At least $5.57 billion in cryptocurrency has abruptly left wallets linked to Binance across three distinct blockchains in what is rapidly emerging as a potential security breach of unprecedented proportions for the world’s largest digital asset exchange. If confirmed as a malicious hack, the incident would shatter previous records, eclipsing all historical digital asset thefts and rewriting the security paradigms of centralized cryptocurrency platforms.
Binance has not yet officially confirmed that its exchange infrastructure has been breached, but leadership and technical teams acknowledged that they are fully aware of the escalating situation. The company stated that it is actively investigating a potential security issue affecting hot wallets—the internet-connected storage facilities that exchanges utilize to facilitate and process day-to-day customer withdrawals.
"Our teams are aware of reports of a potential security issue and are actively investigating," Binance posted in an official statement on the social media platform X. "At this stage, we have not confirmed any impact to user funds. Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information."
The staggering financial tally began unfolding as massive volumes of digital assets moved away from platform-controlled addresses. According to on-chain tracking data and blockchain analysis, the outflows include approximately $3.51 billion on the Ethereum network, roughly $1.44 billion comprising 18,270 Bitcoin, and an additional $630 million originating from the Tron blockchain.
The initial wave of suspicious activity struck the Ethereum blockchain at 20:24 UTC, when a single transaction transferred 167,464 ETH alongside 63 separate token transfers to a newly created, unlabelled address. Public ledger records on Etherscan confirmed that this haul included 1.615 billion units of USDT, a prominent stablecoin pegged to maintain a steady value of one US dollar.
Technical analysis of the on-chain footprint revealed sophisticated methods behind the sudden outflows. Just three minutes prior to the massive Ethereum transaction, an address that had been funded through Tornado Cash—a decentralized privacy mixer known for obscuring transaction trails—submitted a delegation for a Binance hot wallet using EIP-7702. This recent Ethereum network feature allows standard, non-smart-contract wallets to temporarily execute delegated smart-contract code.
Odysseas Lamtzidi, founder of blockchain security firm Phylax Systems, explained the mechanism on X, noting that the standard feature permits a regular wallet to execute delegated instructions where the delegation persists, allowing designated code to authorize subsequent transfers without requiring an additional cryptographic signature from the originating wallet owner. Security experts and independent blockchain researchers are continuing to examine how the required administrative signatures or authorizations were initially compromised to allow the execution of the exploit.
As the suspected attacker moved to disperse and launder the digital assets across decentralized liquidity pools and cross-chain bridges, major stablecoin issuers stepped in with rapid defensive interventions. Tether moved quickly to freeze approximately 975.1 million USDT sitting within the primary receiving address controlled by the suspected malicious actor. Shortly thereafter at 21:04 UTC, Circle, the issuer of rival stablecoin USDC, intervened as well, freezing 800 million USDC within the exact same destination address.
These synchronized blacklisting actions brought the total amount of frozen stablecoins to roughly $1.8 billion, mitigating a substantial portion of the liquid capital drain. Centralized stablecoin issuers possess native smart-contract capabilities that allow them to block specific blockchain addresses from moving or transferring their proprietary tokens, a mechanism frequently utilized in law enforcement requests and emergency breach responses.
Circle CEO Jeremy Allaire confirmed the company’s active containment measures on X, stating that Circle has been closely monitoring reports of the potential exploit targeting Binance. "In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation," Allaire wrote.
Independent blockchain investigators, including prominent on-chain researcher Wazz, noted the unprecedented scale of the outflows while highlighting the swift defensive response from stablecoin operators. Despite the freezing of nearly $2 billion in assets, researchers warned that hundreds of millions of dollars in other cryptocurrencies remain unfrozen, with the attacker aggressively moving funds across multiple networks to evade interception.
The unfolding situation immediately reverberated through the broader cryptocurrency markets, triggering swift downward price adjustments across major assets. Bitcoin slid below the $79,000 threshold, marking a decline of roughly 2.6% over a 24-hour trading window. Meanwhile, BNB, the native utility and governance token of the Binance ecosystem, experienced a sharper correction, falling about 7% to trade at approximately $699.
Conversely, privacy-centric digital assets saw sudden capital inflows as traders sought anonymity amid market volatility. Monero, a privacy coin designed to obscure transaction histories and sender-recipient metadata, jumped by about 6%. This market reaction echoed similar jumps seen during previous high-profile security incidents, such as the 51% surge Monero experienced following a suspicious $333 million Bitcoin transfer in April 2025.
If validated as a confirmed security breach and theft, the magnitude of the $5.57 billion outflow would dwarf all historical precedents in the cryptocurrency industry. It would eclipse the roughly $1.5 billion heist suffered by Bybit in February 2025, which previously stood as the largest single crypto exchange hack on record. By comparison, Binance itself previously experienced a significant security breach in 2019, when hackers made off with 7,000 Bitcoin, valued at approximately $40 million at the time.
As regulatory bodies, blockchain security firms, and Binance’s internal technical squads continue their round-the-clock forensic reviews, the digital asset community awaits verified confirmations regarding the exact vector of the compromise and the ultimate safety of customer balances across the platform.
Web3 & Decentralized Web
Web3 & Decentralized Web
Web3 & Decentralized Web
