Up to $5.8 billion in assets has moved out of multiple Binance hot wallets, and the major crypto exchange is investigating. Tether CEO Paolo Ardoino said more than 15.67 million USDT had been frozen, while Circle CEO Jeremy Allaire said more than $800 million in USDC had been frozen. Binance has also temporarily suspended withdrawals. However, the $5.8 billion figure is an estimate based on on-chain asset movements and related addresses, not a confirmed theft amount. Subtracting the $2.54 billion in frozen assets confirmed by Binance from the $3.3 billion to $3.55 billion in suspicious outflows (excluding Bitcoin and Tron) leaves roughly $760 million to $1 billion. The scope of the two tallies may not match, so this cannot be treated as the actual loss. Still, there is a wide gap between the maximum $5.8 billion outflow and the loss that could remain after the freezes.
What does the $5.8 billion figure mean?
The incident surfaced on October 29, 2026, when large amounts of crypto were sent from multiple Binance hot wallets to newly created Ethereum addresses. According to crypto journalist StarPlatinum, about $2.53 billion worth of 64 types of tokens moved from a wallet known as "Binance 14," and 24 seconds later another wallet sent $174.4 million in assets. A third wallet then sent 780 million USDC to the same address, bringing the total to about $3.48 billion.
The maximum figure of $5.8 billion comes from an estimate by Coinbase's Conor Grogan. Blockchain analytics firm Arkham Intelligence also tracked 55 addresses it labeled "binance-hacker-1029" and calculated their combined holdings at about $5.78 billion. However, BleepingComputer's report makes clear that this amount is the total value of the tracked wallets, not a confirmed theft amount. The reported breakdown is about $1.77 billion in USDT, about $1.44 billion in Bitcoin, about $876 million in ETH and about $823 million in USDC, totaling about $4.9 billion. No detailed breakdown has been given for the remaining roughly $900 million.
Binance itself has not disclosed the size of the loss or the intrusion route. A company spokesperson said it is investigating a security issue while maintaining that user assets are fully safe. Founder Changpeng Zhao (CZ) posted that it "looks like a hack." Although he is no longer involved in management, he said that as a shareholder he expects users' losses to be fully covered. Co-founder Yi He said withdrawals have been paused and will not resume until safety is confirmed.
$2.54 billion frozen against $3.3 billion in suspicious outflows
Different figures have been reported for the outflow, depending on who is investigating and which wallets are counted. Security firm Blockaid is investigating about $3.3 billion in suspicious movements from Binance hot wallets on Ethereum, Arbitrum and Avalanche. StarPlatinum's analysis put the figure at about $3.48 billion, while another analyst, Spreek, counted about $3.55 billion flowing into a single unlabeled wallet. All are based on on-chain transaction records, and none is an amount Binance has acknowledged as stolen.
The frozen amount also grew as the response progressed. CZ initially posted that Tether had frozen about $971 million and Circle about $823 million, for a total of about $1.79 billion at that point. Binance then said there were discrepancies in the frozen amounts being reported externally and announced that the total it had confirmed frozen was $2.54 billion. It added that the figure could rise further through cooperation with relevant organizations.
In a separate post, Yi He thanked Ripple for freezing about $200 million, and World Liberty Financial for freezing $27 million in its USD1 stablecoin and 48 million WLFI tokens worth about $2 million. It is unclear whether these amounts are included in the $2.54 billion Binance announced. Simply adding up the amounts each company disclosed individually could therefore double-count frozen assets.
The types of crypto involved help explain why such a large sum could be frozen relatively quickly. Stablecoins such as USDT and USDC have a mechanism that lets the issuer freeze specific addresses through smart contracts and restrict transfers of the assets. ETH and Bitcoin have no comparable issuer-level freeze function, so once they reach an address controlled by an attacker, the issuer cannot stop the transfer on its own.
Cyber Kendra's analysis of Etherscan records found that the first large transfer included about 1.6 billion USDT, and a later transfer moved 780 million USDC. A considerable share of the suspicious movements was therefore in stablecoins that issuers can freeze. This asset composition appears to have been an important factor in making the large-scale freezes possible. However, a freeze halts the transfer of assets; it does not mean the assets have been returned to Binance.
Subtracting Binance's confirmed $2.54 billion in frozen assets from the roughly $3.3 billion in suspicious outflows Blockaid is investigating leaves about $760 million. Using Spreek's figure of about $3.55 billion, the difference is about $1 billion. At an assumed rate of 155 yen to the dollar, $760 million equals about 117.8 billion yen, but this exchange rate is an assumption for illustration and not the actual market rate that day.
There is an important limitation to this calculation. The $2.54 billion frozen figure is an aggregate spanning multiple issuers and blockchains, while the $3.3 billion to $3.55 billion outflow figure mainly covers Ethereum-based transactions. It has not been confirmed that the assets covered by the two figures fully match, so a simple subtraction may not accurately represent the amount of unfrozen assets. The roughly $760 million to $1 billion is therefore a provisional estimate based on certain assumptions, not a confirmed loss.
A useful comparison is the attack on crypto exchange Bybit in February 2025. In an announcement on February 26, 2025, the U.S. Federal Bureau of Investigation (FBI) attributed the theft of about $1.5 billion in crypto, around February 21, to North Korean attackers. If Binance's loss ends up at roughly $760 million to $1 billion, it would be about half to two-thirds the scale of the Bybit incident. Whether that comparison holds will depend on asset tracing and recovery in the coming days.
About $2 billion in Bitcoin and Tron could significantly change the loss
The most important objection to this view is that large asset movements have also been reported on Bitcoin and Tron. According to another tally cited by TFTC, about $3.51 billion left on Ethereum, 18,270 BTC (about $1.44 billion) on Bitcoin, and about $630 million on Tron, totaling at least $5.57 billion. The assets Arkham tracked also include about $1.44 billion in Bitcoin. If it is confirmed that the roughly $2.07 billion in Bitcoin and Tron actually reached the attackers, the expected loss would rise substantially.
Adding the $2.07 billion in Bitcoin and Tron to the earlier estimate of $760 million gives a total of about $2.8 billion. That would be well above the $1.5 billion Bybit incident. However, this calculation assumes that all the Bitcoin and Tron movements are related to the attack and do not overlap with the outflows already tallied. That assumption has not been confirmed.
Another concern is that the loss after freezing could exceed the initial estimate. According to tech-ish, CZ said that in response to an estimate of a post-freeze loss of about $1 billion, the actual loss could be somewhat larger, but that Binance would cover it. This suggests the loss could exceed $1 billion, but it is not an official disclosure of the loss.
Even so, the provisional estimate excluding Bitcoin and Tron has some basis. On Ethereum, transfers of large amounts to specific addresses can be traced, and Tether and Circle have actually frozen assets. By contrast, neither Binance nor investigators have confirmed that the Bitcoin and Tron movements were outflows to the attackers. The estimate of roughly $760 million to $1 billion is therefore meaningful only if Bitcoin and Tron are excluded and the frozen amount can be deducted from the relevant outflows.
The conditions under which this view would fall apart are clear. If Binance officially announces a loss above $1.5 billion, or if the movements of 18,270 BTC and about $630 million on Tron are confirmed to be linked to the attacker, it would be difficult to maintain the outlook that the post-freeze loss is below the Bybit incident. If the return of frozen assets does not proceed, the final loss and the funds needed to cover it could also exceed the initial estimate.
Binance's ability to compensate users, and the loss figure to watch
A possible source of funds for compensating users is SAFU (Secure Asset Fund for Users), Binance's emergency fund. According to tech-ish, SAFU holds 15,000 BTC, valued at about $1.18 billion when the incident occurred. If the loss stays within $760 million to $1 billion, the fund's valuation alone would be enough to cover it. If the loss including the Bitcoin and Tron outflows reaches about $2.8 billion, SAFU alone would not suffice. Binance has not said whether it will use SAFU for this incident, and the fund's actual capacity also depends on fluctuations in Bitcoin's price.
The biggest question going forward is how much Binance recognizes as unauthorized outflow and what final loss it announces. It also needs to be confirmed how the attackers got in, what actually happened with the Bitcoin and Tron movements, whether frozen assets can be recovered, and when withdrawals will resume. The figure of up to $5.8 billion represents the potential scale of the incident and should not be read as a confirmed loss. At the same time, it would be premature to conclude that damage is limited based solely on the $2.54 billion freeze. The final scale of the damage can only be assessed once the full picture of the asset movements and the handling of frozen assets becomes clear.