Binance Security Breach Triggers Crypto Selloff as Billions Frozen

The cryptocurrency market woke to a shock on October 30, 2026, after Binance, the world’s largest crypto exchange by trading volume, confirmed a security breach linked to abnormal outflows from its hot wallets. What began as an unusual movement of funds late on October 29 quickly turned into one of the most closely watched security incidents in the industry’s recent history, triggering a broad selloff, freezing billions of dollars in stolen assets, and raising urgent questions about how even the biggest platforms protect customer funds.

Binance first described the event as a potential security issue before confirming that a breach had occurred. According to on-chain tracking, outflows began at around 20:24 UTC on October 29 from a hot wallet known as Binance 14. A single transaction moved 167,464 ETH, roughly 1.6 billion USDT, and dozens of other tokens.

One of the most important things for readers to understand is that the total loss figure is not yet settled. Different tracking firms have produced different estimates because they use different methods, count different chains, and draw different lines between funds directly drained from Binance and funds moved in related transactions. On-chain estimates put the amount directly traceable to the Ethereum drain at roughly 2.8 billion to 3.5 billion dollars. Broader estimates that include around 18,000 BTC and Tron outflows not tied to the same attack range from 5.3 billion to 5.9 billion dollars. Those broader figures, attributed to data from firms including Glassnode, Arkham, and Chainalysis and reported via CoinDesk, should be treated as estimates, not as a confirmed Binance loss.

Binance itself has not confirmed its own loss figure. Founder Changpeng Zhao, known as CZ, estimated that losses could slightly exceed 1 billion dollars.

How the Binance Security Breach Unfolded

The timeline matters because it shows how fast a modern exchange incident moves. Hot wallets are the online wallets exchanges use for day-to-day deposits and withdrawals. They are convenient by design, which is also why they are a target. Cold wallets, kept offline, are generally safer but slower to use. When abnormal outflows were detected from Binance 14, the exchange suspended all deposits and withdrawals. Later, it also suspended trading on Binance Alpha, its platform for early-stage tokens.

Co-CEO Yi He addressed users directly, saying user funds are safe, losses will be covered, and withdrawals will stay paused until systems are confirmed secure. That message was designed to calm a market that has seen exchange failures before, where paused withdrawals became a warning sign of deeper trouble. In this case, Binance’s position is that customer assets are backed and that the company, not its users, will absorb the loss. Whether that reassurance holds will depend on the post-mortem, the proof-of-reserves snapshot due on November 1, and the speed with which withdrawals resume normally.

Security firm Blockaid said the attacker used Ethereum’s EIP-7702 delegation feature to take control of Binance 14. EIP-7702 is a relatively new Ethereum feature that allows an externally owned account to temporarily delegate control to smart contract code. In plain terms, it can make an ordinary wallet behave like a programmable wallet for a transaction. Blockaid’s account suggests that feature was abused to seize control of the hot wallet. Binance has not confirmed the attack method, and there has been no official attribution. Some analysts pointed to North Korea, a country whose state-linked hacking groups have been blamed for major crypto thefts in the past, but that link remains unconfirmed and should not be treated as established fact.

Billions Frozen as Exchanges and Issuers Respond

If the scale of the outflows was alarming, the speed of the freeze response was striking. Verified frozen totals reached 2.54 billion dollars initially and later rose to around 3 billion dollars. Tether froze more than 1.5 billion USDT. Circle froze more than 800 million USDC. Ripple also assisted in freezing efforts.

Other parts of the ecosystem moved just as quickly. The Arbitrum Security Council froze 74.56 million ARB tokens in the hacker’s wallet, moving them to an intermediary frozen wallet. Aave, the major lending protocol, froze its lending markets as a precaution. Aave said its contracts were unaffected and positions remained overcollateralised, meaning borrowers had posted more collateral than they borrowed, which limits the risk of bad debt even in volatile conditions. Bybit, another major exchange, denied being affected, an important clarification in a market where rumours can trigger panic withdrawals from unrelated platforms.

Binance also pointed to its Secure Asset Fund for Users, known as SAFU, which holds around 15,000 BTC, worth roughly 1 billion dollars. The SAFU fund was created as an emergency insurance pool, funded by a share of trading fees, to protect users in extreme cases. Its existence is one reason Binance can promise to cover losses without immediately raising questions about solvency, though the final cost will only be known once frozen funds, recovered funds, and actual losses are separated.

Crypto Selloff Hits Bitcoin, Ethereum and BNB

The market reaction was swift and broad. Bitcoin fell to a six-week low of 77,646 dollars according to Reuters, while CoinDesk recorded a session low of around 77,033 dollars, a fall of about 5 percent. Ethereum dropped to a two-month low of 2,238.76 dollars, with CoinDesk reporting around 2,205 dollars, down 5.7 percent. BNB, Binance’s own token, fell to around 694 to 698 dollars, down 8 percent to 8.2 percent. XRP fell 7.4 percent and Solana fell 7 percent.

Traditional markets were also under pressure. Nasdaq 100 futures slid around 2 percent after poor technology earnings, a reminder that crypto does not trade in isolation. When equity sentiment sours, risk appetite falls across the board, and crypto, as a higher-volatility asset class, often falls further. The combination of a security shock and weak tech earnings created a double headwind on the night of October 29 and into October 30.

Polymarket Incident Adds to a Difficult Night

In a separate incident on the same night, prediction market Polymarket was compromised through a third-party provider, DebugBear. Malicious code used logged-in sessions to sell positions and transfer funds. Around 2.6 to 2.7 million dollars was drained from roughly 700 users. Polymarket paused trading to cancel-only mode and then resumed at around 19:00 UTC. It promised full compensation to affected users and said its smart contracts worked as designed, pointing to the third-party code as the weak point rather than its own contracts.

No link has been established between the Polymarket incident and the Binance breach. The timing was coincidental but unfortunate, because it reinforced a sense that the night was a bad one for crypto security generally. The two cases also illustrate different risks. Binance’s case centres on hot-wallet security at a centralised exchange. Polymarket’s case centres on supply-chain risk, where a trusted third-party tool becomes an entry point. Both are reminders that security in crypto is only as strong as its weakest connected system.

What to Watch Next After the Binance Breach

Several milestones will shape the next phase. First, the resumption of withdrawals. Binance has said withdrawals stay paused until systems are confirmed secure. A careful, staged reopening would be reassuring. A prolonged pause, or a pause followed by further issues, would not. Second, the full post-mortem Binance has promised. Traders and security researchers will look for the confirmed attack method, the confirmed loss figure, the timeline of detection and response, and the steps taken to prevent a repeat.

Third, the proof-of-reserves snapshot due on November 1. Proof of reserves is a cryptographic and accounting exercise designed to show that an exchange holds the assets it claims to hold for customers. It is not a full audit, and it has limits, but a clean snapshot on schedule would support Binance’s claim that user funds are safe. A delay or a qualified result would raise questions. Fourth, the fate of frozen funds. Freezing is not recovery. Frozen tokens still need to be returned through legal and technical processes, and some stolen funds may already have been swapped, bridged, or laundered beyond easy recovery.

Frequently Asked Questions

What happened in the Binance security breach?

Binance confirmed a security breach after abnormal outflows from a hot wallet known as Binance 14, beginning at around 20:24 UTC on October 29, 2026. A single transaction moved 167,464 ETH, about 1.6 billion USDT, and dozens of other tokens. Binance suspended deposits and withdrawals and later suspended trading on Binance Alpha while it secured its systems.

How much was stolen in the Binance hack?

No single figure is confirmed. On-chain estimates put the amount directly traceable to the Ethereum drain at roughly 2.8 billion to 3.5 billion dollars, while broader estimates including Bitcoin and Tron outflows range from 5.3 billion to 5.9 billion dollars. Binance has not confirmed its own loss figure, and founder CZ estimated losses could slightly exceed 1 billion dollars. Treat all totals as provisional until the post-mortem is published.

Are Binance user funds safe?

Binance co-CEO Yi He said user funds are safe and losses will be covered, with withdrawals paused until systems are confirmed secure. The SAFU emergency fund holds around 15,000 BTC, worth roughly 1 billion dollars. The proof-of-reserves snapshot due on November 1 will be an important test of that reassurance.

How much stolen crypto has been frozen?

Verified frozen totals reached 2.54 billion dollars initially and later around 3 billion dollars. Tether froze more than 1.5 billion USDT, Circle froze more than 800 million USDC, and Ripple assisted. The Arbitrum Security Council also froze 74.56 million ARB tokens in the hacker’s wallet.

Was the Polymarket hack connected to Binance?

No link has been established. Polymarket was compromised via third-party provider DebugBear, with around 2.6 to 2.7 million dollars drained from about 700 users. Polymarket paused trading to cancel-only mode, resumed at around 19:00 UTC, and promised full compensation, saying its smart contracts worked as designed.

Source: Reuters

Related reading on MM Crypto Analysis Web

• How to Read Crypto Markets: Price, Volume, Flows & Sentiment
• Crypto Market Close October 28: Breadth Turns Positive as Bitcoin Holds $81,254
• Crypto Market Wrap October 29: Bitcoin Holds Above $81,000 After Fed Hold

More in Markets on MM Crypto Analysis Web.