A major security scare at Binance has sent shockwaves through the cryptocurrency market, with Tether, Circle and other companies moving to freeze billions of dollars in assets potentially connected to the incident.
The world’s largest cryptocurrency exchange is investigating a suspected security breach after large transfers from wallets associated with the platform triggered alarm across the crypto industry.
The scale of the incident remains under investigation. Binance has not publicly confirmed the total amount stolen or fully established how the suspected breach occurred. It has, however, said that customer funds are safe and that it is working with law enforcement, blockchain intelligence firms and other industry partners. Reuters+2
The exchange said that more than US$2.54 billion in assets had been frozen by Thursday evening, October 29, and that the figure could increase as investigators trace additional transactions. Reuters subsequently reported Binance’s frozen-asset figure at approximately US$3 billion. These are amounts frozen in connection with the investigation—not a confirmed total loss. Reuters+2
Binance freezes billions as investigators trace suspicious transactions
Binance’s response quickly expanded beyond its own security team, drawing in several major cryptocurrency companies that can freeze certain digital assets.
The companies involved reported the following actions:
- Tether: CEO Paolo Ardoino said the company froze nearly US$1.57 billion in assets connected to the incident.
- Circle: The issuer of USDC confirmed that it froze more than US$800 million in coordination with law enforcement.
- Ripple: Binance co-founder Yi He said approximately US$200 million in related assets had been frozen.
- World Liberty Financial: The company said it worked with cryptocurrency custodian BitGo to freeze funds, including approximately US$27 million in stablecoins and US$2 million in its own tokens, according to Yi He. Reuters+2
These interventions are significant because some stablecoins can be frozen by their issuers when suspicious funds are identified. That gives investigators and cryptocurrency companies a way to restrict the movement of certain assets, even after they have been transferred between blockchain addresses.
However, freezing cryptocurrency does not automatically mean it has been returned to its rightful owner. The funds still need to be traced, investigated and handled through the appropriate recovery process.
How much cryptocurrency was actually stolen?
This is one of the biggest unanswered questions.
Several blockchain analytics firms and cryptocurrency researchers reported billions of dollars in suspicious transfers involving Binance wallets. But their estimates differ, and the figures should not be treated as confirmed losses.
The Block reported that on-chain activity showed approximately US$3.55 billion in transfers into an unidentified wallet, while other analysts cited figures reaching US$5.8 billion.
Arkham Intelligence was also tracking multiple addresses associated with the suspected attacker. However, the total value of assets held across those addresses is not necessarily the same as the amount confirmed stolen from Binance. The Block+2
Reuters reported that Binance had frozen approximately US$3 billion in cryptocurrency as the investigation continued.
The distinction is crucial:
- Suspicious transfers are transactions that investigators or analysts believe may be connected to the incident.
- Tracked assets represent the value of cryptocurrency identified across monitored blockchain addresses.
- Frozen assets are funds that have been restricted from further movement.
- Confirmed losses are the amounts established as stolen through verified investigation findings.
As of the latest reports reviewed, Binance had not publicly confirmed a final stolen amount or disclosed a definitive technical explanation for the incident. Reuters+1
CoinDesk raises questions about Binance’s proof of reserves
Another development has added to the scrutiny surrounding the incident.
CoinDesk reported that the wallets apparently affected by the suspected attack included wallets Binance had previously listed in its proof-of-reserves disclosures.
The publication examined Binance’s October 1 reserve data and identified a wallet labelled Binance 14 among the exchange’s disclosed holdings.
According to CoinDesk’s analysis, approximately 204,500 ETH was taken from the affected wallets. Because Binance’s October 1 report showed that its ETH reserves were equivalent to customer ETH balances, CoinDesk estimated that the theft could have temporarily reduced the exchange’s ETH reserve backing to around 94%, unless the missing assets were replaced. CoinDesk
This is an important distinction: CoinDesk’s calculation is an independent analysis of published reserve information, not an announcement by Binance that customer balances are underfunded.
Binance has continued to insist that customer funds are safe. The exchange’s next reserve snapshot, expected on November 1, will provide another opportunity to examine whether the assets backing customer balances have been replenished.
For more context on the risks surrounding digital-asset theft, readers can also explore WWC ONE MEDIA’s report on a Singaporean man who pleaded guilty in a US$245-million Bitcoin theft case.
Binance temporarily suspends deposits and withdrawals
As the investigation progressed, Binance temporarily suspended deposits and withdrawals while conducting security checks, tracing funds and coordinating with law enforcement.
The exchange also temporarily halted trading on its Binance Alpha platform as a precaution.
Binance said withdrawals would resume once the security issue had been fully resolved. The temporary restrictions were intended to support the investigation and prevent further movement of potentially affected assets. AP News+2
The disruption is particularly significant because Binance is one of the world’s largest cryptocurrency trading platforms.
Reuters reported that the exchange had more than 335 million registered users globally and approximately US$160 billion in assets under custody, based on information from its 2024 annual report. Reuters
For users, the immediate concern is whether they can access their accounts, transfer their holdings and continue trading normally.
Binance has said customer funds remain safe, but customers should rely on official company announcements for updates on the restoration of services.
Bitcoin and other cryptocurrencies fall as market confidence weakens
The suspected security incident also unsettled cryptocurrency markets.
Reuters reported that Bitcoin fell approximately 2% to a six-week low of US$77,646 during early Asian trading on Friday, October 30. Ether also dropped around 2%, while Binance’s BNB token declined more than 8% over the preceding 24 hours.
Shares of Coinbase fell 4.8% in extended US trading, while shares of Bitcoin-buying company Strategy declined nearly 6%. Reuters
The reaction illustrates how a major security incident at a leading exchange can affect confidence beyond the platform itself.
Cryptocurrency markets depend heavily on trust in exchanges, custodians, stablecoin issuers and the systems that allow digital assets to move between wallets.
When a major platform faces a suspected breach, investors may become more cautious about leaving assets on exchanges or taking on additional trading risk.
For additional background on the regulatory and financial pressures surrounding the cryptocurrency industry, see WWC ONE MEDIA’s report on Trump’s reported US$1.4-billion crypto income and the stalled Senate crypto bill.
Binance says it will cover hacking losses
Binance co-founder Yi He said the company would cover all hacking losses, offering reassurance to customers as the investigation continued.
Former Binance chief executive Changpeng Zhao, commonly known as CZ, also commented publicly on the incident.
Zhao said the event appeared to be a hack and expressed confidence that customer funds would be fully covered. He also clarified that he no longer manages Binance’s day-to-day operations.
Binance operates a Secure Asset Fund for Users, commonly known as SAFU. The fund is designed to provide an emergency reserve to protect users in certain extreme circumstances, including security breaches.
Reuters reported that the fund is held entirely in Bitcoin and is intended to protect user assets. However, Binance had not publicly confirmed that SAFU would be used to cover losses from this particular incident. Reuters+1
The company’s commitment to cover losses is important, but customers and the wider market will still be looking for a detailed explanation of what happened, how much was affected and how the exchange will demonstrate that customer balances remain fully supported.
Could this become one of the largest cryptocurrency hacks in history?
The scale of the suspected incident has prompted comparisons with previous major cryptocurrency thefts.
In February 2025, Bybit suffered a confirmed attack involving approximately US$1.5 billion in cryptocurrency, which was attributed by investigators to North Korean hackers.
Reuters also reported that researchers at TRM Labs estimated that attackers stole approximately US$2.9 billion in cryptocurrency across nearly 150 attacks during 2025. Reuters+1
If the highest estimates associated with the Binance incident are eventually confirmed, the case could surpass previous major cryptocurrency thefts.
But that conclusion remains premature. The amount of suspicious activity identified by blockchain analysts is not the same as a final, independently verified loss figure.
The investigation must establish which transactions were unauthorised, how the attackers gained access and how much cryptocurrency was actually taken.
For a wider look at how cyberattacks are affecting financial institutions, readers can also see WWC ONE MEDIA’s coverage of South Korea’s Bank of Korea employee data breach.
What Binance users should do now
While Binance continues investigating, customers should be particularly careful about messages claiming to offer refunds, emergency withdrawals or account recovery services.
The exchange has warned users to avoid unofficial links, messages and requests for account information.
Customers should:
- Access Binance only through its official website or verified application.
- Never share passwords, authentication codes or wallet recovery phrases.
- Avoid clicking links in unsolicited messages claiming to be from Binance support.
- Check official Binance announcements for updates on deposits, withdrawals and trading.
- Be cautious of anyone asking for an upfront payment to recover allegedly stolen cryptocurrency.
Scammers frequently exploit major security incidents by impersonating exchange employees, customer support representatives or blockchain investigators.
The fact that a company is investigating a security incident does not make unsolicited recovery offers legitimate.
The bigger question: Can crypto exchanges keep customer funds safe?
The Binance incident highlights a difficult challenge for the cryptocurrency industry.
Large exchanges hold substantial amounts of digital assets and provide services to millions of customers. Their security systems must protect wallets, private keys, transaction processes and the infrastructure connecting different blockchain networks.
At the same time, blockchain technology allows transactions to move rapidly across borders and between wallets, making it difficult to recover funds once they reach addresses that cannot be controlled by centralised issuers.
The response from Tether, Circle and Ripple demonstrates that cooperation between exchanges, stablecoin issuers, investigators and blockchain intelligence companies can help restrict suspicious assets.
But it also raises questions about how much protection customers can realistically expect from an exchange, even when it publishes reserve information and maintains emergency funds.
For now, Binance says customers’ funds are safe and has pledged to cover hacking losses. But until the company releases a detailed account of the incident and confirms the final financial impact, the full scale of the suspected breach remains uncertain.
