Reports of an alleged $2 billion security breach at Binance triggered swift responses from stablecoin issuers Circle and Tether on October 29, 2026, as on-chain data showed massive transfers from exchange-labeled wallets. While Binance stated that user funds have not been confirmed as impacted, former CEO Changpeng Zhao (CZ) publicly described the incident as an apparent hack and praised the prompt stablecoin freezes.
- On-chain transfers: An Ethereum address received 28,005.6 ETH from a Binance-labeled wallet before sending 195,460 ETH (valued at approximately $440 million) to another address.
- Stablecoin freezes: Circle targeted approximately $823 million in USDC, while Tether initiated a freeze request for $971.1 million in USDT.
- Official statements: Binance confirmed an ongoing investigation with no confirmed user fund impact, while shareholder CZ stated he expects all user funds to be fully covered.
On-Chain Movements and Stablecoin Interventions
The security concerns stem from activity around an Ethereum address holding over $2.3 billion in total tokens. According to Etherscan screenshots, the wallet received 28,005.6 ETH directly from a Binance hot wallet before transferring 195,460 ETH, worth roughly $440 million, to a secondary address.
Following the flagged transfers, Circle reportedly froze $823 million in USDC residing at the address. Meanwhile, Tether initiated a freeze request for $971.1 million in USDT at the same wallet, with the status listed as pending execution. Combined, the flagged stablecoins approach $1.8 billion. Following recent security incidents in the crypto space, prompt stablecoin interventions remain a primary line of defense. Major issuers like Circle continue to play a direct role in mitigating on-chain asset movements during suspected exploits.
A Binance spokesperson stated: "We are aware of reports of a potential security issue and we are actively investigating. At this stage, we have not confirmed any impact to user funds."
In a post on X on October 29, 2026, former CEO Changpeng Zhao wrote: "User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether ($971m) and Circle ($823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered."
Address Poisoning Suspicions and Market Reaction
On-chain monitoring showed the main address had received microscopic transfers from wallets mimicking legitimate previous transactions, raising questions about address poisoning. While address poisoning involves tricking users into copying fake sender addresses, analysts noted no concrete evidence proves this tactic caused the $440 million hot wallet transfer.
Amid the initial security alerts, USDT briefly dipped roughly 0.1% below its $1 peg on select exchange pairs, with deeper temporary discounts observed on isolated decentralized exchanges.
Why It Matters
This potential $2 billion incident highlights the critical reliance on centralized stablecoin blacklisting to contain large-scale exchange breaches. The quick coordination by Circle and Tether to target nearly $1.8 billion demonstrates how frozen liquidity can prevent stolen funds from being laundered through secondary markets. Moving forward, the industry will watch whether Binance's internal audit confirms full backing of hot wallet reserves without taking a balance sheet loss.
