Bitcoin tumbled below 79,000 USD on Oct. 29 as reports spread that a wallet linked to a Binance hot wallet had been drained — triggering nearly 1 billion USD in liquidations and the fastest risk-off swing the crypto market has seen in weeks.
By Yasmin Al-Rashid | October 30, 2026
Bitcoin hit an intraday low of 78,297 USD on Binance spot on Oct. 29 and sat near 79,126 USD at press time, according to CryptoSlate, as large unauthorized-looking transfers left Binance-labeled wallets. For anyone holding crypto, the events of the evening were a live demonstration of how fast leverage unwinds when the market’s biggest exchange is suddenly in the headlines.
The Hook: 2.8 Billion USD Out the Door in Minutes
Whale Alert recorded 28,005 ETH — about 64.9 million USD — leaving a Binance-labeled wallet at 20:24:47 UTC, followed by 780 million USDC leaving another at 20:41:23 UTC. Both went to the same newly created address. At 20:38:47 UTC, the receiving address forwarded 195,460 ETH, about 449 million USD, to a second address. On-chain watchers circulated a total close to 2.8 billion USD across five chains, though the full figure remains unreconciled.
- 78,297 USD — Bitcoin’s intraday low on Binance spot on Oct. 29
- 2.8 billion USD — estimated total moved across five chains (unreconciled)
- 2.39 billion USD — frozen by Tether (1.57 billion USD) and Circle (823 million USD)
- ~1 billion USD — crypto liquidations over 24 hours, per CoinGlass
On-Chain Evidence: The Tornado Cash Trail
Analyst Spreek first flagged the activity, noting that the contract call behind the transfers was funded by an address linked to Tornado Cash — a crypto mixing service that hides the origin of funds. Binance posted on X that it is “aware of reports of a potential security issue and are actively investigating,” adding that its security teams were reviewing all relevant information with urgency. Former CEO Changpeng Zhao went further, arguing that “it does look like a hack on Binance.”
The response from stablecoin issuers was immediate. Tether CEO Paolo Ardoino confirmed the firm froze roughly 1.57 billion USD related to the potential hack, while Circle froze about 823 million USD. That freeze power is one of the most underappreciated safety nets in crypto: when stolen funds are denominated in major stablecoins, the issuers can effectively pull the emergency brake on a large share of the stolen value.
The Core Conflict: Panic versus Balance Sheet
How bad would a hack of this size actually be for Binance? DefiLlama co-founder 0xngmi argued that Binance holds 144 billion USD in assets under custody and that the amount effectively stolen would represent less than 1% of that value, meaning the exchange could “cover it from balance sheet easily.” If that analysis holds, the solvency risk to customers is modest. But markets do not price solvency risk in the heat of the moment — they price uncertainty, and uncertainty was in full supply while the exchange was still investigating.
It is also important context that Bitcoin was already weak before the first flagged transfer. It had traded below 80,000 USD earlier on Oct. 29 as a technology-stock selloff and a hawkish reading of the Fed’s Oct. 28 rate hold weighed on risk assets. Binance spot data shows Bitcoin sliding from about 80,849 USD to 80,438 USD between 20:00 and 20:15 UTC. The 20:30 to 20:45 candle closed at about 78,884 USD, down roughly 1.9%, with the low arriving in the next quarter hour. In other words, the reported wallet activity landed on a market that was already leaning over the edge — and gave it a shove.
Market Implications: The Liquidation Cascade
CoinGlass reported nearly 1 billion USD in liquidations across crypto in 24 hours, with roughly 532 million USD in liquidations in a single hour around the incident. Bitcoin liquidations totaled 289 million USD and Ethereum’s totaled 236 million USD. More than 82% of each asset’s losses were tied to long positions — traders who had borrowed to bet on higher prices and were force-sold when prices dropped. Bitcoin trades around 78,600 USD as of this writing, down about 3.3% on the day.
The lesson for regular investors is straightforward: leverage turns a 2% price move into a total loss. If you hold spot crypto on an exchange during a security scare, your bigger risk is usually panic-selling at the bottom — not the exchange itself failing, especially when the amounts involved are small relative to its reserves.
The Verdict
Three things decide what happens next: Binance’s official incident report, whether the frozen 2.39 billion USD in stablecoins stays out of the attacker’s reach, and whether Bitcoin holds the area below 78,000 USD that forecasters had already flagged as a liquidation trap. A rapid, transparent confirmation that losses are contained could restore confidence quickly. A slow, vague response risks feeding exactly the fear that drove the selloff. Either way, the episode is a reminder that in crypto, the fastest losses come not from the hack itself but from the leverage that surrounds it.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
28,005 ETH and then 780M USDC to the same fresh address 17 minutes apart and nobody at Binance noticed in between? that part scares me more than the dump
17 minutes is honestly generous. same thing on a weekend and that gap is measured in hours. anything sizeable belongs on hardware, not a hot wallet
17 minutes because cz was awake. the same drain at 4am utc and that gap gets measured in blocks, not minutes
20:24 utc is peak hours and it still took 17 minutes. this being the fast version is the scary part
both transfers, the 28,005 eth and the 780M usdc, landing on one freshly created address is the detail. thats no treasury shuffle. where is the key rotation story
78,297 was the actual low and we bounced back to 79k within the hour. everyone screaming exit scam on a wick lmao
^ it bounced because CZ already posted about it. try getting that response from any other exchange
1B liquidated on a rumor and we bounced because cz types fast. the confirmed version of that headline is a different market entirely
the entire risk model now rests on founder response time. rating agencies could never
195,460 eth forwarded to a second address before the usdc leg even moved. that routing is practiced, not panicked
suspected 2.8B and withdrawals stayed open, thats the only reason this stopped at 78,297. the second that door closes 79k looks like a gift
the bounce above 79k only proves your point. withdrawals staying open was the whole ballgame, one pause banner and 78,297 gets retested in minutes