Binance says it is investigating a potential security issue after large transfers left wallets labeled as its hot wallets, and that user funds are completely safe. The exchange has temporarily suspended withdrawals on multiple networks while it runs security checks. The pause reaches a large user base, including in Latin America.
A hot wallet is an internet-connected wallet that an exchange uses to pay customer withdrawals. On Thursday afternoon in US Eastern time, wallets that blockchain explorers label as Binance hot wallets sent large amounts of crypto to a newly created address, according to Unchained. Binance has not confirmed a stolen total, and its own posts have not called the outflows a hack.
What Binance has said
In a post on X, Binance said its teams were aware of reports of a potential security issue and were actively investigating. An earlier version of that post said Binance had “not confirmed any impact to user funds”; Unchained reported the post was edited minutes later to say user funds are “completely safe.” The exchange said it would publish verified updates only through official Binance channels, and it told users to ignore unofficial links, messages or requests for account details.
A later update said the team was conducting security checks and that withdrawals would resume once the security issue was fully resolved. User funds, it repeated, remain safe.
In a later post, Binance said the verified total of assets frozen in connection with the incident had reached 2.54 billion dollars and could rise as teams trace more funds. That figure counts frozen assets, not losses.
Spokesperson Ross O’Leary told TechCrunch that Binance had “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.”
What Changpeng Zhao said
Changpeng Zhao, known as CZ, founded Binance and no longer manages Binance.com. In a post on X, he wrote that user funds were safe and that “it does look like a hack on Binance.” As a shareholder, he said, he expects all user funds will be fully covered. He thanked Tether and Circle for freezing tokens tied to the incident.
In a later reply, Zhao said the loss might be a bit higher than an analyst’s rough remaining figure of about 1 billion dollars after those freezes, “but will cover.” Binance.US, a separate US platform, said it was not affected by the reported Binance.com incident.
Tether and Circle freeze tokens
Stablecoin issuers can block specific addresses from moving their tokens. That is what people mean when they say an issuer “froze” a balance.
Tether CEO Paolo Ardoino wrote that Tether froze more than 1.567 billion USDT related to a potential Binance exchange hack, and that protecting the industry and its partners was the main priority.
Circle CEO Jeremy Allaire wrote that Circle was tracking reports of a potential exploit involving Binance. In coordination with law enforcement, he said, Circle had frozen more than 800 million USDC associated with the incident and would keep supporting the investigation.
World Liberty Financial CEO Zach Witkoff said USD1 froze 27 million dollars in USD1 tied to the same incident. Unchained, reading token contracts on chain, reported that Circle froze 823 million USDC at the main receiving address and that Tether blacklisted that address and further downstream wallets.
What on-chain trackers count
Binance has not published a confirmed loss figure. Outside tallies differ by chain and by method, and they should be read as estimates.
Unchained counted about 3.52 billion dollars in Ethereum transfers into the main receiving address between roughly 4:24 p.m. and 5:04 p.m. Eastern time: about 197,170 ETH, 1.68 billion USDT, 823 million USDC and roughly 564 million dollars across dozens of other tokens, priced when Unchained pulled the data. That Ethereum-only count leaves out other networks. Unchained said Bitcoin outflows in other reports remained unverified in its piece.
Decrypt cited an on-chain tally of at least 5.57 billion dollars across Ethereum, Bitcoin and Tron. BleepingComputer reported that Arkham Intelligence was tracking an entity labeled across dozens of addresses with combined holdings near 5.78 billion dollars, and noted that Arkham’s figure is the value of assets held across those wallets, not a confirmed amount stolen from Binance. Security firm Blockaid said outflows from Binance-labeled wallets on Ethereum, Arbitrum and Avalanche looked consistent with unauthorized movement, according to Unchained.
Unchained also described how one labeled hot wallet received an EIP-7702 delegation shortly before the large transfers. EIP-7702 is an Ethereum feature that lets an ordinary wallet temporarily run smart-contract code after that wallet’s key signs an authorization. How any required signature was obtained is still unknown.
For scale only, and not as a claim about who is behind this incident: the FBI said in a public service announcement that North Korean hackers stole about 1.5 billion dollars from Bybit in February 2025, according to Unchained.
What is still open
Binance has not confirmed whether the transfers were unauthorized, how any breach occurred, or the total value of any assets moved without authority. It has not named a suspect. Withdrawals remain paused on multiple networks until the exchange says the security issue is fully resolved.
Users should rely on official Binance channels for updates and should treat unexpected links, messages or requests for passwords and seed phrases as scams, as Binance warned in its first post.
This article is not investment advice.
