Binance's hot wallets are short about $2.53 billion, withdrawals are paused on several networks, and the exchange says it is investigating. What I find more telling than the total is how little of it Binance has confirmed. Almost everything the public knows comes from on-chain tracking and press estimates. Bitcoin traded near $79,500, down about 3.3% on the day.
What left Binance's hot wallets
On-chain tracking puts the outflow at about $2.53 billion, spread across more than 60 tokens on Ethereum, including a large ETH transfer. The transaction that moved the funds began at an address funded through Tornado Cash, a mixing service built to break the link between a sender and a recipient. The assets ended up in a fresh externally owned account, meaning a wallet controlled by a private key, not by a contract.
A hot wallet is the internet-connected wallet an exchange uses to keep customer deposits moving. It stays online because withdrawals have to clear, which is what makes it the part of an exchange that remote attackers aim at. Cold storage keeps keys offline, out of reach of anyone at a keyboard, and exchanges keep only a working balance hot. The creator's framing is that this was that working balance, not the whole exchange, and the distinction decides whether this is a bad week or a solvency problem.
The creator first called the report unconfirmed, then said to treat it as confirmed. I would keep suspected in front of the number until Binance publishes one of its own. Movement on a public chain is not in doubt; the total is. News reports have put the outflows between about $2.8 billion and $5.8 billion. The difference comes down to the price of each of those 60-plus tokens at the moment of transfer, and to whether every address in the trail belongs to the exchange.
A brand new account makes recovery harder. It has no history to lose and no previous counterparties to flag it, so there is nothing to trace beyond the transfer that funded it. That is why the Tornado Cash link matters more than the token count. The address was set up to be hard to follow from the start.
The creator attributed the exploit to the Lazarus group, the North Korean state-linked outfit, after what he described as five to seven days of the company fighting off an attempted intrusion. That attribution is his, not Binance's.
What Binance and CZ have said
Binance's public position is that user funds are safe and that it is investigating the incident. As of October 30, 2026, the exchange has paused withdrawals on several networks. One report noted that its statement was edited twice, which tells you it was drafted while the facts were still moving.
The most quoted line of the day came from outside management. Changpeng Zhao, Binance's founder, wrote on X: "It does look like a hack on Binance." He also thanked Tether and Circle for freezing funds quickly. Zhao stepped down as CEO, so he speaks as a founder with a large stake, not as an executive answering for the incident, and his wording went further than the company's.
That gap is the part I would watch. "User funds are safe" is a statement about the balance sheet. It does not tell you whether the coins in your account can move today, and on a day when withdrawals are paused, those are two different questions. An exchange balance is a claim on the exchange, not coins in your own wallet, and a claim is only as good as the queue behind it.
The Tether and Circle freezes
Two stablecoin issuers moved faster than the exchange's own communications. In the same post, Zhao said Tether froze $971 million and Circle froze $823 million. Together that comes to roughly $1.8 billion, close to the figure the creator quoted as saved.
Issuers can do this because they control the contract that issues the token. A freeze marks a balance as untouchable, so the coins stay on the chain but cannot be spent or moved. In a hack response it is the fastest tool available: no court order and no chain rollback, just an issuer key doing what the terms of service allow.
The creator's read is that this is a service the well connected get and ordinary users do not. When an individual's wallet is drained, nobody calls the issuer on their behalf. The numbers back him up. About $1.8 billion was stopped because a founder picked up the phone, and people who lost funds in smaller incidents earlier in the year had no such option. I would not count on the same rescue if it were my wallet that got emptied.
It also shows where power sits in this market. Two companies can lock a billion dollars of someone else's coins, and whether that reads as a rescue or as overreach depends on who is holding the frozen balance.
How bitcoin and the markets reacted
Bitcoin traded at $79,496.14, with the total crypto market cap at $2.801 trillion. The creator described it sliding from about $80,000 to $78,000 during the day and noted BNB, Binance's own token, down about 9%. For a multi-billion-dollar incident at the largest exchange, he called the reaction resilient, and he expected more downside as the details came out.
BNB fell hardest because it is tied to the exchange that just lost a working balance, so holders price the damage to the business directly. Bitcoin trades on the same order books as everything else, and it took a knock and kept going.
Tech stocks had their own bad day, and the two stories landed together. These were the levels on October 29.
| Asset | Price | Change on the day |
|---|---|---|
| S&P 500 | 7,720.39 | -0.30% |
| Amazon (AMZN) | $243.79 | -4.25% |
| Alphabet Class C (GOOG) | $282.32 | -12.29% |
| Nvidia (NVDA) | $213.66 | -0.80% |
| Microsoft (MSFT) | $530.14 | -0.16% |
Alphabet was the big loser at 12.29%. The creator's explanation is capital spending: the company is putting money into data centers, chips and cloud capacity for AI, and investors marked the shares down for it. Amazon missed earnings and fell 4.25%, while Nvidia and Microsoft barely moved.
His argument is that Alphabet already owns the infrastructure and is adding to it, so the spending is a position, not a cost. That assumes AI demand arrives on schedule and at the margin investors expect. If it arrives late, or if competitors without the same cash flow have to match the spending to stay in the race, the market's reaction stops looking like a mistake. Either way, crypto traded as a risk asset that day, next to the Nasdaq and not against it.
Where the Binance hack sits in the 2026 theft tally
The total stolen in 2025 came to $3.4 billion for the full year, against an estimated $2.5 billion to $2.8 billion for 2026 through late October.
The creator then did the addition. Take the low end of the year-to-date estimate, $2.5 billion, add the $2.53 billion from Binance, and 2026 passes 2025 with two months to spare. That arithmetic assumes the two numbers do not overlap, which is how he treats them. If the year-to-date tracker already counts the Binance outflow, the total is smaller, and nobody publishing estimates has shown which way they count it.
His broader point is that the pace changed because the tools changed. A hacking group used to spend weeks on one target, and now, in his telling, agents can be pointed at many targets at once and left to run. I would add a qualifier: recorded thefts also rise when more value sits on exchanges and more of it is visible on a public chain, so the tally can climb without the underlying security getting worse by the same amount. What the 2026 figure does show is that exchange hot wallets remain the cheapest place to look for a large, liquid payday.
The cycle and midterm data the creator leans on
Bitcoin was about 36% below its all-time high on the day of the incident. Four years earlier, on October 29, 2022, it was down almost 70% and trading at $20,988. The creator's point for anyone in a first bear market is that this one has been mild by comparison, and he called it boring in a way he seemed to enjoy.
The four-year cycle tool on his site takes that $20,988 and multiplies it by the current cycle's 3.81x. The result is a projected $80,026 for October 29, 2026. Spot was $79,496, so the model landed within about $500 of the price. That is a neat coincidence, and I would not read more into it. The multiple comes from the past, and a model built that way will always look clever at the moment a cycle repeats.
Comparing 36% with 70% carries its own assumption. The two drawdowns started from very different markets: one with leveraged retail mostly on offshore exchanges, one with ETFs and advisers holding bitcoin inside ordinary brokerage accounts. Similar-looking percentages can describe very different holders, and holders decide who sells.
The midterm data interests me more, because it is a set of dates.
The gaps are getting shorter: 71 days in 2014, 39 in 2018, 13 in 2022. The creator flagged 2010 as well, with a 71% drop shortly after that election. Six months after the vote bitcoin was still down 28% in 2014 and 11% in 2018, and up almost 50% in 2022. One year out it was up 25% in 2014, 45% in 2018, and had almost doubled in 2022.
His warning is the one worth keeping: the election is not a switch. In the cycles he looked at, the bottom came after the vote, not before it, and the six-month picture was negative twice. A pattern drawn from four elections is a small sample. Anyone using it to time an entry is betting that the intervals keep shrinking, and nothing in the data says they must.
What to check before your next withdrawal
Start with the venue. These are the steps I would follow before moving anything off Binance.
- Open Binance's status page and confirm that withdrawals are open on the specific network you need, because a pause on one chain says nothing about the others.
- Send a small test amount to the address you intend to use, wait for it to confirm, then move the rest.
- Type the address yourself and check the spelling before you connect a wallet anywhere, because an incident like this one produces a wave of fake support accounts and clone sites within hours.
If you hold coins you do not plan to trade in the next month, self-custody takes the exchange out of the picture. The creator's rule is to spread storage: an ETF, a hardware wallet, a second wallet from another maker, an exchange balance for money in transit.
Over the next few days, watch whether Binance publishes a loss figure of its own, because that number will settle the gap between $2.53 billion and the higher press estimates. Watch too whether anyone outside the on-chain analysts confirms the Lazarus attribution. And watch whether the paused networks reopen without a queue, since a withdrawal backlog is where exchanges get into real trouble.
The number to remember is $2.53 billion, and the word to keep in front of it is suspected. Binance says user funds are safe, two stablecoin issuers froze about $1.8 billion, and nobody has published a final loss figure. Until someone does, treat every total and every assurance as unconfirmed, and keep on any exchange only the balance you need for trading.
