# Binance investigates security issue, pauses withdrawals > Binance says it is investigating a potential security issue and that user funds are safe. It paused withdrawals on several networks and says 2.54 billion dollars in assets has been frozen. - **Source:** https://ptycoin.com/en/posts/2026-10-29-binance-hot-wallet-security-incident/ - **Published:** 2026-10-29 - **Category:** News - **Author:** Mateo - **Tags:** exchanges, security, stablecoins, binance, tether, circle - **Also published in:** [Español](https://ptycoin.com/es/posts/2026-10-29-binance-hot-wallet-security-incident/) --- Binance says it is investigating a potential security issue after large transfers left wallets labeled as its hot wallets, and that user funds are completely safe. The exchange has temporarily suspended withdrawals on multiple networks while it runs security checks. The pause reaches a large user base, including in Latin America. A hot wallet is an internet-connected wallet that an exchange uses to pay customer withdrawals. On Thursday afternoon in US Eastern time, wallets that blockchain explorers label as Binance hot wallets sent large amounts of crypto to a newly created address, according to [Unchained](https://unchainedcrypto.com/binance-says-user-funds-are-completely-safe-after-3-5-billion-drains-from-its-hot-wallets/). Binance has not confirmed a stolen total, and its own posts have not called the outflows a hack. ## What Binance has said In a [post on X](https://x.com/binance/status/2115918888429133902), Binance said its teams were aware of reports of a potential security issue and were actively investigating. An earlier version of that post said Binance had "not confirmed any impact to user funds"; Unchained reported the post was edited minutes later to say user funds are "completely safe." The exchange said it would publish verified updates only through official Binance channels, and it told users to ignore unofficial links, messages or requests for account details. A later [update](https://x.com/binance/status/2115930656589119995) said the team was conducting security checks and that withdrawals would resume once the security issue was fully resolved. User funds, it repeated, remain safe. In a [later post](https://x.com/binance/status/2115947325617299903), Binance said the verified total of assets frozen in connection with the incident had reached 2.54 billion dollars and could rise as teams trace more funds. That figure counts frozen assets, not losses. Spokesperson Ross O'Leary told [TechCrunch](https://techcrunch.com/2026/10/29/binance-pauses-withdrawals-as-hackers-suspected-of-stealing-billions-in-crypto/) that Binance had "temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure." ## What Changpeng Zhao said Changpeng Zhao, known as CZ, founded Binance and no longer manages Binance.com. In a [post on X](https://x.com/cz_binance/status/2115915423174853077), he wrote that user funds were safe and that "it does look like a hack on Binance." As a shareholder, he said, he expects all user funds will be fully covered. He thanked Tether and Circle for freezing tokens tied to the incident. In a later [reply](https://x.com/cz_binance/status/2115932500006756686), Zhao said the loss might be a bit higher than an analyst's rough remaining figure of about 1 billion dollars after those freezes, "but will cover." [Binance.US](https://x.com/BinanceUS/status/2115922119972491559), a separate US platform, said it was not affected by the reported Binance.com incident. ## Tether and Circle freeze tokens Stablecoin issuers can block specific addresses from moving their tokens. That is what people mean when they say an issuer "froze" a balance. Tether CEO Paolo Ardoino [wrote](https://x.com/paoloardoino/status/2115918000373346709) that Tether froze more than 1.567 billion USDT related to a potential Binance exchange hack, and that protecting the industry and its partners was the main priority. Circle CEO Jeremy Allaire [wrote](https://x.com/jerallaire/status/2115916207463481846) that Circle was tracking reports of a potential exploit involving Binance. In coordination with law enforcement, he said, Circle had frozen more than 800 million USDC associated with the incident and would keep supporting the investigation. World Liberty Financial CEO Zach Witkoff [said](https://x.com/ZachWitkoff/status/2115930660166860922) USD1 froze 27 million dollars in USD1 tied to the same incident. Unchained, reading token contracts on chain, reported that Circle froze 823 million USDC at the main receiving address and that Tether blacklisted that address and further downstream wallets. ## What on-chain trackers count Binance has not published a confirmed loss figure. Outside tallies differ by chain and by method, and they should be read as estimates. Unchained counted about 3.52 billion dollars in Ethereum transfers into the main receiving address between roughly 4:24 p.m. and 5:04 p.m. Eastern time: about 197,170 ETH, 1.68 billion USDT, 823 million USDC and roughly 564 million dollars across dozens of other tokens, priced when Unchained pulled the data. That Ethereum-only count leaves out other networks. Unchained said Bitcoin outflows in other reports remained unverified in its piece. [Decrypt](https://decrypt.co/382191/binance-suspected-hack-5-billion-tether-circle-freeze-crypto) cited an on-chain tally of at least 5.57 billion dollars across Ethereum, Bitcoin and Tron. [BleepingComputer](https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/) reported that Arkham Intelligence was tracking an entity labeled across dozens of addresses with combined holdings near 5.78 billion dollars, and noted that Arkham's figure is the value of assets held across those wallets, not a confirmed amount stolen from Binance. Security firm Blockaid said outflows from Binance-labeled wallets on Ethereum, Arbitrum and Avalanche looked consistent with unauthorized movement, according to Unchained. Unchained also described how one labeled hot wallet received an EIP-7702 delegation shortly before the large transfers. EIP-7702 is an Ethereum feature that lets an ordinary wallet temporarily run smart-contract code after that wallet's key signs an authorization. How any required signature was obtained is still unknown. For scale only, and not as a claim about who is behind this incident: the FBI said in a public service announcement that North Korean hackers stole about 1.5 billion dollars from Bybit in February 2025, according to Unchained. ## What is still open Binance has not confirmed whether the transfers were unauthorized, how any breach occurred, or the total value of any assets moved without authority. It has not named a suspect. Withdrawals remain paused on multiple networks until the exchange says the security issue is fully resolved. Users should rely on official Binance channels for updates and should treat unexpected links, messages or requests for passwords and seed phrases as scams, as Binance warned in its first post. This article is not investment advice. --- ## Keep reading - [Is SMS 2FA enough to protect your crypto exchange account? The text code follows your phone number, and a SIM swap or port-out can move that number before the authenticator app, the withdrawal allowlist, and the anti-phishing code are on](https://ptycoin.com/en/posts/2026-10-27-exchange-account-2fa-withdrawal-allowlist/index.md): SMS codes follow the phone number, so a SIM swap can take them. Switch to an authenticator or a passkey, turn on a withdrawal allowlist, and set an anti-phishing code. - [Crypto transaction stuck on pending? A gas bid that is too low, or an older nonce from the same Ethereum account, keeps a MetaMask USDT send from confirming, and Speed up is only one of the fixes](https://ptycoin.com/en/posts/2026-10-20-stuck-pending-transaction-speed-up-cancel/index.md): A pending send of 250 USDT can be a low gas bid or a blocked nonce. Wait, speed it up, or cancel with that same nonce. Do not send the same payment twice. - [USDT sent on the wrong network? A completed transfer is a finished payment on the chain you selected, and the wallet or exchange waiting on a different chain has no new balance to show you](https://ptycoin.com/en/posts/2026-10-13-sent-usdt-wrong-network-recovery/index.md): USDT sent on the wrong network confirms on the chain you picked and stays invisible on the other. Keys you hold on an EVM chain may still reach it. Many exchange deposits do not come back. --- Source: PTYcoin — https://ptycoin.com/en/posts/2026-10-29-binance-hot-wallet-security-incident/. Free to read and cite with attribution to ptycoin.com. AI-usage terms: https://ptycoin.com/en/ai-usage/