Crypto Crash After Binance Hack: $628 Million Liquidated in One Hour

Update 10:45 UTC: trail leads to North Korea, withdrawals within 48 hours. Investigators at TRM Labs attribute the Binance hack with high confidence to North Korea's TraderTraitor group, and Chainalysis points to the same group; Binance has not named an attacker. According to TRM Labs, about $6.36 billion left across ten blockchains, about $2.7 billion is frozen, and the attacker holds more than 420,000 ETH and 18,270 BTC across all wallets. Binance expects to reopen withdrawals within 48 hours; deposits work. Everything in one place: North Korea behind the Binance hack? What we know.

Update 02:30 UTC: Binance puts the damage at $6.3 billion. In an official announcement Binance estimates the total impact at around $6.3 billion, of which about $3 billion is frozen on-chain. According to the initial investigation, a DevOps engineer's laptop was compromised, which let the attacker access a service container and submit unauthorized withdrawal transactions. Binance says it has found no evidence of a private key leak. The exchange will cover all losses from the SAFU fund and company funds; deposits and withdrawals remain suspended, and an updated proof of reserves will follow.

Update 01:25 UTC: Binance confirms the hack. Co-founder Yi He wrote at 00:04 UTC that user funds are safe and Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while the exchange runs security checks, freezes funds and works with law enforcement. According to on-chain investigator ZachXBT, more than $2.83 billion is now frozen. Before the freezes, the attacker had supplied 60 million USDT to Aave and borrowed 19,762 wETH, about $45 million, against it, as Marc Zeller of the Aave Chan Initiative explains.

User funds are safe. Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates.

Yi He (@heyibinance) October 30, 2026

The crypto market is crashing on Thursday night, and the trigger is Binance. At 20:24 UTC a hot wallet of the world's largest crypto exchange was drained in a single transaction, with roughly $2.8 billion leaving on Ethereum. Within the next hour Bitcoin slid from $80,327 to $78,763, BNB lost up to 6.3%, and about $628 million in leveraged positions were force-closed in one hour. Binance co-founder Changpeng Zhao says it "does look like a hack", while Binance itself says it is investigating reports of a potential security issue. Tether and Circle have frozen around $2.4 billion in stablecoins.

The technical details of the drained wallet are in our Binance hack report. This article is about the market: who sold when, which coins fell hardest and what could come next as Asia wakes up. For the bigger picture of why crypto falls in shocks like this, see our continuously updated explainer Why is crypto down today?

Advertisement, for readers in the EU: If you no longer want to keep your coins on Binance after the hack, Bitpanda compares itself with Binance, Kraken, Coinbase and Crypto.com and shows a three-step guide to moving your crypto. Bitpanda is licensed in the EU under MiCA. Other MiCA-licensed alternatives in the EU are Coinbase (licensed via Luxembourg) and OKX (licensed via Malta).

Which EU-licensed exchanges are a Binance alternative, what they charge and how to move your crypto is covered in our guide Binance alternatives: 4 MiCA-licensed exchanges compared.

Binance hack live ticker: what has happened since 21:30 UTC

• 10:45 UTC, North Korea trail: TRM Labs attributes the hack with high confidence to North Korea's TraderTraitor group, Chainalysis points to the same group. Damage per TRM Labs $6.36 billion across ten blockchains, about $2.7 billion frozen. Binance expects to reopen withdrawals within 48 hours. Bitcoin at $77,296 (−3.4% over 24 hours). Everything we know.
• 08:30 UTC, update: According to CoinMarketCap Bitcoin trades at $77,884 (−2.6% over 24 hours), Ether at $2,223.40, Solana at $97.16 and BNB at $706.16 (−6.0%). The attacker address now holds 197,460 ETH; none of it has been sold so far. Binance puts the damage at around $6.3 billion with about $3 billion frozen; deposits and withdrawals remain suspended.
• 07:33 UTC, update: According to CoinMarketCap Bitcoin trades at $78,426 (−1.7% over 24 hours), Ether at $2,245.73, Solana at $97.88 and BNB at $711.43 (−5.1%). The attacker address now holds 197,460 ETH; none of it has been sold so far. Binance puts the damage at around $6.3 billion with about $3 billion frozen; deposits and withdrawals remain suspended.
• 06:36 UTC, update: According to CoinMarketCap Bitcoin trades at $78,441 (−1.9% over 24 hours), Ether at $2,245.76, Solana at $98.05 and BNB at $715.08 (−5.1%). The attacker address now holds 197,460 ETH; none of it has been sold so far. Binance puts the damage at around $6.3 billion with about $3 billion frozen; deposits and withdrawals remain suspended.
• 05:39 UTC, update: According to CoinMarketCap Bitcoin trades at $78,572 (−2.1% over 24 hours), Ether at $2,244.64, Solana at $98.03 and BNB at $717.66 (−5.0%). The attacker address now holds 197,460 ETH; none of it has been sold so far. Binance puts the damage at around $6.3 billion with about $3 billion frozen; deposits and withdrawals remain suspended.
• 04:42 UTC, update: According to CoinMarketCap Bitcoin trades at $78,129 (−2.3% over 24 hours), Ether at $2,241.16, Solana at $97.10 and BNB at $715.94 (−4.7%). The attacker address now holds 197,460 ETH; none of it has been sold so far. Binance puts the damage at around $6.3 billion with about $3 billion frozen; deposits and withdrawals remain suspended.
• 03:44 UTC, update: According to CoinMarketCap Bitcoin trades at $77,861 (−2.3% over 24 hours), Ether at $2,226.64, Solana at $96.63 and BNB at $715.52 (−4.0%). The attacker address now holds 197,460 ETH; none of it has been sold so far. Binance puts the damage at around $6.3 billion with about $3 billion frozen; deposits and withdrawals remain suspended.
• 03:16 UTC, update: According to CoinMarketCap Bitcoin trades at $77,294 (−3.1% over 24 hours), Ether at $2,211.69, Solana at $95.66 and BNB at $710.09 (−5.0%). The attacker address now holds 197,460 ETH; none of it has been sold so far. Binance puts the damage at around $6.3 billion with about $3 billion frozen; deposits and withdrawals remain suspended.
• 02:39 UTC, update: According to CoinMarketCap Bitcoin trades at $77,361 (−2.9% over 24 hours), Ether at $2,217.62, Solana at $95.20 and BNB at $713.91 (−4.2%). The attacker keeps distributing smaller tokens: CFG (about $1.2 million). The attacker address now holds 197,460 ETH; none of it has been sold so far. Binance announces: "Predict (PREDICT) Listing Will Be Postponed".
• 02:07 UTC, update: According to CoinMarketCap Bitcoin trades at $76,418 (−4.5% over 24 hours), Ether at $2,181.59, Solana at $93.57 and BNB at $700.57 (−6.2%). The attacker keeps distributing smaller tokens: WETH (about $1.0 million). The attacker address now holds 197,460 ETH; none of it has been sold so far. Binance has confirmed the hack and says it will cover all losses; deposits and withdrawals remain suspended. Withdrawals: reopened –; newly paused BNB/BSC, BNB/OPBNB, BTC/BSC, BTC/BTC, BTC/ETH, BTC/LIGHTNING, ETH/ARBITRUM, ETH/BASE, ETH/BSC, ETH/ETH, ETH/MANTA, ETH/SCROLL, ETH/STARKNET, ETH/ZKSYNCERA, SOL/BSC, USDC/ALGO, USDC/APT, USDC/ARBITRUM, USDC/ARC, USDC/BASE, USDC/BSC, USDC/CELO, USDC/ETH, USDC/HBAR, USDC/MATIC, USDC/RON, USDC/SEIEVM, USDC/SUI, USDC/WLD, USDC/XLM, USDC/ZKSYNCERA, USDT/APT, USDT/ARBITRUM, USDT/BSC, USDT/CELO, USDT/ETH, USDT/KAIA, USDT/KAVAEVM, USDT/OPBNB, USDT/PLASMA, USDT/SCROLL, USDT/TON, USDT/TRX, USDT/XTZ, XRP/BSC, XRP/ETH.
• 01:43 UTC, update: According to CoinMarketCap Bitcoin trades at $76,958 (−4.4% over 24 hours), Ether at $2,205.17, Solana at $93.83 and BNB at $698.26 (−7.1%). The attacker keeps distributing smaller tokens: PENDLE (about $1.1 million), PENDLE (about $1.3 million), FET (about $1.8 million). The attacker address now holds 197,460 ETH; none of it has been sold so far. Binance has confirmed the hack and says it will cover all losses; deposits and withdrawals remain suspended. Withdrawals: reopened –; newly paused USDC/SONIC.
• 01:11 UTC, update: According to CoinMarketCap Bitcoin trades at $76,980 (−4.8% over 24 hours), Ether at $2,210.78, Solana at $94.21 and BNB at $693.90 (−8.0%). The attacker keeps distributing smaller tokens: PROM (about $5.0 million), MORPHO (about $3.8 million). The 195,460 ETH remain untouched. Binance has posted no new statement on its official announcement page. Solana and XRP withdrawals remain paused.
• 00:38 UTC, update: According to CoinMarketCap Bitcoin trades at $77,160 (−4.9% over 24 hours), Ether at $2,208.67, Solana at $93.21 and BNB at $684.21 (−9.9%). The attacker keeps distributing smaller tokens: ZAMA (about $6.0 million), RSR (about $5.1 million), ZRO (about $5.7 million). The 195,460 ETH remain untouched. Binance has posted no new statement on its official announcement page. Solana and XRP withdrawals remain paused.
• 00:00 UTC, Asia opens with new lows: Bitcoin falls to $77,771 according to CoinMarketCap, the lowest level of the night (down 1.4% in the past hour, down 4.3% over 24 hours). Ether ($2,249) and Solana ($95.49) also slip below their evening lows, and BNB is down 8.0% at $697.67. Binance had posted no new statement on its official announcement page by 00:02 UTC, and Solana and XRP withdrawals remain paused. The attacker's 195,460 ETH are untouched while he keeps distributing smaller tokens: WLD (about $6.8 million), FUN ($6.2 million), USDe ($9.7 million), ONDO ($8.5 million), SAND and SNX.
• 22:50 UTC, freeze verified: We queried the contract blacklists ourselves. On the attacker address 1,175.5 million USDT and 823.0 million USDC are frozen. About 700 million USDT had already been moved before the freeze, details in our article USDT frozen.
• 22:45 UTC, on-chain: The attacker keeps distributing: 2.57 million LINK (about $28 million, 22:34), 127,953 AAVE (about $16 million, 22:37) and 167 WBTC (about $13 million, 22:41) leave the attacker address. The 195,460 ETH remain untouched.
• 22:32 UTC, withdrawals: Binance processes Bitcoin, Ether and USDT on Ethereum and Tron. Paused according to Binance: Solana, XRP and stablecoins on Solana, Optimism, Avalanche, NEAR and Polygon, citing wallet maintenance. Full status in Binance withdrawals after the hack.
• 22:48 UTC, market: Bitcoin $78,813 (down 3.0% over 24 hours), Ether $2,269.93 (down 3.8%), Solana $97.23 (down 5.1%), BNB $701.34 (down 7.3%), according to CoinMarketCap.
• 22:15 UTC, on-chain: The attacker address "Binance Hot Wallet Exploiter 2" has been sending out tokens that Tether and Circle cannot freeze since 21:22 UTC: 88.5 million RLUSD (21:22), 7.0 million UNI (21:46), 7.77 trillion PEPE (21:49), 29,934 WBETH (21:52) and 217.5 million ENA (22:02). Fresh addresses receive 0.5 to 1 ETH each for gas. This is how laundering usually starts. Source: our own analysis of Blockscout data.
• 22:15 UTC, the Ether: The 195,460 ETH, worth more than $440 million, were still untouched at 22:13 UTC on 0x8532…43D4. The first address still holds about 1.18 billion USDT and 823 million USDC, amounts that match the freezes reported by Tether and Circle.
• 22:15 UTC, market: According to CoinMarketCap Bitcoin trades at $78,783 (down 3.0% over 24 hours), Ether at $2,264.86 (down 3.9%), Solana at $97.31 (down 4.9%) and BNB at $704.36 (down 6.8%).
• 22:00 UTC: Changpeng Zhao says, as a shareholder, that all user funds will be fully covered, Crypto Briefing reports. Trackers put outflows across six blockchains at up to $3.55 billion; confirmed so far is about $2.8 billion on Ethereum.
• From midnight UTC: Tokyo, Seoul and Hong Kong open. We will update this ticker as soon as Binance speaks again or the market moves sharply.

Crypto crash timeline: what happened, minute by minute

Almost an hour passed between the first on-chain move and the first word from the Binance camp. In that window the market traded purely on blockchain data.

Prices from CoinGecko in five-minute steps, blockchain data from Etherscan. The attacker's address was funded with 0.1 ETH from the mixer Tornado Cash, a common pattern to hide where the gas money came from.

Bitcoin, Ethereum, Solana and BNB: how hard did they fall?

BNB, Binance's own token, takes the heaviest hit. Bitcoin holds up better than the altcoins but loses the $80,000 mark it was trading above in the afternoon.

Over 24 hours, CoinMarketCap showed Bitcoin down 2.6% at 21:23 UTC, Ethereum down 3.6%, Solana 5.3%, XRP 5.8% and BNB 6.1%. Total crypto market capitalization shrank to $2.65 trillion. Where analysts see Bitcoin by year-end is collected in our Bitcoin price prediction.

Two coins buck the trend. Hyperliquid (HYPE) is up 15% in 24 hours and Tron (TRX) almost 5%. For Hyperliquid the reading is obvious: it is a decentralized exchange on its own blockchain, so traders do not leave coins with a company that can be hacked.

What Binance, CZ, Tether and Circle are saying

The key voices of the night in their own words: Changpeng Zhao was first to call it a hack, the exchange itself only confirms an investigation, Tether and Circle report their freezes.

User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.

CZ BNB (@cz_binance) October 29, 2026

Our teams are aware of reports of a potential security issue and are actively investigating. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.

Binance (@binance) October 29, 2026

Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone.

Paolo Ardoino (@paoloardoino) October 29, 2026

Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.

Jeremy Allaire (@jerallaire) October 29, 2026

$628 million liquidated in one hour

The slide is driven less by coin sales than by leverage. According to CoinGlass data cited by PANews, around $628 million in positions were force-closed within one hour, about $607 million of them bets on rising prices.

The mechanism never changes. A trader long with 10x leverage loses the collateral after a drop of roughly 10%, with 20x after 5%. When prices fall, the exchange closes these positions automatically and sells in the process. Each forced sale pushes the price lower and triggers the next wave. That is why BNB falls even though no BNB was stolen.

More on the Binance hack

• Binance hack: how the hot wallet was drained
• On-chain analysis: what the blockchain shows about the hack
• USDT frozen: what Tether and Circle really blocked
• Binance withdrawals: which networks are paused
• Is this the end? Three scenarios for Bitcoin
• Ethereum: the hacker sits on 195,000 ETH
• Solana below $100: is $80 next?
• BNB crash: another FTT moment?
• The biggest crypto hacks in history
• How to short Bitcoin in the crash
• Why is crypto down today?

Why is Solana falling when only ETH, USDT and USDC were drained?

The attacker took Ether, stablecoins and Ethereum tokens. Solana has nothing to do with the incident, yet it drops more than Bitcoin. The reason is market structure: almost every coin trades against Bitcoin, Ether, USDT or USDC. When those pairs move, everything moves with them. Binance is also the main trading venue for many altcoins, and traders who fear withdrawal problems sell first and ask later. Solana was already weak before the hack, slipping below $100 after spot Solana ETFs lost $24.8 million on October 27 and 28, as crypto.news reported.

What the Binance hack means: five consequences

The night is more than a price drop. As of 23:50 UTC, five consequences are taking shape:

• Binance is under pressure to explain. So far the exchange only confirms an investigation. Open questions: how the attacker obtained the signature for the hot wallet, and whether Binance covers the loss from its own funds. Bybit took only days in 2025, and Binance will be measured against that.
• Stablecoin freezes work, but only in the first minutes. About $2 billion in USDT and USDC is frozen, while 700 million USDT had already left. Issuers can step in, and attackers know it. More in our article USDT frozen.
• EIP-7702 comes under scrutiny. A feature meant to make wallets easier to use drained an entire exchange wallet in one transaction. Exchanges and wallet providers are likely to check delegation signatures more strictly.
• BNB remains the barometer. The exchange token falls hardest. Until Binance confirms and covers the loss, BNB measures trust in the exchange.
• Leverage is out, risk is not. The $628 million liquidation wave removed a lot of leverage, which stabilizes the market short term. What happens to the attacker's 195,460 ETH remains open.

What comes next: Asia and Friday

The evening is only the start. Tokyo, Seoul and Hong Kong open around midnight UTC, and a large share of Binance users sits in Asia. Three things will decide whether the selling continues:

• Binance's next statement. So far the exchange only confirms it is investigating. If it confirms the loss and covers it from its own funds or its SAFU emergency fund, pressure eases.
• Withdrawals. Normal withdrawals are the strongest signal. DefiLlama still showed about $144 billion in customer assets on Binance addresses at 21:15 UTC.
• The attacker's Ether. Most stablecoins are frozen, but around 195,000 ETH cannot be frozen. If the attacker sells them through decentralized exchanges, Ether faces extra pressure in the coming days.

On Friday at 08:00 UTC the monthly October options on Deribit expire, which often amplifies moves in either direction.

What to do now if you hold coins on Binance

• Check whether withdrawals work and move larger holdings to a wallet only you control. Our hardware wallet comparison shows suitable devices.
• Stay away from leverage tonight. The liquidation wave showed how fast positions get closed.
• Do not sell into the spike without a reason that reaches beyond tonight. After the Bybit hack in February 2025 losses were covered and prices recovered, even if it took days.

This article is not investment advice. Crypto assets are highly volatile and you can lose your entire investment. We will update this article as Binance completes its investigation.