Bitcoin fell below $80,000 before the first identified transfers in the Binance security incident. The timing matters: the incident cannot explain the initial break. It did, however, give an already falling market a new problem to price in, as traders tried to establish what had left Binance wallets, how much could be frozen, and whether customers would face losses or prolonged withdrawal restrictions.
BTC/USDT spot price from Toobit, as of October 30, 2026.
Bitcoin later traded at 77,522.02 USDT on the chart, after touching 76,501 USDT during its displayed 24-hour window. The price move and the security alarm overlapped, but they are not one event. The useful question is how the confirmed incident added to the pressure that was already there.
What Binance has confirmed
Binance says its initial investigation points to a compromised DevOps engineer’s laptop. The company believes the attacker gained access to a service container and submitted unauthorized withdrawal transactions. It has found no evidence of a wallet private-key leak, though it says a full technical postmortem will follow once the investigation is complete.
Yi He’s statement on the Binance security incident from X, as of October 30, 2026.
Binance estimates the incident’s total impact at around $6.3 billion and says around $3 billion of affected assets have been frozen on-chain. It has temporarily suspended deposits and withdrawals, revoked the affected address authorization, and said it will cover losses using its Secure Asset Fund for Users (SAFU) and company funds. It also plans to publish updated proof of reserves after remediation.
Those statements answer some immediate questions, but they are still an early account of the incident. The estimated impact is not a confirmed final loss. Frozen assets have not necessarily been returned, and a commitment to cover customers does not by itself show how the exchange’s assets and liabilities will look after recovery.
The sequence behind the security alarm
The Ethereum record gives the incident a more precise sequence than the first wave of market posts. At 20:20:59 Coordinated Universal Time (UTC) on October 29, a transaction involving a Binance-associated wallet included an Ethereum Improvement Proposal 7702 (EIP-7702) authorization to a previously deployed contract. The authorization was accepted on-chain. That establishes that an authorization was used; it does not, on its own, establish who approved it or exactly how the attacker gained the ability to submit it.
EIP-7702 authorization transaction from Blockscout, as of October 29, 2026, around 20:21 UTC.
A little over three minutes later, a transaction moved around 167,464 ETH and 1.615 billion USDT, along with other tokens, from that wallet to the receiving address 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c. Another Binance-associated wallet sent roughly 28,006 ETH directly to the same address at 20:24:47 UTC. Around 780 million USDC followed at 20:41 UTC.
Bitcoin moved on its own network. Eleven transactions at 20:20:06 UTC sent recipient outputs totaling around 18,270 BTC to a separate Bitcoin address. The Ethereum authorization did not sign those Bitcoin transactions. Treating the two chains as one technical exploit would obscure what the public records actually show: several large outflows occurred close together, while the precise access path remains under investigation.
Arkham’s view of the Ethereum receiving address shows what remained visible there when the screenshot was taken. It labels the address “Binance Hacker,” but that label is an attribution by the analytics platform, not an independently established identity.
Ethereum receiving-address holdings from Arkham, as of October 30, 2026.
The portfolio held assets worth around $2.17 billion, including:
-
USDT: 1.184 billion tokens, valued at around $1.18 billion.
-
USDC: 823 million tokens, valued at around $823 million.
-
Tether Gold (XAUT): 12,574 tokens, valued at around $50.12 million.
-
Ether (ETH): 16,502 tokens, valued at around $36.45 million.
-
USD1: 27.824 million tokens, valued at around $27.82 million.
-
Pax Gold (PAXG): 1,907 tokens, valued at around $7.62 million.
-
USDT0: 6.186 million tokens, valued at around $6.19 million.
Where the assets went
The receiving address was not the end of the trail. A later on-chain transaction shows interaction with a Uniswap router. Aave’s risk team also described funds spreading across more than 20 wallets and sales of several tokens for ETH. One linked wallet supplied 60 million USDT to Aave V3 and borrowed 19,762 wrapped ether (WETH) shortly afterward.
Those interactions do not establish that a Uniswap pool or Aave itself was hacked. A router can be used to exchange assets after a theft elsewhere. A lending market can be used by a wallet holding the proceeds. Aave’s risk team said the position was overcollateralized at the time it examined it and described precautionary reserve freezes while leaving repayment, withdrawal, and liquidation functions available.
This distinction changes what readers should watch. The exchange-wallet breach is one question; whether the subsequent movement creates losses for another protocol is a separate one. The transactions cited here show use of decentralized finance services, not a verified second exploit.
How much was moved, frozen, or lost
The figures circulating around this incident measure different things. They should not be subtracted from one another to produce a supposed final loss.
|
Figure |
What it describes |
What it does not establish |
|
Around $6.3 billion |
Binance’s initial estimate of total impact |
A final audited customer loss |
|
Around $3 billion |
Assets Binance says were frozen on-chain |
Funds already recovered and returned |
|
Around $2.17 billion |
The displayed value at one Ethereum receiving address |
The total across every wallet and chain |
|
Around 18,270 BTC |
Recipient outputs in the identified Bitcoin transactions |
Proof that the Ethereum authorization controlled Bitcoin |
A freeze can stop some assets from moving, which may improve recovery prospects. It does not settle who ultimately bears the loss, what happens to assets already swapped or moved, or when customers regain normal access. Binance’s promised postmortem and updated proof of reserves are therefore more consequential than another estimate assembled from a single wallet screen.
Why Bitcoin fell further
The broader Bitcoin decline was underway before the identified wallet transfers. That limits the causal claim: the hack alarm was an additional shock, not the sole reason Bitcoin crossed $80,000.
After the first identified transfers, the selling became sharper across major assets. In a matched Toobit spot window extending from shortly before 20:00 UTC to 02:05 UTC, Bitcoin fell from 80,848.64 to 76,501 USDT, around 5.4%. Ether declined around 7.0%, while BNB fell around 8.7%. BTC/USDT spot volume from 20:30 to 21:30 UTC was around 3.7 times the preceding hour’s volume on the same venue.
That combination is consistent with a market reassessing exchange and custody risk while prices were already under pressure. It cannot isolate how much of each decline came from the incident rather than other selling, liquidations, or the preexisting move. BNB’s larger fall is notable because of its connection to the Binance ecosystem, but it is still a price response, not an independent measure of customer losses.
What would show that the incident is contained
The next meaningful evidence is operational and financial, not another wallet label. Four developments would narrow the uncertainty:
-
A completed technical postmortem explaining the access path, affected systems, and why the withdrawals were authorized.
-
A documented recovery account separating assets frozen, returned, still traceable, and irrecoverable.
-
Restored deposit and withdrawal service with a clear account of any restrictions that remain.
-
Updated proof of reserves and liabilities that lets readers assess Binance’s position after the promised customer coverage and remediation.
A rise in Bitcoin would not answer those questions. Nor would a falling wallet balance automatically prove recovery; assets can leave an address for several reasons. The strongest test of Binance’s assurance is whether customers regain access and the company publishes enough detail to reconcile what happened with what it says it can cover.
Bitcoin outlook
Bitcoin’s move below $80,000 began before the visible incident sequence, so a complete Binance response would not automatically restore the earlier price. The security news did add a specific source of uncertainty: traders now have to assess the exchange’s operational recovery alongside Bitcoin’s existing market weakness.
A convincing stabilization would require Bitcoin to hold a recovery after the immediate selling subsides, while Binance documents progress on access, recovery, and reserves. Continued withdrawal restrictions, a higher verified loss, or evidence of another affected system would make a quick return above $80,000 harder to sustain. The most defensible reading for now is narrower than either “the hack caused the entire drop” or “the incident is already over.” The price decline had started; the incident increased the cost of assuming it would end quickly.
How to buy Bitcoin on Toobit
Open the Toobit Bitcoin spot market, where Bitcoin is quoted in USDT, and choose a market or limit order. The spot trading guide explains how to place either type of order.
Before confirming, check the live quote, fees, order limits, amount of Bitcoin you would receive, account requirements, and availability in your location. Consider whether you plan to leave the Bitcoin on the platform or transfer it to your own wallet.
Risk warning
Cryptocurrency is subject to significant price volatility, and you may lose some or all of your invested funds. Please review the applicable terms and assess these risks carefully before making any investment decisions.
