Is Binance hacked? As of the evening of October 29, 2026, the only evidence is an X thread claiming more than $5 billion left Binance-labeled addresses that day. No statement from Binance, Tether or Circle appears in it. Treat the claim as unverified, and meanwhile check the API keys, withdrawal settings and admin logins your website controls.
Key takeaways
- An X user claimed over $5B left Binance-labeled addresses on Oct. 29; Binance has not confirmed a hack.
- The only evidence is an Arkham label page: no hashes, addresses, issuer statement or attack vector.
- Site owners should audit API key permissions, IP allowlists and withdrawals rather than panic-withdraw.
Is Binance hacked, or did one X account say so?
Nobody with authority has confirmed a Binance hack. The claim comes from Emmett Gallic (@emmettgallic on X, bio: “Analyst”).
A first post flagged “potential Binance hacked wallets,” said over $3 billion had moved and over $900 million in USDT was “frozen so far.” Its only evidence was an Arkham Intelligence entity page.
A correction at 9:17 PM on October 29 (the time X displayed; no timezone shown) raised the figure to over $5 billion, about $2.3 billion of it in USDC and USDT that “should be able to be frozen.” The first post drew roughly 149,000 views, the correction about 8,500.
Why are Arkham wallet labels not proof of a Binance hack?
Address labels are heuristics, and gross outflow is not loss. Exchanges move money between their own wallets constantly: cold-to-hot rotations, migrations, batched withdrawals, treasury rebalancing. A dashboard total climbs during all of it.
Proving theft takes a transaction table (hash, chain, block time, source, destination, asset, amount) and net flows to outside addresses. The thread names no hashes, addresses, attacker or mechanism, and never explains the $2 billion jump.
Tether and Circle can blacklist addresses, but neither is quoted confirming a freeze, and a freeze reverses nothing. That leaves roughly $2.7 billion ($5 billion minus $2.3 billion) the thread does not call freezable; native coins such as BTC, ETH or BNB have no issuer to freeze them.
What should site owners who connect to Binance check today?
If your shop takes Binance payouts or stores API keys in WordPress, WooCommerce or a hosting panel, check these before moving any balance:
- Export account activity, API-key details and active sessions as evidence before revoking anything.
- Check each key’s permissions. Withdrawal rights should be off unless a plugin genuinely needs them.
- Confirm every key has an IP allowlist pointing only at your server. Revoke any key nobody can explain and issue a fresh one.
- Review recent withdrawals and withdrawal whitelist changes.
- Change WordPress admin and hosting passwords that match your exchange login.
Practitioner’s note: in our engagements, the weak point for a small merchant is rarely the exchange. It is a plugin settings row or wp-config.php holding a key with trade and withdraw rights and no IP restriction. A compromised site leaks it either way.
The thread publishes no indicators to scan for, but antivirus website protection detects malware and tampered files that could read a stored key. Also move wp-config.php above the web root or tighten its permissions.
What would a regulator ask if a hot wallet were drained?
DORA’s scope (Article 2) covers crypto-asset service providers authorized under MiCA, so a CySEC-supervised platform in Cyprus should be ready to answer:
- How much sits in hot wallets, and what triggers a top-up from cold storage?
- Who holds signing keys or MPC shares, and are approvals logged and split between people?
- Are custody, analytics and cloud providers in the ICT third-party register?
- Can your monitoring tell a rebalance from a theft before someone on X labels it?
Our guides on what Cyprus financial firms need to test and DORA TLPT requirements map these controls to the rules.
FAQ
Is Binance hacked right now?
Not as of the evening of October 29, 2026. The claim rests on one X thread citing Arkham labels, with no statement from Binance, Tether or Circle.
Did Tether or Circle freeze Binance funds?
No issuer statement backs the $900 million USDT claim. To verify, look for a blacklist event on the official token contract in Etherscan or Tronscan.
How much is the Binance SAFU fund?
No public figure is confirmed. SAFU is Binance's emergency reserve, not deposit insurance, and one reply, from @BurgerBTC, doubted it reaches $3 billion.
Should I move funds off Binance after the X post?
Not on one unverified post. Check your API keys and withdrawal whitelist, and watch Binance's official X account and announcements page for a statement.
If your site stores exchange keys or payment credentials, our website protection plans add malware scanning, a firewall and cleanup if something gets in.