conv.

All stories
SecurityQuiet 13d · day 13

Binance suffers $3.5B crypto drain; founder calls it a hack, exchange denies impact

Billions in stablecoins and tokens flowed from Binance hot wallets to a single address Thursday as Tether and Circle froze funds; leadership disagrees on severity.

newest coverage 13d agosummary written 12d ago2 pieces NewswiresGoogle News

What to know

  • Approximately $3.5 billion in cryptocurrency drained from Binance hot wallets to a single address on October 29; total outflows including other chains reached $5.64 billion.
  • Founder Changpeng Zhao called it a hack and promised full user coverage, but Binance's official statement said user funds were safe without confirming whether the outflows were unauthorized.
  • Tether and Circle froze over $2 billion in stablecoins in the receiving address within minutes; the attacker moved non-frozen tokens to new addresses to avoid further freezes.
  • Drains continued even after Binance's reassurance statement, with additional funds swept into the frozen address and transferred to fresh wallets.

“outflows from Binance hot wallets on Ethereum, Arbitrum and Avalanche look consistent with unauthorized movement”

Blockaid, Security firm · Unchained ↗ · Oct 29, 5:11 PM

Binance Cryptocurrency exchangeChangpeng ZhaoChangpeng Zhao Binance founder and shareholderPaolo ArdoinoPaolo Ardoino Tether CEOCircle Stablecoin issuer (USDC)Blockaid Security firm

Binance suffers $3.5B crypto drain; founder calls it a hack, exchange denies impact
unchainedcrypto.com

How it unfolded 1 development · click the chart to see its coverage articles

Peak 1 piece in 3h at Oct 29, 5 PM; 2 pieces over 13 days (2 articles) Oct 29, 5 PM — 1 piece · 1 article — Newswires 1Oct 29, 8 PM — 1 piece · 1 article — Google News 1Oct 29, 11 PM — quietOct 30, 2 AM — quietOct 30, 5 AM — quietOct 30, 8 AM — quietOct 30, 11 AM — quietOct 30, 2 PM — quietOct 30, 5 PM — quietOct 30, 8 PM — quietOct 30, 11 PM — quietOct 31, 2 AM — quietOct 31, 5 AM — quietOct 31, 8 AM — quietOct 31, 11 AM — quietOct 31, 2 PM — quietOct 31, 5 PM — quietOct 31, 8 PM — quietOct 31, 11 PM — quietNov 1, 1 AM — quietNov 1, 4 AM — quietNov 1, 7 AM — quietNov 1, 10 AM — quietNov 1, 1 PM — quietNov 1, 4 PM — quietNov 1, 7 PM — quietNov 1, 10 PM — quietNov 2, 1 AM — quietNov 2, 4 AM — quietNov 2, 7 AM — quietNov 2, 10 AM — quietNov 2, 1 PM — quietNov 2, 4 PM — quietNov 2, 7 PM — quietNov 2, 10 PM — quietNov 3, 1 AM — quietNov 3, 4 AM — quietNov 3, 7 AM — quietNov 3, 10 AM — quietNov 3, 1 PM — quietNov 3, 4 PM — quietNov 3, 7 PM — quietNov 3, 10 PM — quietNov 4, 1 AM — quietNov 4, 4 AM — quietNov 4, 7 AM — quietNov 4, 10 AM — quietNov 4, 1 PM — quietNov 4, 4 PM — quietNov 4, 7 PM — quietNov 4, 10 PM — quietNov 5, 1 AM — quietNov 5, 4 AM — quietNov 5, 7 AM — quietNov 5, 10 AM — quietNov 5, 1 PM — quietNov 5, 4 PM — quietNov 5, 7 PM — quietNov 5, 10 PM — quietNov 6, 1 AM — quietNov 6, 4 AM — quietNov 6, 7 AM — quietNov 6, 10 AM — quietNov 6, 1 PM — quietNov 6, 4 PM — quietNov 6, 7 PM — quietNov 6, 10 PM — quietNov 7, 1 AM — quietNov 7, 4 AM — quietNov 7, 7 AM — quietNov 7, 10 AM — quietNov 7, 1 PM — quietNov 7, 4 PM — quietNov 7, 7 PM — quietNov 7, 10 PM — quietNov 8, 1 AM — quietNov 8, 4 AM — quietNov 8, 7 AM — quietNov 8, 10 AM — quietNov 8, 1 PM — quietNov 8, 4 PM — quietNov 8, 7 PM — quietNov 8, 10 PM — quietNov 9, 1 AM — quietNov 9, 4 AM — quietNov 9, 7 AM — quietNov 9, 10 AM — quietNov 9, 1 PM — quietNov 9, 4 PM — quietNov 9, 7 PM — quietNov 9, 10 PM — quietYesterday, 1 AM — quietYesterday, 4 AM — quietYesterday, 7 AM — quietYesterday, 10 AM — quietYesterday, 1 PM — quietYesterday, 4 PM — quietYesterday, 7 PM — quietYesterday, 10 PM — quietToday, 1 AM — quietToday, 4 AM — quietToday, 7 AM — quietToday, 10 AM — quietToday, 1 PM — quietToday, 4 PM — quietToday, 7 PM — quiet ◂ 1 earlier
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 8:49 PM ET
  1. 1

    Attacker moves non-frozen tokens to new address

    Approximately 217.5 million ENA and 29,934 WBETH were moved to a fresh address, along with 122,310 ETH transferred to another new wallet, as the attacker moved funds that Tether and Circle could not freeze.

    “it does look like a hack on Binance…”
    — Changpeng Zhao, Binance founder and shareholder · source
  2. background

    Drains continue; attacker sweeps additional funds to frozen address — At 5:44 p.m. ET, about 15 minutes after Binance's reassurance statement, the address that set up the delegation swept approximately 200 million more USDT and roughly 370 ETH from Binance 14 into the frozen address. Total outflows from Binance hot wallets on multiple chains reached approximately $5.64 billion including Bitcoin and Tron.

  3. background

    Binance revises statement, says user funds are completely safe — At 5:29 p.m. ET, Binance issued a revised statement on X saying "user funds are completely safe" after the massive outflows. The revised statement dropped the language about investigating a potential security issue from the earlier 5:16 p.m. version and made no explicit reference to a hack.

  4. background

    Changpeng Zhao calls the incident a hack; promises full coverage — At 5:29 p.m. ET, Binance founder Changpeng Zhao posted that "it does look like a hack on Binance" and, as a shareholder, said he expects "all user funds will be fully covered." This came before Binance's revised statement moments later.

  5. background

    Binance says teams are investigating potential security issue — At 5:16 p.m. ET, Binance posted on X that its teams were "actively investigating" a "potential security issue" and had "not confirmed any impact to user funds." The exchange did not call the outflows a hack.

  6. background

    Tether and Circle freeze stablecoins in receiving address — Tether blacklisted the receiving address at 5:01 p.m. ET, followed by Circle at 5:04 p.m. ET. Tether froze over 1.567 billion USDT and Circle froze 823 million USDC sent to the address. Tether CEO Paolo Ardoino confirmed the freeze was "related to a potential Binance exchange hack."

  7. background

    Massive outflows begin from Binance hot wallets — Starting at approximately 4:24 p.m. ET, approximately $3.52 billion in cryptocurrency began flowing from Binance-labeled wallets on Ethereum to a single receiving address. The transfers included 197,170 ETH, 1.68 billion USDT, 823 million USDC, and roughly $564 million across 62 other tokens, completing by 5:04 p.m. ET.

Also covered reported alongside — the timeline has no entry for these yet

  1. 2 outlets Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets

    first by Yahoo Finance, 13d ago · also Unchained