CZ Says Binance User Funds Are Safe Amid Suspected Hack
On October 29, 2026, Changpeng Zhao (CZ) posted on X that user funds are safe, and said it looks like a hack targeting Binance. He thanked Tether for freezing about $971 million in USDT and Circle for freezing about $823 million in USDC, while noting that he no longer manages Binance.com but, as a shareholder, expects all user funds to be fully covered. The post cited a Tree News report on Tether freezing the related USDT.
Earlier the same day, Binance flagged large transfers from hot wallets, including Binance 14, to a new address, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c. Etherscan records in transaction 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3 show about 167,464 ETH and multiple tokens, including about 1.615 billion USDT. On-chain observers summarized the scale at about $2.7 billion to $2.8 billion. Binance said it was investigating a potential security issue and had not yet confirmed the impact on user funds.
The statement characterized the previously unconfirmed transfers as a suspected hack, while also making clear the expected coverage at the shareholder level, but the operating team’s investigative conclusion still awaits an update.
Original sources:
Title: User funds are safe! It does look like a hack on Binance... Publisher: CZ 🔶 BNB (@cz_binance) Date: 2026-10-29 URL: https://x.com/cz_binance/status/2115915423174853077 Source type: party involved original post Verification status: Full original post and quoted content read in this article Supporting content: CZ said user funds are safe, it looks like a hack, Tether and Circle freeze amounts, he no longer manages Binance.com, and he expects full coverage
Title: Ethereum Transaction Hash: 0x53bd38b816... Publisher: Etherscan Date: 2026-10-29 URL: https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3 Source type: original data Verification status: Transaction details read in this article Supporting content: Binance 14 transferred about 167,464 ETH and multiple tokens to a new address
Title: Our teams are aware of reports of a potential security issue... Publisher: Binance (@binance) Date: 2026-10-29 URL: https://x.com/binance/status/2115915708504900039 Source type: party involved original post Verification status: Full original post read in this article Supporting content: Binance is investigating and has not yet confirmed the impact on user funds
ABAB AI Insight
Changpeng Zhao (CZ) founded Binance in 2017. After multiple security incidents in the early years, he helped establish the SAFU fund to cover user losses. This time he spoke as a shareholder rather than an operator, similar to how he publicly confirmed losses and promised coverage in the 2025 Trust Wallet expansion incident, but he clearly drew a line around management authority.
The fund flow still involved hot wallets converging into newly created EOAs before being split up. The stablecoin portion was frozen by the issuers, limiting subsequent transfers, but the non-stablecoin assets had already completed an on-chain change of ownership. CZ’s statement that it “looks like a hack” was his own judgment, not the operating team’s confirmed investigative conclusion.
Compared with previous abnormal outflows from exchange hot wallets, this incident involved nearly simultaneous movements across multiple wallets, and the receiving address then further split the funds, making it look more like loss of control over permissions than an internal rebalancing. The shareholder expectation of coverage reduces the likelihood of final losses on the user side, but the actual scope of impact and the coverage mechanism still need to await Binance’s formal investigation results.
Observation indicators are whether Binance releases a formal investigative conclusion, whether related withdrawals are restricted, and the subsequent fund flows of the receiving address.
ABAB News · Cognition Law
Public shareholder expectations of coverage do not mean the operating team has confirmed the loss size.
Freezing stablecoins cuts off liquidation, but on-chain ownership transfer has already been completed.
The former management’s characterization as “looks like a hack” remains separate from the current operating team’s investigative conclusion.