Tornado

Tree

SAFU

<p><img width="2000" height="1500" src="https://financefeeds.com/wp-content/uploads/2026/10/binance-shirt-bnb-mark-binance-hack.jpg" alt="Black Binance t-shirt with the yellow BNB diamond mark beside a yellow Binance bag" title="BNB Price After the Binance Hack 66"></p>
<p>The Binance Hack showed up in the exchange token before Binance's own account used that phrase. In the one snapshot that priced BNB, Bitcoin, and Ether on the same lines, BNB was at $711, down 6.2%, Bitcoin was at $79,381, down 2.4% over 24 hours, and Ether was at $2,279, down 3.7%. The posts that itemized the debit did not put BNB on those lines. They named stablecoins, bitcoin, and ether.</p>
<p>That gap is the price fact. On that snapshot the token's percent was wider than Bitcoin's and wider than Ether's, while the itemized outflow posts were not leading with BNB. A venue token can trade like a claim on the house when the buyer is pricing whether holders get made whole, not whether that token left the wallet. I opened the exchange account, Changpeng Zhao's post, and the issuer notes before treating any percent as a market fact.</p>
<p>This article records the move that already happened. It is not a price prediction.</p>
<h2 id="the-prints-side-by-side">The prints, side by side</h2>
<ul>
 <li>BNB $711, down 6.2%, on the 5:20 p.m. ET snapshot from @Dominikz177 at 21:27 UTC on 29 October 2026. The same lines put Bitcoin at $79,381, down 2.4% over 24 hours, and Ether at $2,279, down 3.7%.</li>
 <li>@Nebraskangooner at 20:51 UTC: Bitcoin from $80.8k to $78.8k and Ether from $2,335 to $2,255 in the prior hour. That post did not price BNB.</li>
 <li>@WatcherGuru at 20:52 UTC: Bitcoin under $78,500 and Ether under $2,250, with over $600,000,000 in leveraged crypto longs liquidated in 30 minutes. No BNB price on that post.</li>
 <li>@KobeissiLetter at 20:55 UTC: Bitcoin below $79,000 and Ether below $2,250, tied to the selloff in technology stocks, not to a BNB print.</li>
</ul>
<h2 id="one-snapshot-priced-the-exchange-token">One snapshot priced the exchange token</h2>
<p><a href="https://x.com/Dominikz177/status/2115918581925843020" rel="noopener noreferrer nofollow">@Dominikz177</a> posted at 21:27 UTC. The post clocks itself as a 5:20 p.m. ET market snapshot. The BNB line is "$BNB $711 (-6.2%)". Bitcoin on that same list is "$BTC $79,381 (-2.4% 24h)" with a range of $78.5K to $81.8K. Ether is "$ETH $2,279 (-3.7%)". The useful fact inside that one post is the percent gap. BNB's 6.2% is larger than Bitcoin's 2.4% and Ether's 3.7% without mixing clocks or mixing accounts.</p>
<p>The post is a roundup. It points at other accounts for the outflow, the freezes, and the liquidation note. It does not point at a separate account as the source of the $711 figure. This piece treats $711 and 6.2% as that account's snapshot, not as a Binance official print and not as a blended tape.</p>
<p>Other posts from the same hour priced Bitcoin and Ether and left BNB off the page. @Nebraskangooner, at 20:51 UTC, wrote that the market was "already reacting in the last hour" and gave Bitcoin from $80.8k to $78.8k and Ether from $2,335 to $2,255. @WatcherGuru at 20:52 UTC put Bitcoin under $78,500, Ether under $2,250, Solana under $96, and XRP under $1.25. @KobeissiLetter at 20:55 UTC wrote that Bitcoin falls below $79,000 and Ether falls below $2,250 "as the selloff in technology stocks deepens." Those levels sit near each other. They are not the same sentence, and the gaps between them are not a new percent.</p>
<figure><img src="https://financefeeds.com/wp-content/uploads/2026/10/bnb-usdt-5m-closes-binance-hack.png" width="1200" alt="BNB 5-minute closes after the Binance Hack">
 <figcaption>
  BNB/USDT 5-minute closes from the Binance public market API, from 18:00 UTC on 29 October 2026 through the latest closed bar. The dashed line is 20:24 UTC, labeled outflow reports. The percents in the prose are the X prints, not a calculation from these closes.
 </figcaption>
</figure>
<h2 id="the-coins-named-in-the-outflow-posts-were-not-bnb">The coins named in the outflow posts were not BNB</h2>
<p>The early outflow posts cluster in one range and the later ones in another. They should be read as a disagreement, not as a single number with a typo.</p>
<p>@spreekaway at 20:32 UTC: "Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash." @TreeNewsFeed at 20:39 UTC: "POTENTIAL BINANCE HACK ONGOING - ONCHAIN." @crypto_banter at 20:43 UTC put a figure on a narrower pipe: a Binance hot wallet it called Binance 14, "roughly $2.53 billion across 60+ tokens on Ethereum, including a major ETH transfer," sent to a fresh address, with the moving transaction initiated by an address funded via Tornado Cash. The report, that post said, remained unconfirmed. @Dominikz177's snapshot intro restates a reported $2.53 billion drain. That is this cluster, not a second measurement.</p>
<p>@DeItaone at 20:42 UTC wrote "BINANCE WALLETS SEE $2.77 BILLION OUTFLOW ACROSS FIVE BLOCKCHAINS" and "HACK UNCONFIRMED." @Nebraskangooner at 20:51 UTC wrote "About $2.77B just left Binance wallets across 5 chains." @KobeissiLetter at 21:14 UTC wrote that Binance wallets saw a $2.8 billion outflow across five blockchains. @TheBlockCo at 21:05 UTC, citing on-chain analyst Spreek and Arkham, wrote that hot wallets appeared to have transferred billions to an unlabeled wallet, with "about $3.55 billion in incoming transfer volume" and nearly $900 million later moved across wallets. @peckshield at 20:55 UTC said only that there seemed to be unexpected large outflows from Binance hot wallets.</p>
<p>A second cluster, posted after 21:10 UTC, is almost twice as large. @WazzCrypto at 21:12 UTC: "Total on the hack is at least $5.57B across 3 chains (likely more)." @solidintel_x at 21:34 UTC: approximately $5.643 billion in outflows from Binance-labeled wallets, split as Ethereum $3.528 billion, Bitcoin $1.449 billion, Tron $628 million, and Arbitrum, Optimism, and Base $38 million combined. @WatcherGuru at 21:42 UTC called it the largest hack in crypto history and itemized "over $5.6 billion stolen": $1.45 billion in bitcoin, $875 million in ether, $234 million in TRX, $50 million in XAUT, $1.57 billion in USDT, $823 million in USDC, $75 million in WBETH, $88.5 million in RLUSD, and $447.5 million in additional cryptocurrencies. BNB is not one of the named lines.</p>
<p>@odysseas_eth at 20:54 UTC described one labeled wallet, not the whole map: "A Binance-labeled wallet moved 167,464 ETH + 63 tokens, including 1.615B USDT, just 3m24s after a signed delegation was installed." The coins in that sentence are ether and tether. The wallet story itself is in the FinanceFeeds incident note, <a href="https://financefeeds.com/binance-3-55b-wallet-transfers-spark-hack-fears-but-no-breach-is-confirmed/" rel="noopener noreferrer nofollow">Binance wallet transfers and the unconfirmed-breach framing</a>. This piece stays on the price change.</p>
<p>Read in order, a line that says the debit was "mostly ether and stablecoins" is only half right. Crypto Banter and Odysseus lead with ether and USDT on Ethereum. Watcher.Guru's later list leads with USDT, then bitcoin, then USDC, then ether. Solid Intel's split is by chain, and the Ethereum line is the largest chain line, which is not the same fact as "the coin that moved was ether." The comparison that holds is narrower. The itemized posts did not name BNB. The one snapshot that did price BNB printed a wider percent than Bitcoin and Ether on those same lines.</p>
<h2 id="what-binance-zhao-yi-he-tether-and-circle-actually-wrote">What Binance, Zhao, Yi He, Tether, and Circle actually wrote</h2>
<p>Binance posted twice, about thirteen minutes apart, and the sentences are not the same. At 21:16 UTC @binance wrote: "Our teams are aware of reports of a potential security issue and are actively investigating. At this stage, we have not confirmed any impact to user funds." At 21:29 UTC the account posted again: "Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe." The later post adds that users should not trust unofficial links, messages, or requests for account information. The first post does not say the funds are completely safe. The second post does not repeat the "not confirmed" sentence. Quoting only one of them edits the tape.</p>
<p><a href="https://x.com/cz_binance/status/2115915423174853077" rel="noopener noreferrer nofollow">Changpeng Zhao</a>, posting as @cz_binance at 21:15 UTC, was more direct than the exchange account and less direct than a confirmation. He wrote: "User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." He was quoting @TreeNewsFeed's 21:05 UTC line, "TETHER FREEZES $971M USDT IN LIKELY BINANCE HACK, WITH NO UPDATE FROM BINANCE STILL." Zhao's "it does look like" is not Binance's "we have not confirmed." Both are on the record. The gap is the reporting.</p>
<p>Yi He, posting as @heyibinance at 21:17 UTC, used the house phrase the two exchange posts did not use. Her note says the team is investigating, that updates will come on official channels once there is verified information, and that users should not trust unofficial links or requests for account information. It ends: "User Funds SAFU." Her X profile lists her as co-founder at Binance. The SAFU wording is a balance-sheet claim, not a price claim. FinanceFeeds has already walked through <a href="https://financefeeds.com/binances-safu-fund/" rel="noopener noreferrer nofollow">why the Secure Asset Fund was built and what it is supposed to hold</a>. These posts do not publish a new reserve number. They publish a sentence.</p>
<p>The freeze figures moved while the posts were still going up. Zhao's ~$971 million of USDT and ~$823 million of USDC are the early pair, lined up with Tree News at 21:05 UTC. <a href="https://x.com/paoloardoino/status/2115918000373346709" rel="noopener noreferrer nofollow">Paolo Ardoino</a> at 21:25 UTC wrote: "Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority." @WatcherGuru at 21:29 UTC then said Tether had "now frozen $1.5 billion" in USDT. Those are three public numbers for one issuer in the same half hour: about $971 million, more than $1.567 billion, and $1.5 billion. They are not a series to average.</p>
<p><a href="https://x.com/jerallaire/status/2115916207463481846" rel="noopener noreferrer nofollow">Jeremy Allaire</a> at 21:18 UTC: "Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation." Zhao's ~$823 million and Allaire's "more than 800M" can sit next to each other. They are close and they are not identical. @whale_alert at 21:13 UTC reported an address with a balance of 823,000,000 USDC just frozen. That line is one address, not a full freeze total. @WazzCrypto at 21:12 UTC said Circle had frozen 800 million in a single wallet, that the total frozen was $1.8 billion, and that another $800 million could still be frozen.</p>
<p>Wazz's later total steps up again. At 21:33 UTC, "as of block 26301098 (21:30 UTC)," the same account said every attacker wallet still holding USDT, USDC, or XAUt was frozen, that Tether and Circle had frozen a total of $2.37 billion, and that $187 million might still be frozen or clawed back by other issuers. @solidintel_x at 21:26 UTC said about $2.2 billion was already frozen, with Tether more than $1.56 billion of USDT, and at 21:34 UTC said Tether and Circle had frozen at least $2.316 billion in stablecoins. Same hour, different ledgers. The posts do not get welded into one.</p>
<h2 id="a-venue-token-is-not-the-coin-that-left-the-wallet">A venue token is not the coin that left the wallet</h2>
<p>On the only snapshot that priced all three, BNB's percent move was larger, and the outflow posts did not lead with BNB. That is what "traded like a claim on the venue" means in desk language. Holders were not being asked, in those posts, to absorb a BNB transfer. They were being asked to judge Binance's two sentences, Zhao's shareholder line, and Yi He's SAFU line.</p>
<p>The liquidation post is a separate market fact from the token fact. @WatcherGuru at 20:52 UTC said over $600,000,000 in leveraged crypto long positions had been liquidated in 30 minutes, and it paired that with Bitcoin under $78,500, Ether under $2,250, Solana under $96, and XRP under $1.25. Dominik's roundup links that post and restates it as "$600M+." This piece uses the Watcher.Guru wording, not the restatement. It still does not explain why BNB's percent, on the later snapshot, was wider than either Bitcoin or Ether.</p>
<p>Kobeissi's 20:55 UTC post is a reminder not to give the hack the whole tape. A technology-stock selloff and a hot-wallet scare can hit the same hour. This piece does not award the entire move to one cause. It records that BNB, which the itemized posts were not leading with, still printed the wider percent on the snapshot that included it.</p>
<p>Insurance language is the TradFi parallel, and it is easy to overdraw. A listed exchange does not hand a shareholder a token and call it the residual claim. Crypto venues sometimes do. FinanceFeeds has laid out <a href="https://financefeeds.com/crypto-exchange-insurance-and-solvency/" rel="noopener noreferrer nofollow">what Binance, Coinbase, and Kraken actually put in writing on insurance and solvency</a>. These posts do not update those documents. They show the tape treating the token as if the question of coverage had been opened. Zhao was careful on that point. He said he does not manage Binance.com anymore, and he said he expects coverage as a shareholder. That is not the same sentence as a fund already paying out.</p>
<h2 id="what-was-said-what-was-frozen-and-what-desks-check-next">What was said, what was frozen, and what desks check next</h2>
<p>The operational tape is already on the posts. It does not require a price path from here.</p>
<p>SAFU. Yi He wrote "User Funds SAFU" at 21:17 UTC. The two @binance posts do not use that word. Zhao said user funds are safe and that he expects them to be fully covered, and he separated himself from day-to-day management. A desk that wants the fund, rather than the slogan, is waiting on a Binance post of holdings or a top-up. Nothing in the posts opened for this piece was that document.</p>
<p>Freezes. The early public pair is Zhao's, about $971 million of USDT and about $823 million of USDC, lined up with Tree News at 21:05 UTC and with Allaire's "more than 800M USDC" at 21:18 UTC. The later public pair is Ardoino's "more than 1.567B USDT" at 21:25 UTC and Wazz's $2.37 billion combined Tether and Circle total at 21:33 UTC. Whale Alert's 823,000,000 USDC line matches the scale of Zhao's Circle figure and does not, by itself, prove the later totals. Wazz's 21:12 UTC note is the one to keep distinct from Ardoino's verb: $800 million was described as still able to be frozen, which is not the same as already frozen.</p>
<p>What the exchange said. Investigating, in both Binance posts. "Have not confirmed any impact to user funds" at 21:16 UTC. "User funds are completely safe" at 21:29 UTC. Zhao's "it does look like a hack" sits between those two in time, at 21:15 UTC, and it is not an exchange confirmation. @KobeissiLetter at 21:14 UTC said Binance had yet to comment, which was true of the exchange account at that minute and false thirteen minutes later. The $2.8 billion in that Kobeissi post is that account's outflow figure, not a Binance admission on @binance.</p>
<p>What desks check next is operational, not a price. Whether @binance posts a token-by-token list that can be set beside Watcher.Guru's itemized $5.6 billion and beside Odysseas's 167,464 ETH. Whether the 21:16 "not confirmed" sentence and the 21:29 "completely safe" sentence get a third note that picks one. Whether the issuers post freeze totals that stop stepping up, or whether Ardoino's 1.567 billion and Wazz's 2.37 billion get reconciled in their own words. Whether a follow-up says which wallets were labeled Binance and which were not. Those are document checks, not a later BNB print.</p>
<p>Scam traffic is already in the official wording. Both the 21:29 Binance post and Yi He's post tell users not to trust unofficial links, messages, or requests for account information. That is a line a broker desk can repeat without adding a market call. The Binance Hack, as a phrase, is Zhao's description on his 21:15 UTC post. It is not yet the phrase on the exchange account.</p>
<h2 id="questions-the-tape-actually-answers">Questions the tape actually answers</h2>
<h3 id="did-binance-confirm-a-hack">Did Binance confirm a hack?</h3>
<p>Not in the posts opened for this piece. At 21:16 UTC Binance said it was investigating and had not confirmed any impact to user funds. At 21:29 UTC it said user funds are completely safe and that it was still investigating. Zhao wrote at 21:15 UTC that it does look like a hack. Those sentences are all still up. They are not the same sentence.</p>
<h3 id="how-far-did-bnb-move-on-a-post-that-also-priced-bitcoin-and-ether">How far did BNB move, on a post that also priced Bitcoin and Ether?</h3>
<p>On @Dominikz177's 21:27 UTC snapshot, BNB was $711, down 6.2%. Bitcoin on the same lines was $79,381, down 2.4% over 24 hours. Ether was $2,279, down 3.7%. The piece does not turn the other Bitcoin and Ether levels into a second BNB percent. Those other posts did not print one.</p>
<h3 id="was-bnb-the-coin-that-left-the-hot-wallet">Was BNB the coin that left the hot wallet?</h3>
<p>Not in the itemized posts opened here. Odysseas named 167,464 ETH and 1.615 billion USDT among 63 tokens. Watcher.Guru's $5.6 billion list named bitcoin, ether, TRX, XAUT, USDT, USDC, WBETH, RLUSD, and an unnamed remainder. BNB was not a named line. Earlier posts put the outflow at about $2.53 billion, $2.77 billion, $2.8 billion, or about $3.55 billion of Arkham incoming volume. Later posts put it near $5.6 billion. The totals disagree.</p>
<h3 id="who-said-the-funds-are-covered">Who said the funds are covered?</h3>
<p>Zhao said user funds are safe and that, as a shareholder, he expects them to be fully covered. He also said he does not manage Binance.com anymore. Yi He wrote "User Funds SAFU." Binance's 21:29 UTC post said user funds are completely safe. None of those posts published a new SAFU balance.</p>
<h3 id="what-was-frozen-and-why-do-the-numbers-differ">What was frozen, and why do the numbers differ?</h3>
<p>Zhao thanked Tether for about $971 million and Circle for about $823 million. Paolo Ardoino later wrote that Tether froze more than 1.567 billion USDT. Jeremy Allaire wrote that Circle froze more than 800 million USDC with law enforcement. Wazz later put the combined freeze at $2.37 billion, after an earlier $1.8 billion. The posts disagree because they were written at different minutes, and some of them describe amounts that could still be frozen rather than amounts already frozen.</p>
<h3 id="does-this-piece-say-where-bnb-prints-after-this">Does this piece say where BNB prints after this?</h3>
<p>No. The chart is the Binance public 5-minute closes already printed. The percents are the X prints already posted. The Binance Hack checks in the last section are documents and follow-up posts, not a price.</p>
<p>This is not financial advice.</p>

BNB Price After the Binance Hack

Table of Contents

FinanceFeeds

Other articles published on Oct 29, 2026

Join our free newsletter for daily crypto updates!