Binance says potential security issue, CZ says hack: who is right?

Binance paused deposits and withdrawals on multiple networks on October 29, 2026, after on-chain trackers flagged billions of dollars leaving wallets tied to the exchange. The company confirmed it was dealing with a security incident but stopped short of calling it a hack.

"We are aware of reports of a potential security issue and are actively investigating," Binance said in a statement. "Rest assured that user funds are completely safe." Spokesperson Ross O'Leary said withdrawals were "temporarily suspended on multiple networks following a security incident as a precautionary measure."

Co-founder Changpeng Zhao, who no longer runs the company but remains its largest shareholder, went further. In a post on X, he said the company had been "likely hacked" and that he expects users' funds to be "fully covered." Co-founder Yi He said on X that "User funds are safe" and "Binance will cover all hacking losses."

The company's official post on X said it was "working non-stop to resolve this issue," would "cover all losses," and had suspended deposits and withdrawals while its team conducts security checks, freezes funds, and works with law enforcement.

Analysts and traders estimated that $1.7 billion to $5.7 billion was taken. Stablecoin issuers froze $2.3 billion.

The gap between the founder's characterization and the company's official statement is the story. Zhao says hack. Binance says potential security issue. Yi He says hacking losses. The company has not explicitly confirmed that funds were stolen, has not specified which wallets or networks were affected, and has not said when withdrawals will resume. No loss figure has been confirmed by Binance. No threat actor has been identified.

For security teams, the incident reinforces a familiar pattern: hot-wallet compromise at scale, followed by stablecoin issuers freezing assets to limit outflows. The $2.3 billion freeze shows centralized issuers can act faster than exchanges can investigate.

What defenders should do:

• Treat exchange hot-wallet exposure as a live risk.

Which networks were affected? When will withdrawals resume? Who was behind it? Until Binance answers, the founder's version and the company's version remain two different accounts of the same event.