Binance has paused withdrawals on several networks after suspicious outflows from its hot wallets, and the exchange says it is investigating a security incident. I have spent the day reading announcements, posts and the arguments around them, and the headline number is the least useful part of the story.
Every total in circulation is a report, not a receipt. The figures differ because people counted the same outflows at different moments, with prices moving while they did it. As of October 30, 2026, the work worth doing is checking what you can and staying clear of everything else.
What happened in the Binance hack
The creator cites a post from the account @WatcherGuru, which calls Binance the world's largest crypto exchange and puts the loss at more than $5.6 billion. News reports filed on October 29 and 30 traced suspicious outflows from the exchange's hot wallets and estimated them between about $2.8 billion and $5.8 billion, depending on the source. Binance says user funds are safe, no attacker has been named in those reports, and the company has not confirmed a loss figure.
That is why I keep calling it a suspected hack. The outflows are reported. The scale and the attribution are not settled.
For comparison, the creator puts the February 2025 Bybit breach at about $1.1 billion and calls it the largest financial theft on record. Most reports put Bybit's loss nearer $1.5 billion, so on his $5.6 billion figure this one would be close to four times larger. Even the low end of the reported range would be one of the biggest losses an exchange has ever taken, and Bybit held that benchmark until now.
Check the withdrawal status first
A hot wallet is the internet-connected wallet an exchange uses to move coins in and out all day. It has to be online to be useful, which is exactly what makes it a target. Cold storage sits offline and takes longer to reach, so an exchange keeps most customer funds there and a working balance in the hot wallets. If an attacker gets into that working balance, pausing withdrawals is the fastest way to stop the bleeding and count what is left.
The pause is the part that reaches you directly, whether or not you care about the totals. A withdrawal that will not process is not a loss, but you cannot move your coins on your own schedule, and the queue behind an exchange this size is long. Binance's own announcements are the only place that will tell you which networks are open, so read those and ignore screenshots of status pages passed around in group chats.
What Binance has confirmed, and why the totals differ
Binance's public line is that user funds are safe. One report noted that the company's statement was edited twice, which matters because a message that changes wording is harder to read as a final account. Founder Changpeng Zhao said it "does look like a hack", and Tether and Circle reportedly froze part of the funds. The creator makes the same point about the stablecoins: he says the USDT looked frozen and expects at least that portion to be recovered.
Stablecoin issuers can do that because they control the token contract. Freezing balances stops the coins moving, but it does not put them back in users' accounts by itself, and the process depends on the issuer working out which addresses to freeze. If you hold USDT or USDC on Binance, that is a reason to feel slightly better about those balances and no reason at all to feel better about your bitcoin.
The breakdown in that post is where the $5.6 billion comes from. These are the five largest lines.
| Asset | Amount in the post |
|---|---|
| USDT | $1.57 billion |
| BTC | $1.45 billion |
| ETH | $875 million |
| USDC | $823 million |
| Other tokens | $447.5 million |
The remaining lines are $234 million of TRX, $88.5 million of BUSD, $75 million of WBETH and $50 million of XAUT, the tokenised gold product. Add all nine together and you land at roughly $5.6 billion, which is how the headline number was built. The arithmetic is sound. It still only tells you what one post says was taken.
The gap between the $2.8 billion low estimate and the $5.8 billion high one comes from counting at different moments. Prices move, some outflows may turn out to be internal transfers, and frozen stablecoins may drop out of later totals. I would not treat any single number as final until the exchange publishes one, and even then I would want to know whether it counts what was taken or what is still missing.
What to do if your funds are still on Binance
Withdrawals may be closed while you read this, so the first job is information, not action. These are the steps I would work through, in order.
- Open Binance through the app already on your phone, or by typing the address into your browser yourself. Links in Telegram groups, replies on X and emails that look like exchange mail are how phishing starts.
- Read the announcements page and the withdrawal page for your specific asset and network before you plan anything. If the network is paused, retrying will not move the coins.
- When your network reopens, send a small test withdrawal first and confirm it lands in the destination wallet before you move the rest.
- Check the receiving address on the screen of your hardware wallet, not only on your laptop, before you approve the transfer. Malware that swaps clipboard addresses is old and still works.
- Keep your recovery phrase offline and typed into nothing. Anyone who has it controls the funds, and no exchange support agent will ever need it.
- If the withdrawal is open and you do not need the coins for trading this week, move them to a wallet where you hold the keys and leave a working balance on the exchange.
The temptation during a freeze is to sell at whatever the order book offers and sort the cash out later. That turns a temporary withdrawal pause into a permanent loss at the worst price of the day, and it is the one action that cannot be undone when the queue clears. The creator says he is not selling and is keeping his attention on price, which I read as his position rather than a template: his holdings and timeline are not yours.
The scams that follow a hack within hours
A hacked exchange plus scared users is the best phishing conditions the year offers. The messages start before the official statement is final, because the people sending them work from the same headlines you do. Some of what follows will look like help, and the useful ones will never ask for anything. Expect the wave to peak when withdrawals reopen, since that is when a claim about a withdrawal fee or a verification step has a real queue to hide in.
- Anyone who offers to recover your funds, speed up a withdrawal or move you up the queue for a fee is running a scam.
- A direct message from "support" or "security" is fake. Binance and every other exchange publish announcements openly and do not open chats with customers first.
- Pages that ask you to "validate", "sync" or "reconnect" a wallet are after your seed phrase or a token approval that drains it.
- Emails and ads offering a compensation payment, a refund form or a migration bonus for affected users are trading on the news, not on anything the exchange has promised.
- Lookalike domains with an extra letter or a different ending are the standard delivery method. Type the address yourself and check it before you connect a wallet.
One habit costs nothing: treat every link about the Binance hack as hostile until it comes from a page you reached on your own, including links sent by people you trust. No one at support needs your phrase, and anyone who asks for it is not support.
What the creator expects for the bitcoin price
The creator's read is bearish and specific. He says the level to watch is the orange line at 77.5, that he expected a drop to at least 75,000 and possibly 71,000, and that he had been warning about a surprise news event the day before it arrived. "Show me the chart and I'll tell you the news," he says, meaning he thinks price leads headlines rather than the other way round. The BTC/USDT chart he pulls up on WEEX shows roughly 79,047 USDT.
His plan is a set of limit orders below the market: one at 74.4, one at 71.6 and one at 66.7, which on a dollar chart means $74,400, $71,600 and $66,700. A limit order sits in the book and fills only if the price reaches it, so the idea is to buy weakness instead of chasing the drop. He thinks the first couple will be met and doubts the lowest one will.
That argument assumes the chart always telegraphs the news, and you cannot check that. A trader who names several levels in advance will be right about one of them, and the ones that miss get forgotten. It also assumes an orderly slide rather than a flash crash through every level at once, the scenario he says is likely. Orders placed into a crash can fill on the way down and keep losing value the moment they do.
I would treat the levels as his trade plan and nothing more. 77.5 is his marker, not mine, and a named level is a claim about where buyers might appear, not a floor. 71,000 remains the target he has set for himself, with positions on the line.
The Bybit comparison and the anger behind it
The Bybit figure comes up early because it sets the scale. The creator calls that breach the biggest financial theft ever recorded and says this one is about five times bigger. What he does not do is treat the two events the same way.
His first reaction is that Binance had it coming, a reference to the liquidation cascade he blames on the exchange on October 10 last year. He says he lost millions of his own money that day, and that his companies and people he knows took heavy losses. A few minutes later he takes the remark back: "nobody deserves to get funds stolen". I think that reversal is the honest part, because the customers waiting on withdrawals now had nothing to do with October 10.
He is also confident Binance can absorb the hit, calling the company extremely profitable and saying it will find ways to cover the hole. That is one investor's judgment, not a disclosed balance sheet. A $5.6 billion hole in liquid funds is a serious amount even for a company that size, as he admits when he guesses it could take years of profit to rebuild.
Moving to self-custody once withdrawals reopen
An exchange balance is a claim on a company, not coins in your pocket. When you withdraw to a wallet you control, the exchange can no longer lose your funds, and you take on responsibility for the recovery phrase that regenerates them. That trade is the whole argument for self-custody, and the phrase is the part people get wrong.
A hardware wallet keeps the private keys on a device that never touches the internet. You write the recovery phrase, the words that rebuild the wallet on any compatible device, on paper or a metal plate and store it where only you can reach it. The creator makes the case for metal backups because paper fails in a fire or a flood, and he argues that cold storage is still the safest place for coins after the exchange failures of recent years. He name-checks Coldcard and Ledger among hardware wallets that have had their own incidents, and he is right that no place is guaranteed safe.
What that leaves is unglamorous. Buy the device from the maker rather than a marketplace seller, set it up yourself and let it generate the phrase, test a small withdrawal before a large one, and keep the phrase away from cameras, cloud notes and helpful websites. A device that costs money and an evening still beats a withdrawal queue with no visible end.
