Binance Investigates Potential $5.7 Billion Hack as Tether and Circle Freeze Billions in Crypto

Daily Crypto News | Breaking News | October 29, 2026

Good evening, everybody. My name is Matt, and welcome to an emergency edition of Daily Crypto News.

I don’t do many live streams anymore, but when reports start circulating that Binance, the world’s largest cryptocurrency exchange, may have just suffered one of the biggest cryptocurrency hacks in history, I think that’s a pretty good reason to jump online.

And the numbers are changing incredibly quickly.

When I first started looking into this, reports suggested approximately $2.5 billion had moved out of Binance wallets.

Then we were talking about $2.8 billion.

Then $5.6 billion.

And by the end of the live stream, some estimates were approaching $5.7 billion.

Those are estimates of suspicious transfers, not a final confirmed loss. Binance is investigating, and we still don’t know exactly how much was stolen, how the attackers gained access, or how much can ultimately be recovered.

But even at the lower end of the estimates, we’re talking about an extraordinary security incident.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Billions Move Out of Binance Hot Wallets

The first major warning signs appeared Thursday afternoon, when blockchain investigators noticed enormous transfers out of wallets associated with Binance.

The activity was reported around 4:30 p.m. Eastern.

Some of the initial transactions involved Ethereum and stablecoins, including Tether’s USDT and Circle’s USDC.

As investigators examined additional addresses and blockchain networks, their estimates of the total amount involved increased.

Decrypt reported approximately $5.57 billion in suspicious transfers across Bitcoin, Ethereum, and Tron. Other investigators reported smaller totals, depending on the wallets and transactions they included.

And that’s why I’m being careful about calling this a confirmed $5.7 billion theft.

We know there have been enormous suspicious movements. We know Binance is investigating. But we don’t yet have a final accounting from the exchange.

If the highest estimates are confirmed as stolen funds, this could surpass the roughly $1.4 billion Bybit breach in 2025 and become the largest cryptocurrency hack on record.

Now, some people have asked me why Binance would have billions of dollars sitting in wallets that could potentially be compromised.

Remember, Binance handles an enormous amount of trading activity.

During the live stream, I was looking at figures suggesting approximately $11 billion in daily trading volume.

That doesn’t mean the exchange needs $11 billion sitting in one hot wallet. But a business processing that much trading and withdrawal activity needs substantial liquidity available.

And that creates an important security challenge.

A hot wallet is connected to systems that can authorize transactions relatively quickly. That makes it useful for everyday exchange operations, but it also creates more potential attack surfaces than properly secured offline storage.

The challenge is balancing liquidity, convenience, and security.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Tether and Circle Freeze More Than $2 Billion in Stablecoins

Here’s one of the most important developments in the entire story.

Tether and Circle moved quickly to freeze stablecoins associated with the suspicious transactions.

Initially, Changpeng Zhao, better known as CZ, thanked the companies for freezing approximately $971 million in USDT and $823 million in USDC.

Then the numbers increased.

Tether CEO Paolo Ardoino said his company had frozen more than $1.567 billion in USDT.

Reuters subsequently reported that Tether and Circle had frozen more than $2.38 billion combined, with Ripple also reportedly freezing approximately $200 million.

That’s an enormous amount of cryptocurrency that the suspected attackers may no longer be able to move.

But there’s an important distinction here.

Frozen does not mean recovered.

Tether and Circle can restrict transfers of their centrally issued tokens under certain circumstances. That can prevent the holders of those tokens from moving them while investigators determine what happened.

It doesn’t automatically mean the money has already been returned to Binance or credited back to customers.

Bitcoin works differently.

There isn’t a central company that can simply freeze an ordinary Bitcoin address because somebody reports a theft.

And while Ethereum’s native ETH can sometimes be tracked through the blockchain, it doesn’t have the same issuer-controlled freezing mechanism as USDT or USDC.

That makes the composition of the suspicious transfers incredibly important.

How much was in stablecoins? How much was native cryptocurrency? How much was moved into other addresses or exchanged for different assets?

Those questions will help determine how much can realistically be recovered.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

CZ Says User Funds Are Safe, but He’s No Longer Running Binance

CZ responded publicly as the news spread.

He said the activity appeared to be a hack, thanked Tether and Circle for acting quickly, and stated that user funds were safe.

But he also made something very clear.

He no longer manages Binance.com.

As a shareholder, he said he expects all user funds to be fully covered.

That’s encouraging if you’re a Binance customer.

But an expectation from a shareholder isn’t the same thing as a finalized reimbursement plan from the company.

Binance itself said it was investigating a potential security issue and that customer funds were safe.

The company also reportedly suspended withdrawals on multiple networks as a precaution.

Now, the big question is how Binance would absorb a loss of this magnitude if the largest estimates are confirmed.

Binance has an emergency protection fund known as SAFU, or the Secure Asset Fund for Users.

The company previously used that fund to cover losses following its 2019 security breach.

But I haven’t confirmed how much was available in the fund at the time of this incident, and we don’t yet know the ultimate amount Binance might need to cover.

We’re talking about potentially billions of dollars.

Even for the world’s largest exchange, that’s serious money.

And I think customers deserve clear answers about what assets were affected, how the incident occurred, and exactly how their balances will be protected.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Was Artificial Intelligence Involved in the Binance Attack?

This is the part of the story that really concerns me.

We’ve spent the past couple of weeks discussing how artificial intelligence is changing cybersecurity.

AI tools can examine enormous amounts of code, identify unusual behavior, and help researchers discover vulnerabilities that might previously have taken much longer to find.

That’s useful when legitimate security researchers find the weaknesses first.

It’s potentially dangerous when attackers use the same tools.

We’ve already discussed vulnerabilities involving Bitcoin Core, Electrum wallet software, and other cryptocurrency infrastructure.

And now, with Binance, investigators are trying to understand how such a large amount of cryptocurrency could have been moved.

One theory circulating during the live stream involved Ethereum’s EIP-7702 functionality, which allows certain accounts to delegate execution capabilities to smart-contract code.

Could an attacker have exploited a problem involving delegated execution, account permissions, or exchange infrastructure?

Possibly.

But we do not have evidence establishing that EIP-7702 or AI caused this incident.

And I don’t want to present a theory as a confirmed explanation.

The vulnerability could involve compromised credentials, software, internal systems, transaction authorization, or some other mechanism that hasn’t yet been identified publicly.

We simply don’t know.

My broader concern is that AI-assisted attacks could become more frequent as increasingly capable tools become available.

If AI can help legitimate researchers discover security weaknesses, it can potentially help malicious actors look for them too.

But that doesn’t mean every major cryptocurrency hack is auto…

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit www.dailycryptonews.net/subscribe