read hack headlines like this one.
Sources: Forbes (30 Oct); Financemagnates; FinanceFeeds; CryptoTicker; Cyber Kendra; Mothership; Gokhshtein; Fox Business (GDP and PCE). A CNBC headline, “Bitcoin tumbles below $78,000, extending losses as Binance security scare rattles crypto markets,” was seen in search results but the page could not be retrieved, so it is not used.
Method: bitcoin and ether prices, highs, lows and closes are Coinbase Exchange candles (UTC hour or UTC day) pulled by Bitcoin Mastery at about 07:05 UTC on Friday 30 October 2026; the 30 October candle is still open at that time, so any daily close quoted is the 29 October close (77,780.33) unless stated. Third-party figures are attributed to their source; incident details were still changing at pull time. The loss, freeze and liquidation figures are not independently verified by Bitcoin Mastery.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Bitcoin and other cryptocurrencies are volatile and you can lose some or all of the money you put in. Nothing here is a recommendation to buy, sell or hold bitcoin, any exchange-traded fund, any listed security or any other asset, and the technical levels, probabilities and scenarios discussed are descriptions of published data, not forecasts. Do your own research and consult a licensed financial advisor before making investment decisions.