Download
← All fact checksMorning run · October 30, 2026 · #1 by reach
EconomyTechnologyCrimeEvent claim

Did CZ say a Binance hack froze $971 million at Tether and $823 million at Circle?

Was Binance hacked this week, and are its users' funds really 'completely safe' as the exchange claims?

True, but…

The incident and both freeze figures are real — but Tether's total was later revised upward.

True with caveats. On 29 October 2026, Binance founder Changpeng Zhao posted that a hack on Binance appeared to have happened, that Tether froze about $971 million and Circle about $823 million, and that user funds were safe. Binance later confirmed the incident. Tether's freeze was subsequently revised to more than $1.567 billion.

+4Sources ↓Original post ↗

Claims

✓ 5 true

It does look like a hack on Binance.123

✓ TrueCentral claimHigh confidence

Binance's own security-incident update confirms the incident, and it was independently reported by the Associated Press and The Guardian the same day. The exchange said its initial findings point to a compromised laptop belonging to a DevOps engineer, used to submit unauthorised withdrawal transactions, and put the estimated total impact at around $6.3 billion. That combination matters: a company statement alone would only tell us what Binance wants known, but two wire and broadsheet outlets with no stake in the exchange's reputation reported the same suspected hack on the same day. Zhao's wording is also notably careful — 'it does look like' — framing his statement as an assessment rather than a confirmed finding, which is what the evidence at that point supported. Readers should still note the distinction between 'a hack occurred' (established) and 'this is exactly how it happened' (Binance's own preliminary account).

Still open: Binance's account of how the breach happened is its own preliminary description; it has not been independently reconstructed in the sources we reviewed.

Tether quickly froze roughly $971 million.127

“Appreciate the quick freeze from Tether (~$971m)”

✓ TrueHigh confidence

The $971 million figure was the initial USDT freeze reported as the incident broke on 29 October 2026, so it was accurate when Zhao posted it. What changed afterwards is the total, not the accuracy. Tether CEO Paolo Ardoino later said more than $1.567 billion in USDT had been frozen, and Binance put total frozen assets across the firms at about $3 billion. In other words, Zhao described an early snapshot of a fast-moving situation, and the snapshot was right. The reason this claim carries a caveat rather than a clean pass is that anyone reading the post today would take $971 million as Tether's final figure, and it isn't. We treat the later revision as confirmed because it comes from the issuer's own chief executive and is repeated in independent reporting.

Still open: None material; the direction of the revision (upward) is consistent across sources.

Circle quickly froze roughly $823 million.12

“and Circle (~$823m)”

✓ TrueHigh confidence

This is the cleanest of the numbers. Circle CEO Jeremy Allaire confirmed publicly that the company had frozen more than $800 million in USDC linked to the incident, in coordination with law enforcement. That matches Zhao's ~$823 million closely enough that the difference is rounding and timing, not substance. The confirmation comes from the issuer of the stablecoin itself — the party that controls the freeze — which is the strongest possible source for a fact of this kind, and it is echoed in AP's reporting. We rate it HIGH rather than absolute because the exact dollar figure is Circle's own disclosure and has not been audited by a third party, but the substance of the claim is not in doubt: Circle froze a sum in the region of $800 million.

Still open: The precise final USDC figure is Circle's own disclosure; the sources give 'more than $800 million' rather than an audited total.

User funds are safe and I expect all user funds will be fully covered.35

“User funds are safe! ... I expect all user funds will be fully covered.”

✓ Likely trueHigh confidence

Binance stated that user funds are safe and that it will bear all losses from its SAFU fund and company funds, and co-CEO Yi He repeated the commitment according to industry reporting. That is a strong commitment, but it is a commitment, not an audit. Nobody in the sources we reviewed has independently verified the exchange's balance sheet or confirmed that every customer will in fact be made whole. That is why this claim sits at LIKELY_TRUE rather than TRUE: the company has said the right thing, repeatedly and on the record, and the mechanism it names (the SAFU fund plus company funds) is a real one, but the proof will come when withdrawals are processed and claims are paid. Zhao's own wording — 'I expect' — is a prediction by a shareholder, not a guarantee from the operator.

Still open: Whether every affected user is ultimately repaid in full will only be settled by the exchange's claims process.

CZ no longer manages Binance.com but remains a shareholder.16

“I don't manage Binance (.com) anymore, but as a shareholder”

✓ TrueHigh confidence

This is a straightforward matter of public record. Zhao stepped down as Binance CEO in 2023 after pleading guilty to a Bank Secrecy Act violation. Coverage of this incident describes him as no longer managing the exchange and as a shareholder, and US court filings have described him as its majority owner. Binance now has a co-CEO in Yi He. So the post's self-description is accurate in both halves: he does not run Binance.com day to day, and he does hold a significant ownership stake. That second half is the part readers should hold onto, because it explains why his reassurance about coverage is not a neutral observer's view — he is telling you what he expects as an owner.

A text-only post: there was no media to test.

What was posted

X

A text-only post on X from the account @cz_binance, attributed to Binance founder Changpeng Zhao. It reports that a hack on Binance appears to have taken place, thanks Tether and Circle for freezing roughly $971 million and $823 million respectively, and assures readers that user funds are safe. It asks the reader to accept both the scale of the incident and the exchange's ability to cover losses.

“User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”

Posted from Zhao's own X account during the incident on 29 October 2026, before Binance published its official security-incident update.

Who posted it

X
@cz_binance
View the account on X ↗

Account check

Looks like a genuine account92%
Likelihood of automation4%

Estimates from public signals — account age, posting pattern, audience — not a judgement of the person behind the account, and separate from whether this post is true.

What stood out

  • @czbinance is Changpeng Zhao's confirmed official X account; CZ himself stated in October 2024 that it is the only account he uses and that other 'cz...' handles are impersonators.
  • The handle is repeatedly cited by credible outlets in October 2026 as the source of CZ's statements, including his October 29, 2026 post about a suspected Binance hack and stablecoin freezes.
  • The account belongs to a highly prominent real person (Binance founder, post-pardon crypto figure), and its recent activity matches his known public role and communications.
  • No evidence of automated, coordinated, or inauthentic behaviour was found; activity is consistent with a principal's personal account.
  • Caveats: the supplied profile metadata is empty and isplatformverified is false, which prevents verification from the profile page itself, and CZ's prominence makes impersonation/hack risk a persistent concern.
Signals (6)+
Account identity confirmed by owner
Yes
Notable news coverage
Multiple 2026 outlets (The Block, CoinMarketCap, TheCable, LIGA.net) quote @cz_binance directly
Known affiliations
Founder/former CEO and shareholder of Binance; BNB Chain promoter
Impersonation risk
High; CZ warned in 2024 about numerous fake cz_* accounts
Profile metadata completeness
Low (bio, follower count, creation date, verification status missing)
Posting cadence
Unknown from supplied data; recent posts are newsworthy and consistent with public appearances

Account checked October 30, 2026, 02:47 UTC

Sources

7 sources reviewed

Further reading

  • 1AP News AP's report is the clearest independent account of the incident and quotes Zhao directly.
  • 3Binance Binance's own incident update is the primary document for the breach, the impact estimate and the loss-coverage commitment.
  • 7CoinMarketCap / FinanceFeeds Explains how Tether's figure moved from about $971 million to more than $1.567 billion.

The full story

On 29 October 2026, large unauthorised transfers moved billions of dollars of assets out of hot wallets linked to Binance. The exchange suspended deposits and withdrawals and said it was investigating.

The detail that made this incident unusual was how quickly the stablecoin issuers moved. Circle's chief executive confirmed more than $800 million in USDC had been frozen in coordination with law enforcement. Tether's chief executive initially saw roughly $971 million in USDT blocked — the figure Zhao quoted — and later said more than $1.567 billion had been frozen. Binance's own update put total frozen assets at about $3 billion and the estimated impact at around $6.3 billion.

Binance's preliminary account pointed to a compromised laptop belonging to a DevOps engineer, used to submit unauthorised withdrawal transactions. The company said it would bear all losses through its SAFU fund and company funds.

That is the kernel of truth behind the post. Zhao was not describing a rumour; he was commenting, in real time, on a genuine incident at a company he founded. His two freeze figures matched what the issuers themselves were saying at that moment. The one thing that has changed since is scale: Tether's number was revised upward, so anyone citing $971 million as the final total is working from an early snapshot.

Kernel of truth

A real Binance security breach on 29 October 2026, during which Tether and Circle did freeze hundreds of millions to over a billion dollars in stablecoins, and Binance did commit to covering losses.

Timeline

  1. October 29, 2026

    Large unauthorised transfers move billions out of Binance-linked hot wallets; the exchange suspends deposits and withdrawals and opens an investigation. 1AP News

  2. October 29, 2026

    Changpeng Zhao posts on X that it 'does look like a hack on Binance', citing freezes of about $971 million at Tether and $823 million at Circle. 1AP News

  3. October 29, 2026

    Circle CEO Jeremy Allaire confirms more than $800 million in USDC frozen in coordination with law enforcement. 1AP News

  4. October 29, 2026

    Binance publishes a security-incident update estimating about $6.3 billion of impact, about $3 billion frozen, and commits to covering losses via SAFU and company funds. 3Binance

  5. October 30, 2026

    Tether CEO Paolo Ardoino says more than $1.567 billion in USDT has been frozen, up from the roughly $971 million initially reported. 7CoinMarketCap / FinanceFeeds

How it was framed

Accurate

The post's substantive claims — a hack, the two freeze figures, the ownership situation — match the record. The only gap is that Tether's total was revised upward after posting, which is a matter of timing rather than a misleading framing.

  • Borrowed authority. 'Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m)' — the credibility of named stablecoin issuers is used to support the account of events.
  • Urgency. 'Appreciate the quick freeze' and 'User funds are safe!' placed first, before any explanation of what happened.
  • Missing context. Gives a freeze total with no time stamp, so a later reader cannot tell it was an initial figure that would be revised.
  • Us vs. them. 'I don't manage Binance (.com) anymore, but as a shareholder' — separates the poster from the operator while retaining an owner's stake in the outcome.

Posted from Zhao's own verified X account (@cz_binance) on 29 October 2026, before Binance's official incident update. Zhao stepped down as Binance CEO in 2023 after pleading guilty to a Bank Secrecy Act violation and is described in US court filings as the exchange's majority owner.

Bias

NoneSlightModerateStrong

Leans pro-Binance / reassuring. The post is written by Binance's founder and majority shareholder, and frames a multi-billion-dollar security incident around reassurance ('user funds are safe', 'fully covered') while pointing to third-party stablecoin issuers as the rescuers. The factual content holds up, but the framing minimises the exchange's own responsibility.

Bias describes how the post frames its message — the slant of the language, selection and emphasis — and is judged separately from whether the claim is true. A true claim can still be framed with a strong slant.

How we checked

36 s
  1. 1

    Searched for coverage of a Binance hack in October 2026 involving Tether and Circle freezes, using four query variants including a site-restricted search for Reuters and AP.

  2. 2

    Compared Zhao's post against independent reporting from AP, The Guardian and The Independent on the same incident.

  3. 3

    Checked Binance's own security-incident update for its account of the breach, its impact estimate and its commitment to cover losses.

  4. 4

    Checked the freeze figures against statements attributed to Tether CEO Paolo Ardoino and Circle CEO Jeremy Allaire, including later revisions.

  5. 5

    Reviewed reporting on Zhao's current role and ownership status at Binance.

✓ Claim checked– Media not applicable✓ Sources checked

Why 92% confidence

High

HIGH. The central claim is confirmed by Binance's own statement and by independent wire and broadsheet reporting, and each freeze figure traces to the issuer that carried out the freeze. The only revision — Tether's total rising from about $971 million to more than $1.567 billion — makes the post understate, not overstate, and is documented by the issuer's chief executive. That is why the headline is TRUE_BUT rather than a clean TRUE.

Limits. This is a text-only post, so there was no image or video to authenticate and no media detector was run. We could not independently audit Binance's balance sheet or verify that every customer will be repaid; the reassurance about user funds rests on the company's stated commitment. Binance's account of how the breach occurred is its own preliminary description.

What we don’t know

  • Whether every affected Binance user has in fact been made whole, as opposed to the company's stated intention to do so.
  • The final audited totals of the Tether and Circle freezes; the figures reported are the issuers' own disclosures.
  • The full technical chain of how the breach happened beyond Binance's preliminary reference to a compromised DevOps engineer's laptop.
  • Whether any of the frozen funds will be returned, and to whom.

Spot it yourself

Find the overstatement

Looks suspicious, isn’t proof

  • The poster has a direct financial interest in the company's reputation — that is a reason to weigh his reassurances carefully, not evidence that his figures are wrong.
  • The phrase 'It does look like' sounds hedged or evasive — but it accurately reflects what was known at the time of posting.
  • The exclamation-mark reassurance 'User funds are safe!' reads like public relations — reassurance is not proof, but it also is not a falsehood.
  • Round-ish figures like ~$971m and ~$823m can look invented — in fact they match what the stablecoin issuers themselves said.

The actual evidence

  • Binance's own security-incident update confirmed the incident and gave an estimated impact of about $6.3 billion.
  • Circle's chief executive publicly confirmed more than $800 million in USDC frozen, matching the post.
  • Tether's chief executive later put the frozen total above $1.567 billion — confirming the freeze happened and revising the amount.
  • US court filings describe Zhao as Binance's majority owner, which supports his 'shareholder' framing.
  1. 1

    Separate the numbers from the reassurance.

    Figures like a freeze total can be checked against the issuer's own statements; a promise like 'funds are safe' can only be checked against the company's commitments and later payouts. Treat them differently.

  2. 2

    Go to the issuer, not the commentator.

    For a stablecoin freeze, ask what the stablecoin company's own leadership said. Tether's and Circle's chief executives were the primary sources here.

  3. 3

    Note the timestamp on every figure.

    In a fast-moving incident, the first number quoted is often revised. Search for the same figure a day later: $971 million became more than $1.567 billion within a day.

  4. 4

    Check whether the poster has a stake.

    Zhao's own post discloses it: he is a shareholder. Read his predictions about coverage with that in mind and look for the operator's official statement instead.

Takeaway

A claim can be accurate at the moment it is posted and still mislead a reader who arrives later, because fast-moving numbers get revised. Always ask when a figure was said, not just who said it.

Questions people ask

Did Binance actually get hacked in October 2026?+

Yes. Binance published a security-incident update confirming a compromise, saying initial findings pointed to a compromised DevOps engineer's laptop used to submit unauthorised withdrawals, and estimated the impact at around $6.3 billion. AP and The Guardian reported the incident on 29 October 2026.

Did Tether really freeze $971 million?+

It froze at least that much. About $971 million in USDT was the initial figure reported as the incident broke, which is what Zhao cited. Tether CEO Paolo Ardoino later said more than $1.567 billion in USDT had been frozen, so $971 million is an early snapshot rather than the final total.

Did Circle freeze $823 million?+

Circle's CEO Jeremy Allaire confirmed the company froze more than $800 million in USDC linked to the incident, in coordination with law enforcement. That matches Zhao's ~$823 million figure, with the small difference explained by rounding and timing.

Does Changpeng Zhao still run Binance?+

No. Zhao stepped down as CEO in 2023 after pleading guilty to a Bank Secrecy Act violation. He remains a major shareholder — US court filings have described him as majority owner — and Binance now has a co-CEO in Yi He.

Are my funds safe if I had money on Binance?+

Binance says user funds are safe and that it will cover all losses through its SAFU fund and company funds, a commitment repeated by its co-CEO according to industry reporting. That is the company's own undertaking rather than an independent audit, so check Binance's official notices for the claims process.

Go deeper

Stablecoin
A cryptocurrency designed to hold a steady value, usually pegged to a currency like the US dollar, so it can be frozen or blocked by its issuer.
Freeze
An issuer's action to block specific stablecoin balances so they cannot be moved, typically at the request of law enforcement or an exchange during an investigation.
SAFU
Binance's Secure Asset Fund for Users, a reserve the exchange says it uses to compensate customers for losses.
Hot wallet
A cryptocurrency wallet connected to the internet so it can process withdrawals quickly, which makes it more exposed to attack than an offline 'cold' wallet.
False context
Sharing genuine content but with surrounding information — a date, a place or an amount — that changes what it appears to mean.

People also search for

CZ Binance hack user funds are safeBinance hack Tether Circle freeze 971 milliondid Tether freeze 971 million Binance hackcz_binance "It does look like a hack on Binance"Binance security incident October 2026 user funds safe
For educators+
The difference between a claim being accurate when posted and accurate when read later (the 'early number' problem in breaking news).Primary versus secondary sources: the stablecoin issuers, not the commentator, are the authoritative source for a freeze.Disclosed conflicts of interest: a shareholder's reassurance is not the same as an independent audit.Verdict granularity: why 'true with caveats' exists between 'true' and 'false'.
  • If a figure like $971 million was correct when posted but was later revised to $1.567 billion, should the post be considered misleading? Who is responsible for updating it?
  • Zhao discloses that he is a shareholder. How should that change the way you read his prediction that all funds will be covered?
  • What would you need to see before accepting that 'user funds are safe' — a company statement, a regulator's report, or actual payouts? Why?

About this check

Platform
X
Posted by
@cz_binance
Posted
October 29, 2026
Age when checked
Under 24 hours old when checked
Where it spread
Global, United States, United Kingdom
Audience
International audience
Language
EN
Status
● Post is live
Verified
October 30, 2026, 02:48 UTC
Published
October 30, 2026, 02:48 UTC

Reach. CZ post 28,158 likes; @binance statement 6,539 likes (X, 30 Oct); wide pickup (HT, Mirror, Forbes 'Was Binance hacked?'); 'binance' trending Google Trends IE/PK/PH

This verdict was generated with AI from the sources shown. AI can make mistakes — check the sources before relying on it.

Check anything yourself, in seconds.

Share any social post or video to What the Fact and get the verdict, the confidence, and the receipts.

Download on theApp StoreGet it onGoogle Play