Binance said on X that user funds are "completely safe" after wallets labeled by Etherscan as Binance hot wallets sent billions of dollars in crypto to a single new address on Thursday afternoon. Tether and Circle then froze about $2 billion in stablecoins tied to the movements.
That wording appeared in a revised statement posted at 5:29 p.m. ET. An earlier version at 5:16 p.m. ET said Binance teams were actively investigating a potential security issue and had not confirmed any impact on user funds. The exchange has not called the outflows a hack.
Changpeng Zhao, who no longer runs Binance, posted a minute earlier that it "does look like a hack on Binance" and said that, as a shareholder, he expects all user funds will be fully covered.
Stablecoin freezes reached roughly $2 billion
Tether blacklisted the receiving address at 5:01 p.m. ET. Circle followed at 5:04 p.m. ET, freezing 823 million USDC, based on balances Unchained said it read directly from the USDT and USDC token contracts. The address now holds about 1.18 billion frozen USDT.
Tether also blacklisted seven downstream wallets. Two of them hold about 205 million USDT combined.
At 5:25 p.m. ET, Tether CEO Paolo Ardoino said Tether had frozen more than 1.567 billion USDT related to a potential Binance exchange hack. Binance co-founder Yi He repeated that figure. Unchained said the number is higher than the roughly 1.38 billion USDT it can see frozen with balances on Ethereum.
The drain was still running after Binance published its statement. At 5:44 p.m. ET, the address that set up the delegation swept Binance 14 again, moving about 200 million more USDT into the frozen address. As of 5:48 p.m. ET, Binance 14 was still delegated to that address's contract.
About $3.52 billion moved on Ethereum alone
By Unchained's count of Ethereum transfers, the receiving address took in about $3.52 billion between 4:24 p.m. and 5:04 p.m. ET. That included 197,170 ETH, worth about $456 million at the time, 1.68 billion USDT, 823 million USDC, and roughly $564 million across 62 other tokens. Unchained said the other tokens were priced when it pulled the data.
The total is more than double the approximately $1.5 billion that the FBI said in a public service announcement North Korean hackers stole from Bybit in February 2025.
The figure does not include other chains, and reported Bitcoin outflows remain unverified.
Security firm Blockaid said at 5:11 p.m. ET that outflows from Binance hot wallets on Ethereum, Arbitrum, and Avalanche look consistent with unauthorized movement from those wallets. It put the Arbitrum and Avalanche portions at about $19.5 million and $24 million.
Its rough estimate for Ethereum, about $2.5 billion plus 780 million USDC, was lower than Unchained's count. Blockaid said the numbers were still being reconciled.
On Avalanche, Unchained confirmed that four wallets Blockaid identifies as Binance's sent about 1.81 million AVAX to the same receiving address, which still holds about 8.4 million USDT on Avalanche.
How the funds moved
An address funded in part through Tornado Cash's 0.1 ETH pool set up an EIP-7702 delegation on the wallet Etherscan labels Binance 14 at 4:20 p.m. ET. The delegation pointed to a contract that the same address had deployed earlier that day.
EIP-7702 allows an ordinary wallet to run a smart contract's code. How the delegation was authorized is not known.
Four minutes later, that address swept Binance 14. Binance 16 then sent 28,005.6 ETH to the same destination, and calls through Binance 14 pulled 780 million USDC, then another 43 million, from a wallet Etherscan labels Hot Wallet 34.
Before the freezes, the receiving address sent 700 million USDT to two wallets that quickly swapped much of it into ETH.
Security firm PeckShield flagged unexpected large outflows at 4:55 p.m. ET, more than 20 minutes after on-chain analyst Spreek raised an early public alarm.
Last month, Unchained examined how Bitget pursued $388 million in funds stolen in a hack.
