Binance Says User Funds Are Safe After Billions Drain From Its Hot Wallets

Folks, the largest cryptocurrency exchange on earth spent Thursday night telling the world its customers' money is fine, while the blockchain was telling a very different story in real time.

Binance Says User Funds Are Safe After Billions Drain From Its Hot Wallets

ATLANTA — At 20:20:59 UTC on Thursday, a wallet funded through the crypto mixer Tornado Cash pushed through a delegation that pointed one of Binance's hot wallets at a contract of its own choosing. Three minutes and twenty-four seconds later, 167,464.25 ether and dozens of tokens, including roughly 1.615 billion USDT, left that wallet for an address that had not existed that morning.

What followed was a forty-minute scramble across Ethereum, Arbitrum and Avalanche, two stablecoin issuers freezing more than $2.38 billion between them, a founder promising to cover the losses, and a company that still will not use the word "hack."

Forty Minutes, One Delegation, and a Hole in the Hot Wallets

The sequence, as read off Ethereum by Unchained and independently tracked by the security firm Blockaid, moved fast. The first sweep out of the wallet Etherscan labels "Binance 14" came at 20:24 UTC. Minutes later, a second Binance-labelled wallet, "Binance 16," pushed 28,005.6 ether to the same destination, and calls routed through Binance 14 pulled 780 million USDC and then 43 million more out of a wallet labelled "Hot Wallet 34."

By 20:38 UTC a further 195,460 ether had been forwarded to another fresh address. On Arbitrum, a wallet labelled "Binance 54" sent 74,559,805.2 ARB. Unchained's own count of the Ethereum transfers put about $3.52 billion into the receiving address between 20:24 and 21:04 UTC, and that figure leaves out Bitcoin, Tron and everything else.

Pseudonymous researcher Spreek raised the alarm publicly first, warning the transfer "COULD be routine wallet maintenance, but it looks extremely sus." PeckShield flagged "unexpected large outflows" more than twenty minutes later.

What Binance Has Actually Said, and What It Has Not

Read the company's words carefully, because they are doing a lot of work.

"Our teams are aware of reports of a potential security issue and are actively investigating," Binance posted at 21:29 UTC. "At this stage, we have not confirmed any impact to user funds." A revised version of the same post added that "user funds are completely safe" and warned customers off unofficial links.

By 22:15 UTC the language had hardened into something closer to an admission of an event, without ever naming it. "Our team is conducting security checks," Binance wrote. "Withdrawals will resume as soon as the security issue is fully resolved. User funds remain safe." Shortly before midnight UTC it suspended Binance Alpha trading as well.

A spokesperson, Ross O'Leary, told TechCrunch the exchange had "temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure." That is the closest the company has come to confirming a breach. It has not published a loss figure, has not named the affected networks, has not given a resumption time, and has not said whether its emergency fund will be used.

The Freeze Race: Tether, Circle and a $2.38 Billion Net

The most effective response did not come from Binance. It came from the two companies that issue the dollar tokens the attacker was trying to run with.

Tether blacklisted the main receiving address at 5:01 p.m. Eastern, locking about 975 million USDT inside it, according to balances Unchained read directly from the token contracts. Circle followed three minutes later with 823 million USDC. Reuters reported on Thursday evening that the two issuers had frozen more than $2.38 billion combined, with Tether accounting for nearly $1.57 billion.

There is a discrepancy worth holding out loud: Changpeng Zhao's own early post credited Tether with about $971 million, while Tether chief executive Paolo Ardoino later said the company had frozen "more than 1.567 billion" USDT. Both statements are on the record and they are not the same number.

The net widened further. Reuters, citing Binance co-founder Yi He, reported that Ripple had frozen roughly $200 million. World Liberty Financial froze $27 million of its USD1 stablecoin and $2 million of WLFI, working with BitGo. Tether also blacklisted seven downstream wallets, two of them holding about 205 million USDT.

Why This One Is Different: EIP-7702 Turned the Wallet Into the Thief

Most exchange breaches involve stolen keys used to sign transfers, one transaction at a time. This one appears to have used a feature that makes the wallet itself the weapon.

EIP-7702 went live with Ethereum's Pectra upgrade on 7 May 2025. It lets an ordinary wallet sign an authorization that tells it to run the code of a chosen contract, while keeping its own balances. Exchanges use it to batch payouts efficiently. The catch is that the authorization has to be signed by the delegated wallet's own key, and it stays live until a new authorization pointing at the zero address clears it.

"EIP-7702 can turn the wallet itself into the sweeper," the security researcher Odysseus of Phylax Systems wrote on X. Blockaid's read is that the attacker did not even know the wallet's live nonce: the delegation transaction carried fifty authorizations for consecutive nonces, and one happened to land because the wallet was still broadcasting.

If that holds, the wallet was not robbed once. It was wired to keep paying out until someone un-wired it. That is also why a halt on withdrawals is defensible rather than automatically sinister: keys have to be rotated and delegations cleared.

The Number Nobody Can Agree On

Here is where coverage splits, and the split is not small.

Cointelegraph's live coverage puts losses at between $2.4 billion and $5.8 billion. Blockaid counted roughly $3.3 billion in suspicious transfers, Unchained counted about $3.52 billion on Ethereum alone, and other on-chain tallies ran past $5.5 billion once Bitcoin and Tron were folded in. Arkham Intelligence tagged wallets labelled "binance-hacker-1029" holding about $5.84 billion.

The differences mostly reflect scope: how many chains are counted, whether frozen tokens are netted out, and whether a wallet's reported holdings are treated as stolen funds. Arkham's figure is a balance, not a confirmed loss.

At the other end, the pseudonymous analyst 0xngmi estimated the net loss at about $1 billion once the stablecoin freezes were counted. Zhao replied to that estimate directly: "Loss might be a bit higher than that, but will cover."

The Signature Question No One Has Answered

Everything above the transaction line is checkable. The one thing that matters most is not.

A 7702 delegation requires a signature from the wallet's own key. How that signature was produced is unknown, and Binance has not commented on it. Three routes are on the table, none proven: the hot wallet's private key was stolen; the exchange's signing system was manipulated into authorising a foreign instruction, the mechanism behind the Bybit breach of February 2025; or someone with system access was involved.

The security firm Defimon has classified the case as abuse of an EIP-7702 delegation with a compromised key. That is a technical description, not an attribution.

And here the record needs protecting from itself. Bybit's $1.5 billion loss in February 2025 is the benchmark everyone is reaching for because the FBI publicly attributed it to North Korean hackers. Nothing comparable exists here. No government, no exchange and no security firm has named a group, a country or an individual for Thursday's drain.

Markets Flinch: Bitcoin Below $79,000

The tape did not wait for Binance to publish a number.

Bitcoin fell as much as 3.7% and traded below $79,000 at the close of US hours, its lowest level since September, Bloomberg reported. Ether lost between 4% and 4.9% depending on the timestamp. BNB, Binance's own token, was the worst hit of the majors, down as much as 8% and trading near $694. AAVE, the token of the lending protocol that moved to block the attacker, fell about 8%. Solana and XRP each dropped more than 6%.

Monero, the privacy coin that cannot be frozen by an issuer, rose about 6% to $637, echoing the 51% jump it posted after a $333 million bitcoin theft in April 2025. That is the market pricing the lesson of this week in real time.

Liquidation data from investinglive put about $620 million of positions closed in a single hour, roughly 97% of them longs. The Nasdaq 100 closed almost 1.4% lower. Crypto was already soft after a hawkish Federal Reserve hold at 3.75% to 4.00% at its October policy meeting.

Can Binance Cover It? SAFU, $144 Billion, and a Confident Shareholder

Binance held roughly $144 billion in assets on its platform before Thursday, according to DefiLlama, which would make even the top-end estimate about 4% of its book.

Its cushion is the Secure Asset Fund for Users, or SAFU, created in 2018 to protect customers in exactly this scenario and holding roughly $1 billion in bitcoin. Binance has not said whether it will deploy it. That silence matters, because SAFU is smaller than most of the estimates floating around.

Zhao, who no longer runs the company but remains its largest shareholder, is unbothered on the record. "I expect all user funds will be fully covered," he wrote, and later that the company "will cover" the loss.

Market maker Wintermute's chief executive, Evgeny Gaevoy, told his followers that Binance "has enough to withstand 3-4x of current hit and still be largely intact." Blockaid's chief executive, Ido Ben-Natan, gave CoinDesk the opposite emphasis: "This is the biggest crypto hack in history."

Binance.US, a separate exchange, said it was not affected. Binance's own website claims more than 335 million registered users worldwide, which is the number to keep in mind when anyone says "user funds are safe" without publishing an audited reconciliation.

The Second Breach on the Same Day

Thursday was not a one-incident day, and that is part of what makes it worth your attention.

Earlier, prediction market Polymarket halted trading and paused withdrawals after a third-party provider was compromised. TechCrunch reported that the vector was software supplied by a company called DebugBear, which let wallet-draining code reach users. The Block put the exploit at $2.65 million; CoinDesk reported losses under $3 million, and other researchers put it near $2 million. Trading has since resumed.

Two platforms, two different attack surfaces, one afternoon. Polymarket's failure was in its supply chain; Binance's appears to have been in the signing path of a wallet that was supposed to be the safe end of the operation.

Neither company has published a full post-mortem. Neither has explained, in public, the one step that decided the outcome.

What This Means for Anyone Holding Crypto on an Exchange

Strip away the tickers and three things are now established fact, and one is not.

Established: billions of dollars of customer-facing assets left wallets that were supposed to be secure; the stablecoin issuers, not the exchange, are the reason a large share of it is frozen; and the mechanism used is a standard Ethereum feature that exchanges themselves deploy for efficiency.

Not established: whether customer balances were actually impaired. Binance says they were not. On-chain data cannot show Binance's customer liabilities, so no outsider can verify that claim yet, and the difference between "the company is solvent" and "your specific balance is intact" is exactly the gap an audited reconciliation would close.

What to watch, in order: when withdrawals actually resume; whether Binance publishes a figure and a reconciliation rather than a reassurance; whether SAFU is drawn down; and whether the 7702 delegation is confirmed cleared from every affected wallet. Until then, treat every dollar figure, including the big ones, as an estimate with an agenda.

And if you hold coins on an exchange because it is convenient, this is the week the convenience got priced.

By Jessica Ali, Staff Writer

This article was produced with AI-assisted research and editorial support. Sources: Reuters, Bloomberg, TechCrunch, CoinDesk, The Block, Cointelegraph, Decrypt, Unchained, BleepingComputer, FXStreet, Coingape, financefeeds, The Defiant, investinglive, Etherscan and Arbiscan data as reported by those outlets. Cover: Global 1 News editorial image. Photographs: Ben McShane/Web Summit via Sportsfile (CC BY 2.0); Binance (CC BY 4.0).