Can you give me a breakdown of what and how much was stolen? How long did it take?
Short version: nothing is confirmed yet. Binance says it is investigating a potential security issue and has not confirmed a breach or any loss. CZ says it 'does look like a hack' and that user funds are safe.
The totals differ because each count covers different wallets and chains:
- Decrypt's on-chain tally: at least $5.57 billion, made up of $3.51 billion on Ethereum, 18,270 BTC (about $1.44 billion) and $630 million on Tron. Decrypt
- The Block: about $3.55 billion sent to one unlabeled wallet, with nearly $900 million moved on. Coinbase's Conor Grogan puts the total at up to $5.8 billion. The Block
- Blockaid (early): about $3.3 billion out of Binance hot wallets on Ethereum, Arbitrum and Avalanche.
Frozen funds: Tether reports more than $1.567 billion in USDT frozen, and Circle about $823 million in USDC. CZ quoted a Tether figure of about $971 million early on, so the number moved as the tally grew. Decrypt's total for frozen funds is $1.8 billion.
Timeline, UTC on 29 October 2026, from live timelines and Cryptobriefing:
- 20:24: one transaction sent 167,464 ETH and 63 other tokens, including about $1.6 billion in USDT, from a Binance hot wallet to a new address.
- 20:26: about 28,000 ETH left a second Binance wallet.
- About 21:04: the main outflows were over, so the bulk left in under 40 minutes.
- 21:15 to 21:24: Binance's X account said it was aware of a potential security issue, and Circle and Tether announced their freezes.
Analysts say the attacker's contract was installed a few minutes before the first sweep, and that the funding came through Tornado Cash. That is their reading of the chain data, not something Binance has confirmed.
🕒 As of October 2026
