Developing · Updated 30 Oct 2026, 20:05 UTC

The Binance hack, 29 October 2026: what moved on-chain

On 29 October 2026, Binance's hot wallets were hacked. Binance puts the loss at about $6.3 billion and says it will cover all of it. More than $3 billion in ether, stablecoins and other tokens left its Ethereum hot wallets for new addresses, in transfers started by an address funded through Tornado Cash. Four minutes before the first of them, 18,270 BTC left an address that Binance lists in its Bitcoin proof of reserves. Deposits work normally. Withdrawals are paused. Binance said at 19:58 UTC on 30 October that it aims to start resuming them in phases within about 34 hours. Chainalysis, a blockchain analysis firm, says it has “a high degree of confidence” that North Korea is responsible. Binance hasn't said who is. This page follows the funds on the chain.

estimated loss, by Binance: about $6.3B
left a Binance Bitcoin reserve address: 18,270 BTC
frozen, by Binance's verified count: about $3B
Bitcoin amounts not moved yet: Checking…

What's new

Update 15 · 30 Oct 2026, 20:05 UTC

Binance's co-CEOs date the hack to about 20:05 UTC on 29 October and list BTC among the stolen assets, without naming addresses. See in timeline ↓
Binance aims to start resuming withdrawals in phases within about 34 hours of 19:58 UTC on 30 October. A Proof of Reserves snapshot follows within 12 hours, with results by Monday. See in timeline ↓
Its co-CEO says an EIP-7702 delegation gave on-chain approval over a Binance hot wallet without passing through its normal approval controls. See in timeline ↓
The receiving address swapped 3.5 million DAR and 13.9 million CTSI in Uniswap pools, for under 0.2 ETH in total. Nothing else moved on-chain. See in timeline ↓

What happened, minute by minute

All times are UTC on 29 October 2026 unless a row says otherwise.

Jump to latest ↓

28–29 Oct Ethereum
An Ethereum address, 0x7C86…5CA0, receives three withdrawals of about 0.1 ETH from Tornado Cash, a mixing service. It pays the fees for the transactions it starts later.
15:59 Ethereum
That address deploys a new contract, 0x63e8…6fAe. Its source code is not published.
16:20–16:26 Ethereum
It tries the contract on a test address, 0x43AE…04BD.
20:20 Bitcoin
Bitcoin. In block 973,732, 18,270.2 BTC leaves bc1qm34l…77s3h, an address Binance lists in its proof of reserves, in 11 transactions. It goes to one new address and is split across 19 new addresses in the same block.
20:21 Ethereum
The same Ethereum address submits an authorization signed for the address Etherscan labels Binance 14. It lets the new contract act for Binance 14.
20:24 Ethereum
Through the contract, 167,464 ETH, 1.615 billion USDT and about 60 other tokens move from Binance 14 to a new address, 0x5227…2f8c.
20:24 Ethereum
24 seconds later, 28,005.6 ETH and 55.7 million USDT arrive at the same address from the address Etherscan labels Binance 16.
After the first transfers
20:30–20:33 Ethereum
700 million USDT moves on to two more new addresses. Within minutes it is swapped or sent on to other addresses.
20:38 Ethereum
195,460 ETH, about $450 million, moves to 0x8532…43D4.
20:41–20:59 Ethereum
823 million USDC arrives at 0x5227…2f8c from 0xEe7a…4055, a contract wallet that reports attribute to Binance.
By 21:17 Ethereum
Tether and Circle have blacklisted 0x5227…2f8c, freezing its USDT and USDC.
21:22–22:00 Ethereum
0x5227…2f8c sends 88.5 million RLUSD, Ripple's dollar stablecoin, through two other addresses to 0xE702…958d, and sends it 127,953 AAVE directly. 0xE702…958d sells both for ETH on decentralized exchanges.
21:29 Statement
Binance, in a revised statement on X: “user funds are completely safe.”
21:44 Ethereum
A further 200.4 million USDT moves from Binance 14 to the frozen address.
21:47 Ethereum
0x9749…C762, one of the two addresses that received USDT before the freeze, swaps it for about 122,316 ETH and sends 122,310 ETH, about $280 million, to a new address, 0xc887…286A. It has not moved since.
21:52 Ethereum
0x5227…2f8c sends 29,934 WBETH, Binance's wrapped staked ether, about $73 million, to a new address, 0x7f9D…15E3. It has not moved since.
22:02 Ethereum
0x5227…2f8c sends 217.5 million ENA tokens, about $37 million, to the same address.
22:08–23:05 Ethereum
0xE702…958d sends 26,825 ETH to a new address, 0x5440…C942.
22:15 Statement
Chainalysis on X: it is “monitoring funds moving across multiple blockchains, including Bitcoin, Ethereum, Tron, and a number of L2s.”
22:27 Statement
A Binance spokesperson tells TechCrunch that Binance has “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.”
22:33 Statement
Binance on X: “Withdrawals will resume as soon as the security issue is fully resolved.”
22:39 Ethereum
The address funded through Tornado Cash calls the contract again: 122 further tokens and 128.5 ETH move from Binance 14 to another new address, 0xA97b…8d10.
22:51–00:41 (30 Oct) Ethereum
0x7f9D…15E3 sells the ENA in Uniswap pools in more than 20 batches, for about 15,288 ETH.
22:55 onward Ethereum
Binance 14 sends its remaining tokens to the address Etherscan labels Binance 8, in ordinary transfers signed for Binance 14: 44 by 23:08, and more than 220 by 00:31 on 30 October.
22:55 onward Ethereum
Binance 16 sends more than 200 tokens to the address Etherscan labels Binance 8, in ordinary transfers signed for Binance 16. Most went by 23:37; smaller batches followed.
23:22 Statement
Binance says verified frozen assets total $2.54 billion, with more tracing under way.
23:56 Ethereum
The address funded through Tornado Cash calls the contract once more: 2,961.9 ETH, about $6.9 million, moves from Binance 14 to 0xA97b…8d10. (transaction)
30 Oct 00:04 Statement
Binance co-founder Yi He writes on X that “User funds are safe,” that Binance will cover all losses, and that deposits and withdrawals are suspended while it runs security checks, freezes funds and works with law enforcement. She promises a full post-mortem.
30 Oct 00:10 Ethereum
A transaction signed for Binance 14 resets its delegation to none. The contract deployed on 29 October can no longer act for Binance 14.
30 Oct 00:24 Statement
Binance co-founder Yi He writes on X that the Arbitrum Security Council has frozen about $30.5 million linked to the outflows.
30 Oct 00:36–01:30 Ethereum
0x5227…2f8c sends about $17 million of other tokens it received, including PROM, FET, PENDLE, CRV and SHIB, mostly into Uniswap pools.
30 Oct 00:36 onward Ethereum
The ETH raised by these sales collects at 0x5227…2f8c itself, reaching 17,263 ETH by 05:00 UTC. 0xA97b…8d10 does the same.
30 Oct 00:52 Statement
Binance on X: “The current verified total frozen amount is around $3 billion.”
30 Oct 00:59 Ethereum
0x7f9D…15E3 sends 15,292 ETH to 0xc887…286A, which now holds 137,602 ETH. (transaction)
30 Oct 01:14 Ethereum
0x5227…2f8c sends 2,000 ETH to 0x8532…43D4, which now holds 197,460 ETH. (transaction)
30 Oct 01:16–01:28 Ethereum
Three more addresses that got tokens from 0x5227…2f8c (3.38 billion RSR, 17.3 million WLD, 1.76 million MORPHO) sell them and send 6,129 ETH to 0x5440…C942.
30 Oct 01:17 Ethereum
0xA97b…8d10 sends 3,000 ETH to a new address, 0xC209…850a. (transaction)
30 Oct 02:25 Statement
Binance on X: its initial investigation “suggests that the security incident may involve a compromised DevOps engineer's laptop,” which gave access to a service container from which unauthorized withdrawals were submitted. “We have found no evidence of any wallet private key leak.” It puts the impact at about $6.3 billion and says it has revoked the affected address authorization.
30 Oct 04:14 Statement
Jonathan Levin, Chainalysis co-founder, on X: “We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack.” DPRK is North Korea's official name.
30 Oct 04:17 Statement
Binance co-founder Yi He writes on X that deposits work normally and that Binance expects to begin resuming withdrawals within 48 hours.
30 Oct 04:31 Statement
Chainalysis on X: “Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance. We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance.”
30 Oct 04:36 Statement
Binance on X: “Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours.” It adds that “the incident stems from multiple factors.”
30 Oct 05:15 Ethereum
0x5227…2f8c sends 17,260 ETH, nearly all it held, to a new address, 0x03b0…20ea. (transaction)
30 Oct 06:36 Ethereum
0xA97b…8d10 sends 7,647 ETH, nearly all it held, to 0x5440…C942, which now holds 40,601 ETH. (transaction)
30 Oct 08:47 Statement
Binance on X: “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.” It says it is “still on track” to resume withdrawals in 45 hours, and that “the outflows ceased when we paused withdrawal service earlier.”
30 Oct 10:09 Statement
Chainalysis on X and its blog: it sees “thousands of transactions in a short period” and funds circulated among addresses, often back to ones used earlier. On Tron, “many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses.”
30 Oct 10:55 Statement
Binance on X: it has “reserved over $6.34B of company funds to cover this incident,” and “$5B of these funds are already held in the exact token assets that were impacted.” It is buying the rest through the market and OTC desks.
30 Oct 11:07 Statement
Yi He on X: Binance is buying matching amounts of the affected altcoins, on the exchange and over the counter.
30 Oct 11:08 Ethereum New
0x5227…2f8c swaps 3.53 million DAR in a Uniswap pool and receives 0.16 ETH. (transaction)
30 Oct 14:33 Statement New
Richard Teng, Binance co-CEO, in a video on X: an EIP-7702 delegation gave on-chain execution approval over a Binance hot wallet, and “that delegation did not pass through our normal approval controls.” Only Binance's own hot wallet was affected. Withdrawals are “on track to be within 40 hours”, and a full Proof of Reserves report is due by Monday.
30 Oct 17:25 Ethereum New
0x5227…2f8c swaps 13.9 million CTSI in a Uniswap pool and receives 0.02 ETH. (transaction)
30 Oct 19:58 Statement New
Binance's co-CEOs Yi He and Richard Teng, in “Security Incident Update #2” on X: at around 20:05 UTC on 29 October “our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.” About $3 billion is frozen on-chain, and Binance already holds about 80% of the amount in matching assets. It has found no evidence that wallet private keys leaked. It aims to start resuming withdrawals in phases within about 34 hours, plans an initial Proof of Reserves snapshot within 12 hours with results by Monday 2 November, and expects to share technical findings within about 48 hours.

Where did the bitcoin go?

All 18,270.2 BTC came from one address that Binance lists in its proof of reserves. It passed through bc1q0mtc…l2mnm, a new address that was used only in this one block, and ended in 19 new addresses: 17 of exactly 1,000 BTC, one of 832.5 BTC and one of 437.7 BTC. Each tile below checks its address live. Open a tile to see that address on satoshis.watch.

Binance reserve address bc1qm34l…77s3h 18,270.2 BTC out · 11 transactions

New address bc1q0mtc…l2mnm Used only in block 973,732

19 new addresses 17 × 1,000 BTC · 832.5 BTC · 437.7 BTC

Not moved the full amount is still there.
Moving a spend is waiting to confirm.
Moved some or all of it has been sent on.

Checking…

Is the Bitcoin transfer connected?

Binance hasn't named the addresses. Its 30 October update lists BTC among “the exact impacted token assets that were stolen”. The chain shows two things: the transfer came four minutes before the first Ethereum transfer, and the coins were split into round 1,000 BTC amounts on new addresses. It doesn't show who controls those addresses.

How did the funds leave Binance 14?

Since Ethereum's May 2025 upgrade (EIP-7702), an ordinary address can sign a message that lets a piece of contract code act for it. Whoever submits that signed message switches the code on. At 20:21, the address funded through Tornado Cash submitted an authorization signed for Binance 14, pointing it at the contract deployed that afternoon. That address then called the contract's function named sweep, which sent Binance 14's balances to 0x5227…2f8c. How the authorization came to be signed is not public. At 00:10 UTC on 30 October, a transaction signed for Binance 14 reset its delegation to none, so the contract can no longer act for it. On 30 October, Binance's co-CEO said an EIP-7702 delegation gave on-chain execution approval over a Binance hot wallet without passing through its normal approval controls.

1A contract is deployed by an address funded through Tornado Cash.
2A signed authorization lets the contract act for Binance 14.
3One call moves Binance 14's balances.

What has been frozen?

Binance 14 (Etherscan label)167,464 ETH, 1.615 billion USDT, about 60 other tokens; 200.4 million USDT more at 21:44; delegation reset 30 Oct 00:10
0xA97b…8d10↳ 3,000 ETH → 0xC209…850a · 7,647 ETH → 0x5440…C942
Binance 16 (Etherscan label)28,005.6 ETH, 55.7 million USDT
Leftover tokens→ Binance 8 (Etherscan label)
0xEe7a…4055823 million USDC

Receiving address0x5227…2f8c17,260 ETH from token sales → 0x03b0…20ea
0x7f9D…15E329,934 WBETH (held) · 217.5M ENA sold → 15,292 ETH → 0xc887…286A

197,460 ETH0x8532…43D4Can't be frozen
700 million USDTSent on before the freeze
137,602 ETHafter a swap0xc887…286A
40,601 ETH0x5440…C942From token sales · can't be frozen
17,260 ETH0x03b0…20eaCan't be frozen
about $2.0B USDT and USDCFrozen by Tether and Circle

Asset	Where	Amount	Status
USDT	0x5227…2f8c	1,175,464,711	Frozen by Tether
USDC	0x5227…2f8c	823,000,000	Frozen by Circle
USDT	0x9749…C762 and 0x0Ddf…697e	700,000,000	Sent on before the freeze, then swapped or moved on. Both addresses are now blacklisted and hold no USDT.
ETH	0x8532…43D4	197,460	Can't be frozen. Not moved out as of 20:05 UTC.
ETH	0xc887…286A	137,602	Can't be frozen. Came from USDT swapped before the freeze and ENA sold on Uniswap. Not moved out as of 20:05 UTC.
WBETH	0x7f9D…15E3	29,934	Binance's wrapped staked ether. Not moved as of 20:05 UTC.
ETH	0xC209…850a	3,000	Can't be frozen. Not moved as of 20:05 UTC.
ETH	0x5440…C942	40,601	Can't be frozen. ETH from sales of tokens that left 0x5227…2f8c, plus 7,647 ETH from 0xA97b…8d10. Not moved out as of 20:05 UTC.
ETH	0x03b0…20ea	17,260	Can't be frozen. Sent by 0x5227…2f8c at 05:15 UTC. Not moved as of 20:05 UTC.
BTC	19 addresses	18,270.2	Can't be frozen. Live status above.

Binance counts about $3 billion in verified frozen assets in all, including assets frozen at other addresses.

What have Binance and others said?

Binance, on X (revised statement, 21:29 UTC)

“user funds are completely safe”

An earlier version, at 21:16 UTC, said its teams were investigating a potential security issue and had not confirmed any impact on user funds.

“temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure”

A Binance spokesperson, to TechCrunch, 29 Oct 2026.

“Withdrawals will resume as soon as the security issue is fully resolved.”

Binance on X, 22:33 UTC.

“The current verified total frozen amount is around $3 billion.”

Binance on X, 30 Oct 2026, 00:52 UTC.

“Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop.”

“The estimated total impact sits at around $6.3B.”

“We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.”

“Binance will cover all losses from the SAFU fund and the company's funds.”

Binance on X, 30 Oct 2026, 02:25 UTC. Binance says it will publish an updated Proof of Reserves once remediation is complete.

“Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours.”

“The incident stems from multiple factors.”

Binance on X, 30 Oct 2026, 04:36 UTC.

“Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.”

“We are still on track towards the expected timeline to resume the withdrawal service in 45 hours.”

“The outflows ceased when we paused withdrawal service earlier.”

Binance on X, 30 Oct 2026, 08:47 UTC.

“Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted.”

“Ultimately, all user funds will be verified publicly through our Proof of Reserves.”

Binance on X, 30 Oct 2026, 10:55 UTC.

Richard Teng, Binance co-CEO, video on X, 30 Oct 2026, 14:32 UTC

“That delegation did not pass through our normal approval controls.”

“What was affected in this incident was Binance's own hot wallet.”

“We will be sharing a full Proof Of Reserves report by Monday, and we are hoping to give an initial view of Proof of Reserves before that.”

Yi He and Richard Teng, Binance co-CEOs, “Security Incident Update #2” on X, 30 Oct 2026, 19:58 UTC

“At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.”

“At this stage, we have found no evidence that wallet private keys were leaked.”

“The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks.”

“We plan to run an initial Proof Of Reserves snapshot in 12 hours and have the result ready by Monday 2026-11-02.”

Yi He, Binance co-founder, on X, 30 Oct 2026

She writes on X that “User funds are safe,” that Binance will cover all losses, and that deposits and withdrawals are suspended while it runs security checks, freezes funds and works with law enforcement. She promises a full post-mortem.

At 00:24 UTC she added that the Arbitrum Security Council had frozen about $30.5 million linked to the outflows.

At 04:17 UTC on 30 October she wrote that deposits work normally and that withdrawals should begin resuming within 48 hours. At 11:07 UTC she wrote that Binance is buying matching amounts of the affected altcoins, on the exchange and over the counter.

Chainalysis, a blockchain analysis firm, on X and its blog, 30 Oct 2026

“We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance.”

“Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance.”

“Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses.”

Its co-founder Jonathan Levin names the group as TraderTraitor. DPRK is North Korea's official name. Chainalysis counts about $2.8 billion frozen; Binance counts about $3 billion.

Changpeng Zhao, Binance co-founder

He no longer runs the exchange. He posted on X that user funds are safe, thanked Tether and Circle for freezing about $971 million and $823 million, and said that as a shareholder he expects all user funds to be fully compensated.

Markets: BNB fell as much as 9%. About $629 million of leveraged positions were liquidated within an hour. Bitcoin dipped below $78,500.

What isn't known yet

Who carried out the hack. Chainalysis attributes it to TraderTraitor, a group it links to North Korea; Binance hasn't named anyone.
Binance's full account of how the authorization for Binance 14 was signed, and why Binance 16 sent funds to the same address. Binance says there was more than one point of entry and that the delegation bypassed its normal approval controls; the post-mortem is still to come.
Whether the 18,270 BTC on this page is the BTC Binance counts in the loss.
Whether withdrawals resume on the timeline Binance gave.
What Binance's Proof of Reserves report, due by Monday 2 November, shows.

Follow it yourself

Bitcoin, on satoshis.watch

Ethereum, on Etherscan

Update history

Update 15 · 30 Oct 2026, 20:05 UTC: Binance's Security Incident Update #2 and its co-CEO's statement added, with two small swaps from the receiving address. The title and lead now say hack.
Update 14 · 30 Oct 2026, 14:25 UTC: Chainalysis's attribution and its findings on how the funds are moving added.
Update 13 · 30 Oct 2026, 14:00 UTC: Binance's statements from 04:17 to 11:07 UTC added; ETH moved from 0x5227…2f8c and 0xA97b…8d10 to two new addresses; Binance's findings now quoted in its own words.
Update 12 · 30 Oct 2026, 05:00 UTC: Binance's estimate of about $6.3 billion total impact and its first findings added; ETH balances at 0x5227…2f8c and 0xA97b…8d10 updated.
Update 11 · 30 Oct 2026, 04:00 UTC: Binance's frozen count raised to about $3 billion; the Arbitrum Security Council freeze added; ETH balances at 0x5227…2f8c and 0xA97b…8d10 updated.
Update 10 · 30 Oct 2026, 03:33 UTC: ETH from token sales collecting at 0x5227…2f8c (16,993 ETH) and 0xA97b…8d10 (3,371 ETH) added to the timeline and the table.
Update 9 · 30 Oct 2026, 02:15 UTC: Binance's pledge to cover all losses, the full deposit and withdrawal suspension, and its $2.54 billion frozen count added.
Update 8 · 30 Oct 2026, 01:33 UTC: A last contract call on Binance 14 at 23:56 (2,961.9 ETH) added; about $17 million of token sales from 0x5227…2f8c; 3,000 ETH to 0xC209…850a.
Update 7 · 30 Oct 2026, 01:24 UTC: 2,000 ETH from 0x5227…2f8c added to 0x8532…43D4 (now 197,460 ETH).
Update 6 · 30 Oct 2026, 01:03 UTC: ENA sale on Uniswap and the 15,292 ETH added to 0xc887…286A (now 137,602 ETH); 29,934 WBETH at 0x7f9D…15E3 added to the frozen table.
Update 5 · 30 Oct 2026, 00:36 UTC: Binance 14's delegation reset added; Binance 14 row updated for transfers after midnight.
Update 4 · 30 Oct 2026, 00:08 UTC: Binance 16 row corrected: its transfers to Binance 8 continued after 23:37.
Update 3 · 29 Oct 2026, 23:59 UTC: Binance's withdrawal suspension added; Binance 16's transfers to Binance 8 completed at 209 tokens; range of published estimates added.
Update 2 · 29 Oct 2026, 23:27 UTC: Binance 16's transfers to Binance 8 added; Binance 14's count corrected from 42 to 44 tokens.
Update 1 · 29 Oct 2026, 23:12 UTC: Three timeline rows (21:47, 22:39, 22:55–23:07) and the 122,310 ETH row in the frozen table.
Published · 29 Oct 2026, 22:29 UTC: First version of this page.

Sources

Bitcoin: blocks 973,732 onward, read from a Bitcoin node. bc1qm34l…77s3h is listed in Binance's proof-of-reserves address file.
Ethereum: transactions and balances from a public Ethereum node and the Blockscout explorer. Address labels Binance 14 and Binance 16 are Etherscan's. The authorization is in transaction 0xad99…298b, and the first transfer is 0x53bd…e2f3.
Binance on X, 29 Oct 2026, 22:33 UTC
Binance on X, 29 Oct 2026, 23:22 UTC
Binance on X, 30 Oct 2026, 00:52 UTC
Binance on X, 30 Oct 2026, 02:25 UTC
Binance announcement linked from that post, 30 Oct 2026
Binance on X, 30 Oct 2026, 04:36 UTC
Binance on X, 30 Oct 2026, 08:47 UTC
Binance on X, 30 Oct 2026, 10:55 UTC
Yi He on X, 30 Oct 2026, 00:04 UTC
Yi He on X, 30 Oct 2026, 00:24 UTC
Yi He on X, 30 Oct 2026, 04:17 UTC
Yi He on X, 30 Oct 2026, 11:07 UTC
Chainalysis on X, 29 Oct 2026, 22:15 UTC
Jonathan Levin on X, 30 Oct 2026, 04:14 UTC
Chainalysis on X, 30 Oct 2026, 04:31 UTC
Chainalysis on X, 30 Oct 2026, 10:09 UTC
Chainalysis blog, 30 Oct 2026
Richard Teng on X, video, 30 Oct 2026, 14:32 UTC
Richard Teng on X, transcript, 30 Oct 2026, 14:33 UTC
Binance on X, “Security Incident Update #2”, 30 Oct 2026, 19:58 UTC
Changpeng Zhao on X, 29 Oct 2026, 21:15 UTC
Tether CEO on X, 29 Oct 2026, 21:25 UTC
Circle CEO on X, 29 Oct 2026, 21:18 UTC
Blockchain Reporter, 29 Oct 2026: Zhao's post.
PANews, 29 Oct 2026, and Unchained, 29 Oct 2026: totals of about $3.3 billion and $3.5 billion; Binance's statements and their times.
PANews, 29 Oct 2026: liquidations in the past hour.
Crypto Briefing, 29 Oct 2026: BNB's fall.
Coindoo, 29 Oct 2026: bitcoin's dip below $78,500.
TechCrunch, 29 Oct 2026: Binance's withdrawal statement.
Bitcoin Magazine, 29 Oct 2026: the $5.8 billion estimate.
Bitcoin.com News, 30 Oct 2026: Yi He's post.
Gizmodo, 29 Oct 2026: Binance's 6:33 p.m. ET post and the $2.54B frozen figure.
investingLive, 30 Oct 2026: the deposits and withdrawals halt.

This page records public blockchain data and published statements. It doesn't say who controls any address and makes no finding about any person or company.