"It looks like a hack," says Binance founder CZ after wallets on Ethereum, Bitcoin and Tron were drained of at least $5.5 billion overnight Friday. Tether and Circle have frozen over $2.3 billion across the addresses that received the funds.
Binance is the world's largest crypto exchange by trading volume, and a hot wallet is an internet-connected wallet the exchange uses to pay out customer withdrawals, as opposed to cold storage, where the bulk of reserves normally sit offline.
Overnight Friday, blockchain analysts registered large sums leaving several of Binance's hot wallets on Ethereum, directed to a brand-new address funded through the crypto mixer Tornado Cash – a service that obscures where funds come from and that has previously been sanctioned by US authorities. If the amount is confirmed in full, it would be the largest theft from a crypto exchange ever – well above the previous record holder, Bybit, which lost around $1.5 billion in February 2025.
The first transfer took place at 20:24 UTC (21:24 Norwegian time) on 29 October, when the wallet labelled Binance 14 sent 167,464 ETH – worth around $388 million – and 63 other tokens, including roughly $1.6 billion in USDT (Tether), to a newly created address. Twenty-four seconds later, another wallet, Binance 16, followed with a further 28,005 ETH to the same recipient. Seventeen minutes later, $780 million in USDC (Circle) also left a third wallet, Binance: Hot Wallet 34.
On Ethereum alone, the transfers amount to around $3.51 billion. It also emerged that Binance wallets on Bitcoin were drained of 18,270 BTC, around $1.44 billion, and that a further $630 million disappeared on Tron – a combined total of at least $5.57 billion according to a comprehensive blockchain review, likely a floor rather than the final figure.
The address that triggered the transfers was funded exclusively through Tornado Cash and received its first funds from there on 28 October – the day before the attack. Blockchain analysts point out that the attacker may have exploited the EIP-7702 standard, which makes it possible to delegate control of a wallet to a smart contract; according to an analyst going by the username Spreek on X, such a delegation was installed just minutes before the wallet was drained. Binance has not confirmed this explanation.
Binance founder Changpeng Zhao, known as CZ, addressed the incident on X just over an hour and a half after the first transfers. "Users' funds are safe. It looks like a hack on Binance. I appreciate the swift freeze from Tether (around $971 million) and Circle (around $823 million)," he wrote, adding: "I no longer run Binance (.com), but as a shareholder I expect all user funds to be fully covered."
Zhao stepped down from Binance's day-to-day operations in 2023 as part of a settlement with US authorities, but retains a stake in the company. Binance's own official response has been more cautious than CZ's: "Rest assured user funds are completely safe," an exchange spokesperson said. "Our security teams are reviewing all relevant information with high priority, and we will provide updates through Binance's official channels as soon as we have verified information."
The issuers of the two largest dollar stablecoins reacted swiftly. Tether CEO Paolo Ardoino wrote on X that the company had frozen over $1.567 billion in USDT linked to "a potential hack of the Binance exchange," stressing that protecting the industry and the company's partners is the top priority.
Circle CEO Jeremy Allaire stated that his company, working with law enforcement, had frozen over $800 million in USDC linked to the incident, and that Circle will continue to assist the investigation. Combined, the two issuers have thus frozen over $2.3 billion across the addresses that received the funds – stablecoins can be frozen because issuers control which addresses are allowed to use them, unlike ether and most other tokens.
Estimates of the total loss have grown by the hour. The Wall Street Journal reported Thursday evening a loss of at least $1.7 billion, while a broader blockchain review of transfers on Ethereum, Bitcoin and Tron on Friday morning put the figure at at least $5.57 billion – more than three times the amount from the previous record hack of Bybit in February 2025, at around $1.5 billion. The figure could rise further as more wallets and transfers are mapped.
Bitcoin fell 3.2 percent Thursday afternoon US time, to below $79,000, in the wake of the news.
At the time of publication, Binance had not confirmed the scale of the loss or explicitly said that customer funds are affected. The exchange says it is still investigating the incident, and that updates will come through official channels. The figures cited in this article are based on blockchain data and statements from Tether and Circle, and may change as Binance releases more information.
Sources: X (@cz_binance, @paoloardoino, @jerallaire, @WatcherGuru), The Wall Street Journal, The Guardian/Associated Press, Decrypt
You have read what you can read for free. With an account you get unlimited access to all news and articles on kaupr.io — and become part of the network of investors, professionals and builders following onchain finance.