Crypto Crash After Binance Hack: $628 Million Liquidated in One Hour

Update 22:50 UTC: Tether and Circle have verifiably frozen 1.18 billion USDT and 823 million USDC on the attacker address, while about 700 million USDT left before the freeze. Binance has paused Solana and XRP withdrawals. Bitcoin holds just below $79,000. All updates in the live ticker below.

The crypto market is crashing on Thursday night, and the trigger is Binance. At 20:24 UTC a hot wallet of the world's largest crypto exchange was drained in a single transaction, with roughly $2.8 billion leaving on Ethereum. Within the next hour Bitcoin slid from $80,327 to $78,763, BNB lost up to 6.3%, and about $628 million in leveraged positions were force-closed in one hour. Binance co-founder Changpeng Zhao says it "does look like a hack", while Binance itself says it is investigating reports of a potential security issue. Tether and Circle have frozen around $2.4 billion in stablecoins.

The technical details of the drained wallet are in our Binance hack report. This article is about the market: who sold when, which coins fell hardest and what could come next as Asia wakes up. For the bigger picture of why crypto falls in shocks like this, see our continuously updated explainer Why is crypto down today?

Binance hack live ticker: what has happened since 21:30 UTC

• 22:50 UTC, freeze verified: We queried the contract blacklists ourselves. On the attacker address 1,175.5 million USDT and 823.0 million USDC are frozen. About 700 million USDT had already been moved before the freeze, details in our article USDT frozen.
• 22:45 UTC, on-chain: The attacker keeps distributing: 2.57 million LINK (about $28 million, 22:34), 127,953 AAVE (about $16 million, 22:37) and 167 WBTC (about $13 million, 22:41) leave the attacker address. The 195,460 ETH remain untouched.
• 22:32 UTC, withdrawals: Binance processes Bitcoin, Ether and USDT on Ethereum and Tron. Paused according to Binance: Solana, XRP and stablecoins on Solana, Optimism, Avalanche, NEAR and Polygon, citing wallet maintenance. Full status in Binance withdrawals after the hack.
• 22:48 UTC, market: Bitcoin $78,813 (down 3.0% over 24 hours), Ether $2,269.93 (down 3.8%), Solana $97.23 (down 5.1%), BNB $701.34 (down 7.3%), according to CoinMarketCap.
• 22:15 UTC, on-chain: The attacker address "Binance Hot Wallet Exploiter 2" has been sending out tokens that Tether and Circle cannot freeze since 21:22 UTC: 88.5 million RLUSD (21:22), 7.0 million UNI (21:46), 7.77 trillion PEPE (21:49), 29,934 WBETH (21:52) and 217.5 million ENA (22:02). Fresh addresses receive 0.5 to 1 ETH each for gas. This is how laundering usually starts. Source: our own analysis of Blockscout data.
• 22:15 UTC, the Ether: The 195,460 ETH, worth more than $440 million, were still untouched at 22:13 UTC on 0x8532…43D4. The first address still holds about 1.18 billion USDT and 823 million USDC, amounts that match the freezes reported by Tether and Circle.
• 22:15 UTC, market: According to CoinMarketCap Bitcoin trades at $78,783 (down 3.0% over 24 hours), Ether at $2,264.86 (down 3.9%), Solana at $97.31 (down 4.9%) and BNB at $704.36 (down 6.8%).
• 22:00 UTC: Changpeng Zhao says, as a shareholder, that all user funds will be fully covered, Crypto Briefing reports. Trackers put outflows across six blockchains at up to $3.55 billion; confirmed so far is about $2.8 billion on Ethereum.
• From midnight UTC: Tokyo, Seoul and Hong Kong open. We will update this ticker as soon as Binance speaks again or the market moves sharply.

Crypto crash timeline: what happened, minute by minute

Almost an hour passed between the first on-chain move and the first word from the Binance camp. In that window the market traded purely on blockchain data.

Prices from CoinGecko in five-minute steps, blockchain data from Etherscan. The attacker's address was funded with 0.1 ETH from the mixer Tornado Cash, a common pattern to hide where the gas money came from.

Bitcoin, Ethereum, Solana and BNB: how hard did they fall?

BNB, Binance's own token, takes the heaviest hit. Bitcoin holds up better than the altcoins but loses the $80,000 mark it was trading above in the afternoon.

Over 24 hours, CoinMarketCap showed Bitcoin down 2.6% at 21:23 UTC, Ethereum down 3.6%, Solana 5.3%, XRP 5.8% and BNB 6.1%. Total crypto market capitalization shrank to $2.65 trillion. Where analysts see Bitcoin by year-end is collected in our Bitcoin price prediction.

Two coins buck the trend. Hyperliquid (HYPE) is up 15% in 24 hours and Tron (TRX) almost 5%. For Hyperliquid the reading is obvious: it is a decentralized exchange on its own blockchain, so traders do not leave coins with a company that can be hacked.

What Binance, CZ, Tether and Circle are saying

The key voices of the night in their own words: Changpeng Zhao was first to call it a hack, the exchange itself only confirms an investigation, Tether and Circle report their freezes.

User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.

CZ BNB (@cz_binance) October 29, 2026

Our teams are aware of reports of a potential security issue and are actively investigating. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.

Binance (@binance) October 29, 2026

Tether froze more than 1.567B USDT related to a potential Binance exchange hack. Protecting the industry and our partners is our main priority. Stay safe everyone.

Paolo Ardoino (@paoloardoino) October 29, 2026

Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.

Jeremy Allaire (@jerallaire) October 29, 2026

$628 million liquidated in one hour

The slide is driven less by coin sales than by leverage. According to CoinGlass data cited by PANews, around $628 million in positions were force-closed within one hour, about $607 million of them bets on rising prices.

The mechanism never changes. A trader long with 10x leverage loses the collateral after a drop of roughly 10%, with 20x after 5%. When prices fall, the exchange closes these positions automatically and sells in the process. Each forced sale pushes the price lower and triggers the next wave. That is why BNB falls even though no BNB was stolen.

More on the Binance hack

• Binance hack: how the hot wallet was drained
• USDT frozen: what Tether and Circle really blocked
• Binance withdrawals: which networks are paused
• Is this the end? Three scenarios for Bitcoin
• Ethereum: the hacker sits on 195,000 ETH
• Solana below $100: is $80 next?
• BNB crash: another FTT moment?
• The biggest crypto hacks in history
• How to short Bitcoin in the crash
• Why is crypto down today?

Why is Solana falling when only ETH, USDT and USDC were drained?

The attacker took Ether, stablecoins and Ethereum tokens. Solana has nothing to do with the incident, yet it drops more than Bitcoin. The reason is market structure: almost every coin trades against Bitcoin, Ether, USDT or USDC. When those pairs move, everything moves with them. Binance is also the main trading venue for many altcoins, and traders who fear withdrawal problems sell first and ask later. Solana was already weak before the hack, slipping below $100 after spot Solana ETFs lost $24.8 million on October 27 and 28, as crypto.news reported.

What comes next: Asia and Friday

The evening is only the start. Tokyo, Seoul and Hong Kong open around midnight UTC, and a large share of Binance users sits in Asia. Three things will decide whether the selling continues:

• Binance's next statement. So far the exchange only confirms it is investigating. If it confirms the loss and covers it from its own funds or its SAFU emergency fund, pressure eases.
• Withdrawals. Normal withdrawals are the strongest signal. DefiLlama still showed about $144 billion in customer assets on Binance addresses at 21:15 UTC.
• The attacker's Ether. Most stablecoins are frozen, but around 195,000 ETH cannot be frozen. If the attacker sells them through decentralized exchanges, Ether faces extra pressure in the coming days.

On Friday at 08:00 UTC the monthly October options on Deribit expire, which often amplifies moves in either direction.

What to do now if you hold coins on Binance

• Check whether withdrawals work and move larger holdings to a wallet only you control. Our hardware wallet comparison shows suitable devices.
• Stay away from leverage tonight. The liquidation wave showed how fast positions get closed.
• Do not sell into the spike without a reason that reaches beyond tonight. After the Bybit hack in February 2025 losses were covered and prices recovered, even if it took days.

This article is not investment advice. Crypto assets are highly volatile and you can lose your entire investment. We will update this article as Binance completes its investigation.