Changpeng Zhao says Binance will fully cover any losses after billions flowed out of the exchange's hot wallets in under an hour
Binance founder Changpeng Zhao says user funds are safe after a suspected hack drained an estimated $2.5 to $3.5 billion from the exchange’s hot wallets on October 29, 2026. He also says Binance will cover any losses in full.
Forty minutes, billions of dollars
Blockchain analysts flagged the activity between 20:24 and 21:04 UTC. Large sums left Binance hot wallets during that 40-minute window, including ETH, USDT, and USDC.
Several details made analysts suspicious. The addresses receiving the funds were brand new, and the assets were pushed onward within minutes of arriving.
The activity was also funded through Tornado Cash. That is a mixing protocol built to obscure where money came from.
CZ addressed the situation on X at approximately 21:15 to 21:16 UTC. That was roughly ten minutes after the flagged outflows ended.
He said the outflows appeared to be a hack. He added that user funds remained safe and stressed full coverage for any potential losses, speaking in his capacity as a shareholder.
Binance has since confirmed that an investigation is underway. As of the latest updates, there were no verified impacts on user funds.
The stablecoin issuers step in
Tether and Circle moved to freeze about $1.8 billion linked to the outflows. The initial breakdown was $971 million in USDT and $823 million in USDC. Later reports put Tether’s frozen total at approximately $1.5 billion.
Stablecoins are centrally issued, so the companies behind them can blacklist specific addresses. ETH has no equivalent off switch.
How markets took it
Liquidations reached $627.7 million, mostly from long positions.
Bitcoin and ETH fell between 2% and 4% within the hour after reports surfaced. BNB, the token most closely tied to Binance, dropped by as much as 6%.
Why the reassurance matters
CZ’s post landed before most users knew whether to rush for the exits. Still, a pledge to make users whole is a statement of intent, not proof of solvency. The real test is whether Binance’s investigation confirms that customer balances were untouched.
The shareholder framing is also worth noting. It suggests CZ is positioning the hit as something owners absorb instead of customers.
What this means
For traders, the most immediate lesson is about leverage. More than $600 million in positions were wiped out on headlines alone, before anyone knew the full extent of the damage.
The stablecoin freezes may have limited the damage in hours by locking roughly $1.8 billion before it could be laundered further. It also highlights how much control centralized issuers hold over assets marketed as digital dollars.
There are several things to watch from here. First, the findings of Binance’s investigation, including how the attacker gained access to its hot wallets. Second, whether the frozen stablecoin balances can be returned to the exchange. Third, whether any user funds turn out to be affected despite early assurances.
