Binance pauses withdrawals as it investigates a potential security issue

Binance later said withdrawals had resumed after it completed its security checks, adding that customer funds remained safe.

Binance says withdrawals are on hold

Binance said on X that it was conducting security checks and that withdrawals would resume only after the security issue had been fully resolved. The exchange did not identify the suspected vulnerability, disclose whether any assets had been stolen, or provide a timeline for restoring withdrawals.

In an earlier update, Binance said its teams were aware of reports involving a potential security issue and were actively investigating. The company said its security teams were reviewing relevant information with urgency and promised to provide further updates through official Binance channels.

Binance also repeatedly said user funds were safe. It warned customers to remain cautious of scams, including unofficial links, messages, and requests for account information. That warning is particularly relevant during a withdrawal suspension, when users may be more vulnerable to fake recovery services or impersonation attempts.

The company’s statements establish that withdrawals are paused and that an investigation is underway. They do not, however, establish the cause of the incident or confirm that the exchange itself was hacked.

Large wallet movements draw scrutiny

The uncertainty has centered on the movement of funds from wallets associated with Binance. On-chain researcher Spreek, as reported by BeInCrypto, flagged the transfers as suspicious, while also acknowledging that they could represent routine wallet maintenance.

According to the report, more than $2 billion in assets moved from Binance linked hot wallets. Hot wallets are connected to online systems and are used to process transactions, making their activity an important signal for exchange liquidity. Large transfers can indicate a security incident, but they can also reflect internal treasury management, custody changes, wallet rotation, or preparations to rebalance funds.

That distinction matters because blockchain data can show where assets moved without immediately showing why they moved. A transfer from a wallet identified as belonging to an exchange is not, by itself, proof that an attacker controlled the wallet. It also does not establish whether customer assets were exposed, whether the exchange authorized the transfers, or whether the funds remain under Binance’s control.

Spreek’s assessment therefore presents the central challenge for interpreting the event. The transfers appeared unusual enough to warrant investigation, but the available on-chain evidence did not conclusively separate a breach from an internal operational event. Binance’s decision to suspend withdrawals suggests that the exchange is treating the situation as serious, even as it maintains that customer funds are protected.

Reports describe the incident as a hack

A separate account has taken a more definitive view. FinanceFeeds reported that Binance founder Changpeng Zhao said the incident appeared to be a hack. The report said Zhao also maintained that user funds were safe and expected them to be fully covered.

The same report described the incident as involving approximately $3.3 billion in drained hot wallet assets and said Tether and Circle froze substantial amounts of stablecoins linked to the activity. Those details, if confirmed, would indicate that the event was more than a temporary exchange outage. Freezing stablecoins can limit an attacker’s ability to move or liquidate assets, but it also reflects the unusual role that centralized issuers play in the crypto market’s emergency response.

The figures in the reports are not identical. BeInCrypto cited more than $2 billion in assets moved from Binance linked hot wallets, while FinanceFeeds described $3.3 billion as drained. The difference may reflect different wallet groupings, asset calculations, or interpretations of transfers. Neither Binance’s public statements cited here provides a confirmed loss figure.

That gap between observed movement and confirmed damage is central to the story. The market is being asked to interpret billions of dollars in transfers before the exchange has explained the transaction path, the affected wallets, or the security mechanism under review.

Liquidity and confidence are now linked

The immediate financial consequence is not necessarily a loss of funds. It is the interruption of liquidity. When withdrawals are paused, customers cannot freely move assets to private wallets, other exchanges, or decentralized protocols. Even if Binance ultimately confirms that no customer funds were lost, the suspension can change how users manage counterparty risk across the exchange sector.

For traders, the first signal to watch is whether withdrawals resume normally and whether Binance publishes a verified explanation of the security issue. A second is the destination and behavior of the transferred assets. Assets that remain identifiable and immobilized present a different risk from funds that are rapidly dispersed across multiple addresses or converted into harder to trace instruments.

Binance’s assurance that user funds are safe is therefore important, but it remains an assertion while the investigation continues. The reports of large wallet movements provide reason for scrutiny, not a final finding. Until the exchange releases verified details, the most accurate description is that Binance is investigating a potential security incident, has paused withdrawals, and faces competing interpretations of whether its wallet activity reflects maintenance or a hack.

Update, 29 October 2026, 23:16 UTC: Binance said that, as part of its ongoing security measures, Binance Alpha trading had been temporarily suspended, and that trading would resume once the security issue was resolved. The exchange said user funds remained safe.