Binance halts withdrawals and pledges to cover losses after record breach

Binance suspended all deposits and withdrawals early Friday (October 30) and said it will cover every loss from a suspected breach of its hot wallets. Even the lowest outflow estimate makes this the largest theft ever recorded at a centralized exchange. For institutions, the question has already shifted from whether Binance can absorb the hit to how much of it stablecoin issuers neutralized, and what that says about where exchange risk now sits.

• Binance says $2.54 billion has been frozen, more than $2.37 billion of it by Tether and Circle, but it has not published a loss figure or a reopening date.
• Outflow estimates range from about $2.8 billion out of a single hot wallet to more than $5.7 billion across Ethereum, Bitcoin and TRON, depending on how analysts count.
• Watch Binance’s promised post-mortem, the confirmed attack vector, and whether the net loss fits inside its roughly $1 billion SAFU fund.

• $2.54B Funds Binance says are verified frozen so far
• $1.567B USDT that Tether says it froze in connection with the incident
• ~$1B Size of Binance’s SAFU emergency fund, held in bitcoin
• $627.7M Crypto liquidations in a single hour as the outflows hit

Funds began leaving Binance hot wallets at around 20:20 UTC on Thursday (October 29). On-chain analysts trace the transfers to an address that had been seeded the day before with 0.1 ETH from Tornado Cash and that later deployed its own smart contract. An analysis by Cryptoticker says the attacker tied a Binance hot wallet to that contract using EIP-7702, the account-delegation feature Ethereum added in its Pectra upgrade in May 2025. Binance has not confirmed how its wallets were accessed.

Binance founder Changpeng Zhao wrote on X at 21:15 UTC that the activity looked like a hack. The exchange’s own statement, first posted a minute later, was edited several times within about 13 minutes, moving from saying no impact on user funds had been confirmed to saying user funds were completely safe. Shortly after midnight UTC, Binance and co-CEO Yi He said the exchange will cover all losses and halted all deposits and withdrawals while it runs security checks, freezes funds and works with law enforcement. It has promised a full post-mortem once the investigation ends.

The number that matters is net, not gross

The headline figures vary because analysts are measuring different things. One count looks only at the main hot wallet drained in the first transfers, at roughly $2.8 billion. Chinese outlet TechFlow put the incident at about $3.43 billion, while Arkham data cited by CoinDesk showed more than $5.7 billion leaving wallets across three networks.

Gross outflow overstates the economic loss. A large share of what left Binance was stablecoins, which their issuers can freeze at the contract level. Binance says $2.54 billion is now verified frozen, and Zhao has said the actual loss may come in slightly above $1 billion. The remainder is harder to stop: the attacker has been swapping assets through Uniswap, and native ETH and BTC cannot be frozen by any issuer. Smaller recoveries are adding up at the edges, including about $30.5 million frozen by the Arbitrum Security Council, according to PANews.

Stablecoin issuers acted as the circuit breaker

Tether CEO Paolo Ardoino said the company froze more than 1.567 billion USDT linked to the incident, NBC News reported, and Circle moved to block USDC as well. Most of that happened within about an hour of the first transfers.

That speed stands out against Circle’s record earlier this year. After the $285 million Drift exploit in April, critics including on-chain investigator ZachXBT faulted Circle for letting the attacker move USDC through its own cross-chain protocol without a freeze. This time the two issuers did more to limit Binance’s loss than any control inside Binance itself.

The freeze function is usually discussed as a censorship risk. In this incident it worked as the main loss-mitigation tool, which cuts both ways: it confirms that a handful of issuers hold a practical veto over dollar liquidity onchain, for good and for bad.

SAFU covers the low case, the balance sheet covers the rest

Binance created its Secure Asset Fund for Users in 2018 and drew on it in May 2019 to repay 7,000 BTC stolen from a hot wallet. The fund was converted into roughly $1 billion of bitcoin earlier this year. If the net loss lands near Zhao’s estimate, SAFU roughly covers it. Anything larger comes out of Binance’s own balance sheet. The exchange held about $144 billion in assets on platform before the breach, per DefiLlama data cited by CoinDesk.

Holding the reserve in bitcoin adds a wrinkle. Bitcoin fell below $79,000 as the outflows were reported, so the value of the backstop dropped at the moment it was needed.

Exposure runs past Binance’s own customers

A withdrawal halt turns a loss question into a liquidity question. Trading firms, market makers and platforms that hedge positions or park liquidity on Binance cannot move those assets until the exchange reopens. The market priced the worst case quickly: liquidations reached $627.7 million in one hour, almost all of it long positions, and Binance accounted for $344.8 million of that total, according to Coinglass data reported by BeInCrypto.

This is the biggest crypto hack in history.

Ido Ben-Natan, co-founder and CEO of Blockaid, speaking to CoinDesk

The previous record was the roughly $1.5 billion taken from Bybit in February 2025, which was attributed to North Korea-linked hackers. No one has been publicly named in the Binance incident.

The BlockWest read. The loss figure will keep moving, but the shape of this incident is already clear. A hot wallet large enough to hold billions is a concentration risk that no reserve fund was sized for, and the fact that most of the stablecoin share was recovered within an hour owes more to Tether and Circle than to Binance’s own controls. For allocators the questions are operational: how much any venue keeps hot, how fast its post-mortem arrives, and whether a newer Ethereum feature like EIP-7702 has opened a class of wallet risk that custodians have not yet priced.

Binance has given no date for reopening deposits and withdrawals. The next markers are its post-mortem, a confirmed loss figure, whether SAFU is drawn, and whether law enforcement names a suspect.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.