In this article4 sections
Binance is investigating a possible multibillion-dollar security breach tied to one of its Ethereum wallets, after transfers that prompted Tether and Circle to freeze close to $1.8 billion in stablecoins, Cointelegraph reported. The exchange said on Thursday, October 29, 2026, that it was looking into reports of a potential security issue but had not confirmed any effect on user funds.
Key facts
- Binance said its security teams were reviewing suspicious wallet activity and would update the public once more details were verified.
- Co-founder Changpeng Zhao described the activity as appearing to be a hack and said Tether froze approximately $971 million while Circle froze approximately $823 million.
- Zhao, who no longer manages the exchange, said he expected all user funds to be fully covered.
- Blockchain researcher Spreek first raised the alarm on X, saying assets from a Binance-linked Ethereum wallet moved to a newly created address through a contract call allegedly funded by Tornado Cash.
- Spreek later reported that wallets connected to the transfers had started selling Tether (USDT) through decentralized exchanges.
How the alert unfolded
The sequence began with a public post rather than a company disclosure. Spreek flagged the movement of funds out of an Ethereum wallet associated with Binance into a fresh address, describing the transfer as executed through a contract call allegedly financed via Tornado Cash, the mixing service that has long drawn scrutiny from regulators and exchanges.
Also read: Conduit Sues Tether Over $2.76M USDT Frozen Since 2025
Spreek subsequently said wallets linked to the transfers had begun selling USDT on decentralized venues. That detail matters because large, rapid stablecoin sales are one of the signals analysts watch for when they try to distinguish an exploit from routine treasury movement.
Binance’s public response was cautious. A spokesperson told CoinPulseHQ the exchange was investigating but had not confirmed any hit to customer balances, and that updates would follow verification. Zhao, speaking outside an official company role, went further, calling the activity a hack and pointing to the stablecoin freezes as the main containment step.
Why it matters
Stablecoin issuers can freeze tokens on their networks, which gives them a lever that ordinary token holders lack. In this case, that lever appears to have limited how much of the moved value could be sold on the open market, though the freeze is not the same as recovery. Affected users have no confirmed loss to point to yet, and Binance has framed the situation as unresolved. The episode also shows how quickly a single researcher’s posts can force a major exchange into public comment, and how centralised stablecoin control shapes the outcome of large crypto thefts.
What to watch
The next concrete marker is Binance’s promised update once its security review is complete, alongside any formal confirmation from Tether and Circle on the amounts frozen. How Zhao’s expectation of full coverage is implemented will be the detail customers watch most closely.
Reported by Cointelegraph.
Source: Cointelegraph