Binance wallets lose $3.5B as Tether and Circle freeze funds

About $3.5B left Binance hot wallets on October 29, 2026, and the split inside that figure is the part a custody desk can act on. Stablecoin issuers can blacklist their own tokens, while ether (ETH) has no equivalent switch. Etherscan has labelled the receiving addresses Binance Hot Wallet Exploiter. FinanceFeeds, tallying that explorer plus later movements across chains, put the book as high as $3.55 billion, which rounds to the $3.5B in the headline.

A hot-wallet drain and a line that user funds are safe can both stand. The coins that moved were exchange inventory until a client balance is left unpaid, so the open question is who wears the loss. Zhao’s shareholder sentence and Binance’s operational post both promise that the house will wear it. A published Secure Asset Fund for Users draw would be a separate statement.

What left the hot wallets

At 20:24 UTC, Etherscan records a successful call on the wallet it labels Binance 14, address 0x28C6c06298d514Db089934071355E5743bf21d60. The caller was 0x7C8601d4645b93cea45F71e118A729332e6B5CA0, which the explorer names Binance Hot Wallet Exploiter. Binance 14 sent 167,464.25 ETH, valued on the page at $381,706,284.06, and 1,615,409,498.97 Tether (USDT), together with 62 further tokens, to 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c. The input data is the function sweep, and the transaction carries an EIP-7702 delegation to contract 0x63e842B054Bd624a465454D533C33F573e9c6fAe. That signature path, which lets an ordinary account run contract code after its own key signs an authorisation, is a different failure from September’s Bitget breach, which this desk traced to spoofed approvals.

Related:Collector Crypt vests 44.6 million CARDS to insiders

Fourteen minutes later the receiving address forwarded 195,460 ETH, which Etherscan priced at $446.94 million in that transaction, to a fresh wallet it labels Binance Hot Wallet Exploiter 8. FinanceFeeds’ reading of the following legs adds 780 million USD Coin (USDC) from Binance Hot Wallet 34 at 20:41 UTC, about 28,006 ETH from Binance 16, and a further 43 million USDC at 20:59 UTC. Those legs are the bulk of the $3.5B.

What issuers could freeze

Tether and Circle used the switch ether lacks. Zhao wrote at 21:15 UTC: “User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.” Ten minutes later Paolo Ardoino, chief executive of Tether, posted that Tether “froze more than 1.567B USDT related to a potential Binance exchange hack,” a blacklist already larger than the $971 million in Zhao’s note. Jeremy Allaire, chief executive of Circle, said Circle had frozen more than 800 million USDC “in coordination with law enforcement.” The 195,460 ETH on the exploiter wallet has no blacklist of that kind.

Binance’s own account posted at 21:29 UTC that its teams were “aware of reports of a potential security issue” and that “user funds are completely safe.” Co-founder Yi He had posted the same line at 21:17 UTC and closed with “User Funds SAFU.” Naming the reserve is a different fact from a stated draw of a stated amount.

What the market did with the hour

Coinglass data, reported by BeInCrypto for the hour the outflows hit, showed $627.7 million of liquidations, $606.6 million of it from long positions. Bitcoin (BTC) positions accounted for $189.1 million and ETH positions for $156.8 million, with Solana (SOL) third at $46.8 million and short positions losing $21.1 million. Binance’s own venue carried $344.8 million of that hour. The largest single close was an $11.09 million bitcoin long on Binance at $79,254, while Bitcoin traded under $79,000 and ether under $2,240.

After MiCA, Binance co-chief executive Richard Teng put the share of departing European Economic Area users who moved to self-custody near 70 percent, with the rest going to licensed rivals. A self-hosted wallet takes the exchange hot wallet out of the path and also removes the issuer freeze that just locked USDT and USDC. The WAX bridge exploit earlier this month showed the other move available to a venue, which is to pause processing and resume once the path is mapped. Binance’s posts instead describe an investigation and warn users off unofficial links.

The next prints are whether frozen USDT climbs past 1.567 billion, whether frozen USDC climbs past 800 million, and whether the 195,460 ETH splits again. A SAFU commitment a risk desk can book names the fund and the amount. Until that statement is on the official channel, the book is the set of transfers Etherscan has labelled an exploit, sized as high as $3.55 billion, about $3.5B.

This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.