# Binance investigates potential security issue as CZ describes apparent hack

Canonical: https://chainincident.com/news/47b28d94-23f7-4e2b-9202-169630d9e77a
Published: 2026-10-29T21:54:27.510Z
Publisher: Chain Incident

Binance says it is investigating reports of a potential security issue. CZ separately described an apparent hack, while Ethereum records show wallet transfers.

Binance said it was actively investigating reports of a potential security issue in an [October 29 statement on X](https://x.com/binance/status/2115918888429133902). The exchange said its security teams were urgently reviewing the available information and would publish updates through official channels once facts had been verified.

The post is displayed as last edited at 21:29 UTC. It did not include a technical cause, a list of affected systems or a complete asset reconciliation.

### Binance's investigation and CZ's assessment

In a separate [October 29 post](https://x.com/cz_binance/status/2115915423174853077), published at 21:15 UTC, Changpeng Zhao said Binance appeared to have been hacked. Zhao thanked Tether and Circle for freezing assets, while stating that he no longer manages Binance.com and describing himself as a shareholder.

These are different statements: Binance has confirmed an investigation into reports of a potential issue; Zhao supplied his own characterization of an apparent hack. Neither post identifies a specific exploit mechanism.

### What one Ethereum transaction records

A [transaction displayed by Etherscan](https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3) is marked successful at 20:24:23 UTC on October 29, in block 26,300,770. It lists 63 ERC-20 transfer rows involving the address the explorer labels Binance 14 and recipient `0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c`.

The transaction's top-level native Ether value is zero, while token movements appear separately in its transfer records. Explorer wallet labels are third-party annotations. Those records alone do not establish ownership, authorization, the cause of a compromise or an incident-wide loss.

Binance's post also warned about scams and unofficial requests for account information. A detailed incident account and separate issuer confirmations remain necessary to reconcile the reported freezes with the recorded wallet movements.

## Sources

- [Binance statement on investigation of a potential security issue](https://x.com/binance/status/2115918888429133902) — Binance (@binance), X
- [Ethereum transaction 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3](https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3) — Etherscan
- [CZ statement on an apparent Binance hack](https://x.com/cz_binance/status/2115915423174853077) — CZ (@cz\_binance), X

- [Editorial policy](https://chainincident.com/editorial-policy)
- [Request a correction](https://chainincident.com/corrections)