Binance said Thursday it is investigating a "potential security issue" after billions of dollars in crypto left its exchange wallets, and the issuers of the two largest dollar stablecoins say they have frozen well over $1 billion of it. The exchange has not said how much was taken, how, or whether it was a hack.
"Our teams are aware of reports of a potential security issue and are actively investigating," Binance said in a post on X. "User funds are completely safe." FinanceFeeds, which reviewed the post's edit history, reports that Binance changed it twice. The first version said the exchange had "not confirmed any impact to user funds"; at 21:24 UTC that sentence came out, and at 21:29 UTC "User funds are completely safe" went in.
Binance's founder was less guarded. Changpeng Zhao, who says he no longer manages the exchange, wrote: "It does look like a hack on Binance." As a shareholder, he said, he expects "all user funds will be fully covered."
The freezes came from the stablecoin issuers.
Tether CEO Paolo Ardoino said the company froze more than 1.567 billion USDT "related to a potential Binance exchange hack." Circle CEO Jeremy Allaire said Circle froze more than 800 million USDC "in coordination with law enforcement." Those are the issuers' own figures. Zhao thanked Tether for about $971 million and Circle for about $823 million, and Decrypt counts 975.1 million USDT and 823 million USDC frozen in the main receiving wallet, about $1.8 billion. The posts do not say which addresses were frozen, so the totals do not reconcile.
Billions?!
Nobody has a confirmed loss figure. Decrypt's on-chain tally is at least $5.57 billion across Ethereum, Bitcoin and Tron: $3.51 billion on Ethereum, $1.44 billion in 18,270 BTC and $630 million on Tron. The Block reports that Conor Grogan, a Coinbase senior director, put the total at up to $5.8 billion, while the security firm Blockaid is looking at about $3.3 billion in suspicious outflows from Binance hot wallets on Ethereum, Arbitrum and Avalanche. The tallies come from different trackers and may overlap, and Binance has confirmed none of them.
Glassnode also suggested over $5 billion worth of crypto assets moved.
Decrypt says the first Ethereum transfer, at 20:24 UTC, moved 167,464 ETH and 63 token transfers, including 1.615 billion USDT, to a new address. About three minutes earlier, an address funded through the Tornado Cash mixer had submitted an EIP-7702 delegation for a Binance hot wallet, a mechanism that lets a wallet hand its execution to outside contract code. Decrypt does not establish that as the cause, and how the attacker got the required signature is unknown.
Markets reacted.
Bitcoin tumbled back below $80,000...
Decrypt has BNB down about 7% to roughly $699 and bitcoin below $79,000, and The Block says on-chain data shows Aave froze lending markets to stop the suspected hacker from borrowing, though Aave has issued no statement.
If confirmed at anything near Decrypt's figure, it would be more than triple the roughly $1.5 billion Bybit theft of February 2025, the previous record. Binance lost 7,000 BTC, about $40 million at the time, in a 2019 hack. It has promised updates "through official Binance channels."