Binance has paused withdrawals after between USD 3.3 billion and USD 3.5 billion (about KES 428 billion to KES 454 billion) left its Ethereum hot wallets late on Thursday 29th October 2026. “Withdrawals will resume as soon as the security issue is fully resolved. User funds remain safe,” Binance said at 01:33 on Friday, Kenyan time. It hasn’t said how much it lost.

Binance, the biggest crypto exchange by trading volume, also hasn’t called it a hack, but its founder has. “It does look like a hack on Binance,” Changpeng Zhao said at 00:15. Zhao, better known as CZ, stepped down as chief executive in 2023 but still owns part of the company. An hour later, replying to an estimate that the loss after freezes was about USD 1 billion (about KES 130 billion), he said: “Loss might be a bit higher than that, but will cover.”

So if you keep crypto on Binance, you can’t move it off the exchange for now, and Binance says your balance is safe. It took Binance a few edits to say so. At 00:16 its statement said it had “not confirmed any impact to user funds”, and by 00:29 it read “User funds are completely safe.”

A hot wallet is the online wallet an exchange pays withdrawals from, so it has to stay connected. That’s why attackers go after it.

The main one here, labelled Binance 14 on Etherscan, a public site that shows every Ethereum transaction, was taken over through EIP-7702, a feature added in May 2025 to Ethereum, the blockchain whose own coin is ETH. It lets an ordinary wallet run a smart contract’s code, so once the wallet is pointed at a contract, that contract can move its money without a new signature each time.

At 23:20 on Thursday, Binance 14 was pointed at a contract set up by an address funded partly through Tornado Cash, a mixer that hides where ETH came from. Four minutes later, one transaction moved about 167,464 ETH, 1.615 billion USDT, a stablecoin pegged to the US dollar, and 62 other tokens to a new address. Two more Binance wallets followed with about 28,006 ETH and 823 million USDC. Most of it went in about 40 minutes, and Binance 14 was still being emptied after 00:40.

Pointing a wallet at a contract takes a signature from that wallet’s private key, the secret that controls it. So whoever did this either had the key or got Binance’s systems to sign for them. Binance hasn’t said which.

Totals above USD 5 billion (about KES 649 billion) are going round on X. They add Bitcoin and Tron outflows from Binance wallets that nobody has tied to the attacker.

USDT and USDC are both stablecoins, and unlike ETH, each has a company behind it that can blacklist an address. Tether blacklisted the receiving address at 00:01, and Circle froze the USDC three minutes later.

Tether’s chief executive, Paolo Ardoino, says it froze more than 1.567 billion USDT, though Tether hasn’t said which addresses make up that figure. Circle’s chief executive, Jeremy Allaire, says it froze more than 800 million USDC “in coordination with law enforcement”. That’s about USD 2.4 billion (about KES 312 billion).

The rest, more than USD 1 billion and mostly ETH, is out of their reach. About 700 million USDT also left the receiving address before the blacklist, and much of it was swapped for ETH.

If Binance confirms a theft, the Ethereum transfers alone are more than double the USD 1.5 billion (about KES 195 billion) the FBI says North Korea stole from Bybit in February 2025, which was the biggest crypto theft on record.

Binance’s person-to-person market lets Kenyans swap USDT for M-Pesa with each other. At 01:39, 39 ads offering USDT for M-Pesa were still up at about KES 130 to the dollar. Binance hasn’t said whether those trades settle as normal during the pause.

Binance keeps an emergency fund for this, the Secure Asset Fund for Users or SAFU. The fund now holds 15,000 Bitcoin, about USD 1.18 billion (about KES 154 billion) at Friday’s price. Binance hasn’t said whether it will use it.

In Kenya, the crypto law we covered last October makes licensed platforms keep customer assets apart from their own and hold enough of each coin to pay everyone back. Existing operators have until 4th November 2026 to get licensed.

Until withdrawals reopen, ignore anyone on WhatsApp or Telegram offering to “unlock” your Binance funds. Binance says updates will come through its official channels.

If Binance covers the unfrozen part, as CZ says it will, the loss stays with Binance. But until it explains how the attacker got that signature, nobody outside Binance can tell whether its other hot wallets are open to the same thing.

Figures as of 01:40 on Friday 30th October 2026, Kenyan time, at USD 1 = KES 129.83. We’ll update this story as Binance says more.