Binance investigates a possible hack as Tether and Circle freeze stablecoins. What we know so far

Binance said on October 29, 2026, that it is investigating reports of a potential security issue, after on-chain researchers reported one of its wallets being emptied. Within about an hour, the companies behind the USDT and USDC stablecoins said they had frozen funds tied to the incident. Here's what is confirmed, what isn't, and what to do if you hold crypto on any exchange.

What happened

At 4:32 p.m. Eastern, an on-chain researcher who posts as Spreek flagged what the researcher called an unconfirmed but possibly massive Binance hack: a Binance wallet drained into a new address, with the contract call funded through Tornado Cash, a tool used to hide where crypto came from. CoinDesk's first report said the new address held more than $2 billion in coins, including ETH, USDT and USDC. Later estimates are much higher, as the update above explains.

At 5:15 p.m., Changpeng Zhao, who founded Binance, posted that "it does look like a hack on Binance." He said he no longer manages Binance.com but, as a shareholder, expects all user funds to be fully covered.

At 5:17 p.m., Binance co-founder Yi He posted that the company knew of the reports and was investigating. Binance's official X account posted a nearly identical message at 5:15 p.m. and again at 5:16 p.m., and at 5:29 p.m. it edited the 5:16 post to say: "User funds are completely safe." Binance said it would share updates through its official channels once it has verified information, and told users to stay alert for scams and to distrust any unofficial link, message or request for their account details.

Tether and Circle freeze stablecoins

Circle CEO Jeremy Allaire said Circle, working with law enforcement, froze more than 800 million USDC associated with the incident. Tether CEO Paolo Ardoino said Tether froze more than 1.567 billion USDT linked to the possible hack. Earlier, at 5:15 p.m., Zhao had thanked Tether and Circle for freezing about $971 million and about $823 million, and Yi He posted the same figures at 5:26 p.m. Ardoino's Tether figure is higher, and at 5:36 p.m. Yi He thanked Tether for freezing more than 1.567 billion USDT.

Later in the evening, World Liberty Financial said it had frozen funds, and Yi He said Ripple had too (see the 7:00 p.m. update above). Neither Tether nor Circle said exactly which addresses it froze. A freeze means whoever controls a frozen address can't send those stablecoins anywhere. It doesn't touch other coins, such as ETH, held at the same address.

CoinDesk reported that crypto prices slid on the news, with BNB, the token tied to Binance, down about 6% in an hour. This post isn't a price call; prices move on early reports and often move again as facts come in.

What isn't known yet

• Whether it was a hack. Binance calls it a potential security issue, and its spokesperson referred to "a security incident," but it hasn't confirmed a breach.
• How much left Binance. Outside on-chain estimates range from about $5.5 billion to $5.8 billion (see the update above). Binance hasn't given a number.
• The cause. Binance hasn't said how the wallet was emptied. Decrypt's on-chain reading points to an EIP-7702 delegation, but how the attacker got the needed signature is unknown.
• When withdrawals come back. Binance has paused withdrawals on multiple networks and says they'll resume once the issue is fully resolved, with no time given. It hasn't said whether deposits or trading are affected.

What about Binance.US?

Binance.US is run by a separate company, BAM Trading Services, for customers in supported U.S. states and regions. At 5:41 p.m., Binance.US posted on X that it is not affected by the reported Binance.com security incident and that its customers' funds and services are "secure and operating normally."

What it means for you

• Don't pay anyone to "unlock" a withdrawal. While withdrawals are paused, expect messages offering to speed up or release your funds for a fee. Binance resumes withdrawals itself; no one outside it can do that for you.
• Get news only from official accounts. In the hours after a big incident, fake "Binance support" accounts, fake refund forms and fake screenshots spread fast. Binance itself warned users about this.
• No one legitimate will ask for your password, 2FA code or seed phrase. Not to "verify" your account, and not to "protect" your funds.
• Ignore "recovery" offers. Anyone promising to get money back for a fee is running a recovery scam.
• An exchange balance carries the exchange's risk. Coins on an exchange are an IOU from that company. Our wallets guide explains the difference between an exchange account and a wallet you control.
• Stablecoins can be frozen. That helped here, but it works both ways. Our stablecoins guide explains who controls USDT and USDC.

The takeaway

Binance says it is investigating a potential security issue, that user funds remain safe, and that withdrawals are paused until the problem is fully resolved. Tether says it froze more than 1.567 billion USDT and Circle more than 800 million USDC tied to the incident, World Liberty Financial says it froze funds too, Yi He said Ripple did as well, and outside on-chain estimates of the amount involved run from about $5.5 billion to $5.8 billion. Binance hasn't confirmed a hack, a loss figure or a cause. This is education, not financial advice, and it reflects statements and reporting as of 7:00 p.m. Eastern on October 29, 2026. We'll update this post as Binance shares more.

Published October 29, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.

About the author

Dave McNaught

Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.

Full bio