The first alert was not a press release. It was a researcher named Spreek pointing at an Ethereum wallet tagged Binance 14, a contract call, and a relayer that had been fed in 0.1 ETH sips from Tornado Cash over the previous two days. Twenty-four seconds after the main sweep, a second tagged wallet, Binance 16, sent another 28,005 ETH to the same fresh address. That pattern — mixer-seeded trigger, new receiver, immediate hop onward — is what theft looks like on a block explorer. It is also, in rarer cases, what a panicked wallet rotation looks like. Binance has not said which one this is.
By late afternoon in New York the numbers had split. Early Ethereum-only counts sat around $2–2.7 billion in ETH and tokens, including about 167,464 ETH from Binance 14 plus dozens of ERC-20s. CoinDesk, citing Arkham, later described the receiving account as holding more than $5.7 billion, including bitcoin and ether. Decrypt’s chain-wide tally landed at about $5.57 billion: roughly $3.51 billion on Ethereum, 18,270 bitcoin (~$1.44 billion), and $630 million on Tron. Treat any single headline figure as a snapshot, not a close.
How this file is built: on-chain labels (Binance 14 / 16), issuer freeze posts from Tether and Circle, CZ’s public statement, and Binance’s own network-status page. We do not take Telegram screenshots as a source. If a number below disagrees with an official announcement, the announcement wins. Dollar totals below are cited to CoinDesk, Decrypt, Cointelegraph and BeInCrypto so you can open the original desk rather than trust a screenshot of this page.
Binance 16 → same pool +24s · ~28,005 ETH
Relayer funded via Tornado Cash (~0.1 ETH × 3)
Verify on Etherscan labels + the desks linked in Sources. Do not paste seeds. Do not connect a wallet to a “recovery” site.
What the chain shows
Spreek’s reconstruction, circulated on X and summarized by Cointelegraph and BeInCrypto, is more useful than the dollar total. A relayer deployed a delegate contract around 15:59 UTC. About four hours later it submitted an EIP-7702 authorization that installed that code on Binance 14, then called a function labeled sweep. The same relayer later moved USDC from another Binance hot wallet into the same pool. If the attacker had full private keys, they may not have needed a relayer at all — which is why researchers are talking about phished 7702 signatures rather than a simple key leak.
- Relayer funded with three Tornado Cash withdrawals of ~0.1 ETH.
- Delegate contract deployed.
- Binance 14 sends 167,464 ETH and 63 tokens, including about 1.615 billion USDT, to a brand-new address.
- Binance 16 sends 28,005.6 ETH to the same pool. The pool forwards ~195,460 ETH to a second fresh wallet.
- Circle freeze reported on the main receiver; Tether blacklist activity follows. Figures moved through the evening.
What Binance and CZ have said
A Binance spokesperson told several desks the same line: the firm is aware of a potential security issue, is investigating, and has not confirmed any impact to user funds. The company posted on X that updates would come only through official channels, and told users to ignore unofficial links and requests for account information — standard, and still the right advice. Phishing mail and fake “Ledger/Trezor support” DMs spike on days like this.
“User funds are safe. It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don’t manage Binance anymore, but as a shareholder, I expect all user funds will be fully covered.”
Those two sentences are doing different jobs. “Looks like a hack” is CZ reading the chain. “User funds are safe” and “fully covered” are a solvency claim, not a proof. SAFU, Binance’s Secure Asset Fund for Users, has been used after past incidents. It is not an insurance policy you can file. Wait for the exchange, not a screenshot of a tweet, before you assume a make-whole.
Tether and Circle
Issuer freezes are the one part of this story that has already happened in public. Circle CEO Jeremy Allaire said the company, working with law enforcement, had frozen more than $800 million USDC tied to the incident — later counts clustered around $823 million. Tether’s Paolo Ardoino posted that USDT linked to the suspected exploit had been frozen; CZ cited ~$971 million, Decrypt recorded 975.1 million in the main receiver, and later posts put Tether’s total higher as more addresses were added. CryptoBriefing walked through the mechanic: a freeze is a blacklist, not a refund. Tokens sit still until the issuer decides what to do with them.
Everything that is not USDT or USDC is a different problem. Bitcoin, ether, wrapped assets, and a long tail of ERC-20s cannot be frozen the same way. That is why the gap between “total moved” and “total frozen” is the number that actually matters, and why it is still moving.
Snapshot vs Decrypt’s ~$5.57B chain-wide tally
Withdrawal rails
Binance’s own network status page is the only list that counts. As of 13:27 on 29 October it showed BTC, BNB, TRX, LTC and DOGE as normal. ETH, USDT, USDC, XRP and SOL showed partial withdrawal suspensions. Status chips change. Do not copy this paragraph into a trade without opening that page yourself.
That is a Thursday-afternoon snapshot, not a standing order. Open binance.com/en/network in another tab, then work the list below. The point is not speed — it is not sending the whole stack on a paused ERC-20 pair, and not depositing it into a site that did not exist this morning.
If you still have size on Binance
- Open the network page. Note which asset–network pairs are actually Normal. Ignore Telegram screenshots.
- If USDT-ERC20 or ETH is paused, convert a slice on spot to an open rail — BTC, BNB, TRX or LTC — and send a test amount first. Full walkthrough: how to withdraw crypto from Binance.
- Do not bridge through a random “recovery” site. If CEX rails are dead, a known instant swap such as ChangeNOW is safer than a Telegram bot. Dust-size first.
- Whatever you do not need for trading should leave exchange hot wallets. Confirm the destination on a device screen. Cold wallet buyer’s guide · cash-out via P2P alternatives.
Three other venues
If you still want an order book while this is unresolved, split size. One extra account with KYC already done is worth more than a bonus headline. We highlight Bybit for that job because the book is deep and proof-of-reserves is public; OKX and Kraken are listed as official-site backups, not as the default. Comparison of the desks people actually open tonight: best Binance alternatives 2026.
Bybit
Deepest immediate book for most international users, with a published proof-of-reserves program. Use it as a staging account, not a second vault. This is the desk we highlight if you need one extra order book tonight.
Open BybitOKX
Spot liquidity plus a built-in Web3 wallet if you have to hop chains after a CEX withdrawal. Verification is usually quick.
Open OKXKraken
The conservative choice: slower product surface, longer public record on custody incidents. Fine if you care more about operational history than leverage.
Open KrakenThree cold wallets
Buy the device from a retailer you can see, not from a marketplace listing with a 40% “official” discount. Write the backup on paper or steel. Never type it into a website, a chat, or a “support” form. Full buyer’s guide: best cold wallet for crypto safety. Then run the crypto exchange emergency security checklist.
Ledger Nano X
The default multi-chain brick. Confirm every receive address on the device screen. Buy from the Ledger Amazon storefront, not a third-party listing with a discount.
Buy Ledger on AmazonOfficial Amazon storefront · Prime where available
Trezor Safe 3
Open firmware, Shamir backup if you want it. A good fit if you mainly hold bitcoin and majors.
Buy at trezor.ioTangem
Card form factor, tap to sign. Buy a set, not a single card, and store the spare off-site.
Buy at tangem.comQuestions people are searching
Is Binance safe right now?
Elevated risk. Binance is investigating. CZ said it looks like a hack. Customer-fund impact is unconfirmed. BTC, BNB and TRX were listed as normal; ETH, USDT, USDC, XRP and SOL had partial suspensions Thursday afternoon. Until there is an official all-clear, do not treat a hot wallet as storage.
Why are withdrawals failing or delayed?
Incident response, wallet rotation, chain congestion, and issuer blacklists can all look like a “failed withdraw” in the app. Check the network page, pick an open rail, send dust, then size. Repeating the same paused ERC-20 withdrawal does nothing.
Will the SAFU fund compensate lost funds?
Zhao said he expects coverage. SAFU is a Binance reserve, not a regulated insurance policy. Frozen USDT/USDC may come back if issuers reverse those addresses. None of that is automatic. Watch Binance’s announcement board, not random threads.
What are the simplest Binance alternatives tonight?
Bybit, OKX, and Kraken if you still need an exchange — see best Binance alternatives 2026. A Ledger Nano X, Trezor Safe 3, or Tangem card if you do not. Two venues plus a device you already initialized is enough. Opening five accounts during a panic is how people send funds to the wrong chain.
Guides in this file
Sources
- CoinDesk — potential multi-billion Binance hack, Arkham holdings, CZ quote
- Cointelegraph — Binance investigating; Spreek’s first flag; issuer freezes
- Decrypt — $5.57B across Ethereum, Bitcoin and Tron; Allaire freeze note
- BeInCrypto — Binance 14 / 16 flows, Tornado Cash trigger, $2B Ethereum view
- CryptoBriefing — Tether freeze mechanics vs a refund
- Binance — live deposit and withdrawal status
- Binance — official announcements