The Binance apparent hack rests on one source: an X thread by analyst Emmett Gallic saying more than $5 billion left Binance addresses on October 29, 2026. Neither the thread nor its replies contain any statement from Binance. Cyprus crypto and payment firms with exposure should check their own controls now.
Key takeaways
- The over $5B figure comes from one analyst's X thread, revised up from $3B; no Binance statement appears in it or its replies.
- No transaction hashes, wallet addresses or attack method are public, so nothing separates theft from withdrawals or wallet rotation.
- Cyprus CASPs and EMIs should reconcile exposure, restrict API withdrawal rights and timestamp decisions now.
What do we actually know about the Binance apparent hack?
Gallic first posted that “potential Binance hacked wallets” showed over $3 billion moving off the exchange, with more than $900 million in USDT “frozen so far.” A correction posted at 9:17 PM on October 29 (no timezone shown) raised the total to over $5 billion, roughly $2.3 billion of it in USDC and USDT that “should be able to be frozen.”
A Hacker News submission titled “Over $5B drained from Binance in apparent hack” (21:24 UTC, October 29) linked to the thread; it is a forum post, not reporting. The thread’s only evidence is a truncated link to an Arkham Intelligence entity page: no wallet address, transaction hash, attack method or threat actor.
Outflow, migration or theft: why the numbers settle nothing
The posts show value leaving Binance-labeled addresses, not theft. Explorer labels are attribution estimates, and the same pattern fits customer withdrawals, cold-to-hot rebalancing, custody moves or a drain. Only transaction-level destination tracing separates them.
Treat the freeze figures the same way. Tether and Circle can blacklist addresses so their tokens stop moving, but a freeze returns nothing and does not reach BTC, ETH or stablecoins already swapped or bridged. No Tether confirmation of the $900 million appears, and nothing says whether it overlaps the $2.3 billion.
The nearest precedent is Bybit, which lost about $1.5 billion in ETH in February 2025 after signers approved what a tampered signing interface showed them; the FBI attributed it to North Korea’s TraderTraitor. It is a comparison, not evidence.
What should Cyprus CASPs and EMIs do while the claim is unconfirmed?
- Reconcile three records for every Binance account: on-chain balances, approved withdrawal logs and your client ledger.
- Tighten API keys: disable unused withdrawal permission, confirm IP allowlists, rotate any key you cannot account for.
- Pause new exposure until Binance comments.
- Log every decision with timestamps, including what you could not verify.
DORA, applying since January 17, 2025, covers MiCA-authorized CASPs and EMIs. If an exchange incident disrupts your services and you classify it as major, initial notification is due within 4 hours of classification (no later than 24 hours after detection), with an intermediate report within 72 hours.
MiCA Article 75 also makes custodial CASPs liable for client crypto-assets lost through incidents attributable to them.
Do not tell clients or regulators there was a hack until there is official confirmation or transaction-level evidence.
Which controls will CySEC and DORA reviewers ask about?
Reviewers look at custody and access paths, not the headline figure: hot-wallet limits and sweep thresholds, signer sets and MPC/HSM quorums, who can change the signing interface or its pipeline, API key scope, and an exit plan for any single exchange in your third-party register.
The Denmark CPR breach was the same single-supplier problem. The weak point is usually the path around the keystore: a support role that can raise withdrawal limits, a CI job that ships the signing front end unreviewed, an exchange key with forgotten withdrawal rights. Our MiCA and CASP penetration testing and EMI penetration testing exercise exactly these paths.
FAQ
Has Binance confirmed the $5 billion drain?
Not in the available record. As of October 30, 2026, the only source is an analyst's X thread citing an Arkham Intelligence entity page.
Could the flows be an internal Binance wallet move?
Yes. Explorer labels cannot separate withdrawals or rebalancing from theft without transaction-level tracing.
Can Binance's SAFU fund cover a loss this size?
Unknown. No SAFU figure appears in the thread, so leave it out of exposure planning.
If you hold client assets or API keys at a third-party exchange, our API penetration testing checks whether key scope, withdrawal endpoints and approval logic would hold before a regulator asks.