Binance Hack Allegations: $5.8B Suspected Losses and Emergency Response

On October 29, 2026, the global cryptocurrency market was shaken by reports that Binance was hacked after numerous hot wallets on the platform recorded abnormal asset withdrawals [1] [2]. Initial estimates indicated that the scale of compromised assets could reach up to $5.8 billion, placing this incident at risk of becoming the largest cryptocurrency theft in history [1]. To control the risk, the exchange temporarily suspended withdrawals across multiple networks, while cryptocurrency issuers immediately acted to freeze suspicious wallet addresses [1] [2] [3].

Illustration: LibreOffice Start Center, macOS 13.5.1, LibreOfffice 7.6.0.3 – Fantasiasod, CC BY-SA 4.0, via Wikimedia Commons.

Details of the Suspected Binance Hack and Billions in Fund Flows

Abnormal signs began when billions of dollars were transferred from multiple Binance hot wallets to a newly created Ethereum address [1]. According to on-chain data analysis by journalist StarPlatinum, the hot wallet named "Binance 14" transferred approximately $2.53 billion comprising 64 different tokens, followed by $174.4 million from a second wallet just 24 seconds later [1]. A third hot wallet continued to transfer 780 million USDC to the same address, raising the total recorded value at that time to approximately $3.48 billion [1].

Blockchain intelligence platform Arkham Intelligence recorded up to 55 wallet addresses under the label "binance-hacker-1029," holding an estimated asset volume of about $5.78 billion [1]. This asset structure included approximately $1.77 billion in Tether (USDT), $1.44 billion in Bitcoin (BTC), $876 million in Ethereum (ETH), and $823 million in USDC [1]. The Etherscan block explorer also attached "Exploit" and "Heist" warning labels to the initial recipient address identified as "Binance Hot Wallet Exploiter 2" [1].

Although TechCrunch reported that experts estimated at least $2 billion was withdrawn and damages could exceed the $5.7 billion mark, BleepingComputer noted that the $5.78 billion figure from Arkham represents the total asset value in the monitored wallets rather than official damage figures confirmed by Binance [1] [2]. If authenticated, the scale of this incident would far surpass the previous record set by the Bybit hack orchestrated by North Korean hackers in February 2025 (TechCrunch reported $1.4 billion, while BleepingComputer cited $1.5 billion) [1] [2].

Record Freezing Actions by Tether, Circle, and Ripple

Facing the risk of widespread asset loss, stablecoin managers and major crypto projects quickly intervened technically [1] [3]:

• Tether: CEO Paolo Ardoino announced on X that the company had frozen nearly $1.57 billion in USDT (TechCrunch cited about $1.56 billion; BleepingComputer cited a more precise $1.567 billion) linked to the incident [1] [2] [3].
• Circle: Co-founder and CEO Jeremy Allaire confirmed that Circle froze over $800 million in USDC and is actively cooperating with law enforcement to support the investigation [1] [2] [3].
• Ripple: Binance Co-founder Yi He stated that Ripple also assisted in freezing approximately $200 million related to the incident [3].

The total value of assets blocked from trading by these issuers exceeded $2.3 billion according to BleepingComputer and reached over $2.38 billion per CNA statistics [1] [3].

On the exchange side, spokesperson Ross O’Leary confirmed that Binance temporarily suspended withdrawals across multiple networks as a precautionary measure [2]. Binance affirmed that user assets remain completely safe and advised customers to stay vigilant against scams [1] [2]. Former CEO Changpeng Zhao (CZ) shared on social media platform X that the event looked like a cyberattack, emphasizing that he no longer directly manages the company but expects all user losses to be fully covered [1] [2] [3]. Binance.US declared it was entirely unaffected [3].

Supply Chain Attack Targeting Polymarket

Also on October 29, 2026, prediction market platform Polymarket had to suspend international trading after discovering a security breach via a third-party supply chain [4] [5].

According to cybersecurity firm Hudson Rock and BleepingComputer, the attacker infiltrated the systems of DebugBear—a UK-based web performance monitoring service provider—to distribute malicious JavaScript code via the Real User Monitoring (RUM) service [4] [5]. This code was designed to hijack active user session cookies on Polymarket, automatically liquidating prediction positions or withdrawing tokens to the attacker's wallet [5].

Sources varied on the extent of damages: TechCrunch recorded about $2 million seized [2]; Wired cited data from Bubblemaps showing around 700 users affected with losses approximating $2.7 million [4]; while BleepingComputer and Hudson Rock tracked the attacker's wallet to record transferred POL tokens valued at about $2.57 million (equivalent to 28.6 million POL) [5]. Polymarket removed the malicious code, reported the incident to UK authorities, resumed trading after about an hour, and committed to fully compensating affected users [4] [5].

Vizy's take

According to Vizy, the world's largest centralized exchange suffering a hot wallet incident on the same day as the supply chain attack on Polymarket serves as a profound wake-up call for Web3 infrastructure. The most notable point lies not just in the estimated billions in damages, but in the immediate response from centralized crypto issuers. The fact that Tether, Circle, and Ripple could rapidly freeze over $2.5 billion in just a few hours shows that technical intervention mechanisms act as an emergency brake to prevent bad actors from laundering assets.

Vizy believes that for technology enterprises and digital market participants in Vietnam, this event delivers two major lessons in risk management. First, supply chain risks from source code libraries and third-party services (such as the DebugBear case) can nullify multiple layers of a business's front-end defenses. Second, organizations and investors must maintain the habit of diversifying assets, limiting the storage of large capital volumes on hot wallets or centralized exchanges, because even platforms with top-tier security resources always face infiltration risks.

Sources

1. BleepingComputer – Binance probes potential $5.8 billion crypto-theft hack (Thu, 29 Oc)
2. TechCrunch – Binance pauses withdrawals as hackers suspected of stealing billions in crypto (2026-10-29)
3. CNA – Tether, Circle freeze $2.38 billion after Binance reports security incident (Fri, 30 Oc)
4. Wired – Polymarket Halted International Trading After Hackers Drained Accounts (2026-10-29)
5. BleepingComputer – Polymarket halts trading after crypto-draining script breach, $2.5M traced (Thu, 29 Oc)

Compiled and analysed by Vizy from the sources above and reviewed by a Bống Media editor before publication. "Vizy's take" is the author's own opinion. For information only, not investment advice.