Binance Under Scrutiny as Billions in Crypto Leave Exchange Wallets; Tether and Circle Freeze Over $1 Billion in Stablecoins

Binance Confirms Investigation After Massive Outflow of Digital Assets

Binance disclosed on Thursday that it is examining what it described as a "potential security issue" following the movement of billions of dollars in cryptocurrency from its exchange wallets. The exchange stopped short of confirming a breach, declining to specify how much left its systems, the method used, or whether the event constitutes a hack. In a statement posted on X, the company said its teams were "actively investigating" and added that "user funds are completely safe."

According to FinanceFeeds, which tracked the post's edit history, Binance revised the statement twice. The original version included a line saying the exchange had "not confirmed any impact to user funds." That sentence was removed at 21:24 UTC, and four minutes later, at 21:29 UTC, the reassurance about user funds being safe was inserted in its place. The final version also noted that security teams were reviewing all relevant information with urgency and that updates would follow through official Binance channels.

Founder's Candid Assessment and Shareholder Reassurance

Binance co-founder Changpeng Zhao, who stated he no longer holds a management role at the exchange, offered a far more direct read on the situation. Writing on social media, Zhao acknowledged: "It does look like a hack on Binance." He added that, in his capacity as a shareholder, he expected all user funds to be fully covered. Zhao also expressed gratitude for what he described as a "quick freeze" by Tether (approximately $971 million) and Circle (approximately $823 million).

Competing Figures as Stablecoin Issuers Lock Assets

The two largest dollar-pegged stablecoin issuers confirmed that they had frozen substantial amounts tied to the incident. Tether CEO Paolo Ardoino announced the company locked more than 1.567 billion USDT, which he characterized as being "related to a potential Binance exchange hack," adding that protecting the industry and its partners was the top priority. Circle CEO Jeremy Allaire stated that the firm froze more than 800 million USDC "in coordination with law enforcement" and pledged continued support for the investigation.

However, the exact amounts remain a matter of discrepancy. Zhao's own figures cited roughly $971 million from Tether and $823 million from Circle. Decrypt, tracking the primary receiving wallet, counted 975.1 million USDT and 823 million USDC, totaling approximately $1.8 billion. Because none of the parties disclosed the specific addresses that were frozen, the totals do not fully reconcile across reports.

On-Chain Trackers Paint a Wider Picture of Outflows

No single confirmed loss figure exists at this stage. Decrypt's on-chain analysis placed the total at no less than $5.57 billion spread across Ethereum, Bitcoin, and the Tron network: $3.51 billion in Ethereum-based assets, $1.44 billion in 18,270 BTC, and $630 million on Tron. Conor Grogan, a senior director at Coinbase, put the total as high as $5.8 billion, according to The Block. Meanwhile, security firm Blockaid identified roughly $3.3 billion in suspicious outflows from Binance hot wallets on Ethereum, Arbitrum, and Avalanche. Glassnode independently suggested that over $5 billion in crypto assets had moved, breaking the figure down into $1.66 billion in USDT, 17,985 BTC (approximately $1.45 billion), $767 million in USDC, ETH, and a range of smaller tokens. The varying totals reflect differences in which trackers were used and whether the data sets overlap, and Binance has confirmed none of them.

Technical Mechanics and Market Reaction

Decrypt reported that the first Ethereum transfer, executed at 20:24 UTC, moved 167,464 ETH along with 63 separate token transfers—including 1.615 billion USDT—to a newly created address. Approximately three minutes before that transfer, an address funded through the Tornado Cash mixer submitted an EIP-7702 delegation for a Binance hot wallet. EIP-7702 is a protocol mechanism that allows a wallet to delegate its execution authority to external contract code. Decrypt did not establish this delegation as the direct cause of the outflow, and the method by which the actor obtained the necessary signature remains unknown.

The news triggered an immediate selloff. Bitcoin slid back below the $80,000 mark, with Decrypt noting prices dipping under $79,000. BNB, Binance's native token, fell roughly 7 percent to around $699. The Block also reported that on-chain data indicated Aave had frozen its lending markets to prevent the suspected actor from borrowing against the stolen assets, though Aave itself had issued no public statement as of the time of reporting.

Historical Context and What Comes Next

If the outflow is confirmed at anything close to Decrypt's estimate, it would dwarf the roughly $1.5 billion Bybit theft in February 2025—the previous record for a single exchange hack—by more than a factor of three. Binance's last confirmed security incident dates to 2019, when it lost 7,000 BTC, worth approximately $40 million at the time. Glassnode noted that even at the higher estimates, the total represents a relatively small fraction of what Binance holds on-chain. The exchange has pledged to provide further updates through its official channels as the investigation progresses.