Binance is examining allegations of a significant security compromise that may have exposed as much as $5.8 billion in cryptocurrency holdings. Should the theft be verified, it would surpass the $1.5 billion heist targeting Bybit by North Korean threat actors in February 2025, currently the largest documented cryptocurrency theft.
The suspected incident has already triggered responses from major stablecoin operators. Tether and Circle have each moved to freeze digital assets valued at more than $2.3 billion in total that appear connected to the breach.
A Binance representative provided this statement to BleepingComputer: "Our teams are aware of reports of a potential security issue and are actively investigating. Rest assured that user funds are completely safe." The spokesperson added, "Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information."
The exchange has also cautioned users to be wary of fraudulent schemes and to steer clear of unverified links, communications, or requests seeking personal account details.
Binance founder Changpeng Zhao posted on X that the situation resembled a hack, while emphasizing that he no longer oversees day-to-day operations at the exchange and expressing confidence that all customer holdings would receive complete protection.
Tether's chief executive Paolo Ardoino announced via X that his organization had immobilized approximately $1.567 billion in USDT connected to the suspected Binance incident.
Jeremy Allaire, who leads Circle, disclosed that the stablecoin issuer had frozen roughly $800 million in USDC tied to the breach. Allaire noted that Circle is working alongside law enforcement authorities and remains committed to facilitating the ongoing probe.
Billions transferred from Binance hot wallets
These announcements came after reports surfaced detailing substantial cryptocurrency movements originating from several Binance hot wallets directed toward a freshly established Ethereum address.
Blockchain analysis data distributed on X by crypto journalist StarPlatinum indicated that a Binance hot wallet designated "Binance 14" moved approximately $2.53 billion spanning 64 different cryptocurrency tokens. This was followed within 24 seconds by an additional $174.4 million transfer from another Binance wallet.
A subsequent report noted that a third Binance hot wallet sent another 780 million USDC to the same receiving address, pushing the cumulative reported figure to roughly $3.48 billion.
Arkham Intelligence, a blockchain monitoring service, is monitoring 55 cryptocurrency addresses grouped under the designation "binance-hacker-1029," collectively valued at approximately $5.78 billion.
The monitored holdings comprise roughly $1.77 billion in USDT, $1.44 billion in Bitcoin, $876 million in Ethereum, and $823 million in USDC.
The blockchain exploration tool Etherscan has tagged the initial destination address with the label "Binance Hot Wallet Exploiter 2," applying both "Exploit" and "Heist" classifications.
It is important to clarify that Arkham's $5.78 billion valuation represents the total worth of assets distributed across all monitored addresses, not necessarily a verified sum of funds taken from Binance.
Binance has not yet disclosed whether the transfers were unauthorized, revealed specifics regarding how the suspected breach took place, or confirmed the precise value of any potentially stolen assets.
This situation remains active and will be updated as additional details emerge.