Billions leave Binance wallets in suspected hack

Binance is investigating a "potential security issue" after billions of dollars in cryptocurrency left its wallets on Thursday, and within hours the two largest dollar-stablecoin issuers had frozen a large share of the outflows: Tether reported more than 1.567 billion USDT, Circle more than 800 million USDC. Binance itself has confirmed nothing — not how much moved, not how it was taken, not even that a hack occurred.

Its only public statement, a post on X, has since been edited twice. The original wording said the exchange had "not confirmed any impact to user funds"; at 21:24 UTC that sentence was deleted, and at 21:29 UTC "User funds are completely safe" was added. Founder Changpeng Zhao, who says he no longer manages the exchange, was blunter: "It does look like a hack on Binance." As a shareholder, he said he expects all user funds to be fully covered.

The loss figures in circulation are all third-party tallies, and they disagree. Decrypt's on-chain count puts at least 5.57 billion dollars across Ethereum, Bitcoin and Tron — 3.51 billion on Ethereum, 18,270 BTC worth roughly 1.44 billion, and 630 million on Tron. Glassnode arrives at around 5.3 billion, security firm Blockaid at about 3.3 billion in suspicious outflows from hot wallets on Ethereum, Arbitrum and Avalanche, and a Coinbase senior director told The Block the total could reach 5.8 billion. Binance has confirmed none of them.

The on-chain record suggests the method. Three minutes before the first large Ethereum transfer at 20:24 UTC — 167,464 ETH plus 63 token transfers, including 1.615 billion USDT, into a fresh address — a wallet funded through the Tornado Cash mixer submitted an EIP-7702 delegation for a Binance hot wallet, a mechanism that hands a wallet's execution to outside control.

The recovery effort is the other half of the story. Tether chief executive Paolo Ardoino said his company had frozen the tokens "related to a potential Binance exchange hack," adding that "protecting the industry and our partners is our main priority." Circle's Jeremy Allaire said his company froze its share "in coordination with law enforcement." Neither issuer named the addresses, so the totals do not reconcile — Zhao thanked Tether for roughly 971 million and Circle for 823 million — and every figure is the issuers' own.

However the counts settle, the mechanics are simple. USDT and USDC are tokens with built-in blacklists, and the companies that issue them can make any balance unspendable at will. The feature that froze billions for Binance on Thursday would work just as well against anyone else.

Five minutes passed between Binance deleting "not confirmed any impact to user funds" and typing "User funds are completely safe."