At least $5.57 billion in cryptocurrency moved from wallets linked to Binance on Thursday across Ethereum, Bitcoin and Tron, in what appears to be a major security breach at the world’s largest crypto exchange. Binance said it was investigating a potential security issue and had not confirmed any impact on customer funds.
The transfers prompted Tether and Circle to freeze a combined $1.8 billion in stablecoins held by the main receiving wallet. The incident also coincided with declines in Bitcoin and Binance’s BNB token, while privacy-focused cryptocurrency Monero gained.
What moved from Binance-linked wallets
An on-chain tally cited by Decrypt put the value of the transfers at $3.51 billion on Ethereum, $1.44 billion in 18,270 Bitcoin and $630 million on the Tron network. The figures cover assets that left wallets identified as being connected to Binance, although the tally could increase as investigators trace additional transactions.
The funds came from hot wallets, which are internet-connected wallets used by cryptocurrency exchanges to process transactions such as customer withdrawals. Their online access makes them operationally useful, but also means they are a key security concern in any suspected exchange breach.
The first reported Ethereum transaction took place at 20:24 UTC. It sent 167,464 ETH and 63 different token transfers to a newly created address. Among the assets was 1.615 billion USDT, a stablecoin designed to maintain a value of about $1.
Binance said on X that its teams were aware of reports about a “potential security issue” and were “actively investigating.” The exchange said it had not confirmed any impact to user funds, adding that its security teams were reviewing relevant information and that updates would be provided through official channels once information had been verified.
How the suspected exploit may have worked
The exact route by which the funds were accessed remains unknown. Three minutes before the large Ethereum transfer, an address funded through Tornado Cash submitted a delegation for a Binance hot wallet using EIP-7702, an Ethereum feature that allows a standard wallet to execute smart-contract code.
Odysseas Lamtzidi, founder of Phylax Systems, said on X that the delegation can remain in place and allow the code to authorize later transfers without another signature from the wallet. That mechanism may help explain how the wallet was used to move assets, but the source material does not establish how the required signature was obtained or confirm that the suspected breach was caused by this process.
Tornado Cash is a cryptocurrency mixer that scrambles the trail of payments. Its appearance in the transaction history has drawn attention from blockchain researchers, but it does not by itself establish who controlled the address or who carried out the transfers.
If the incident is confirmed as a hack, the reported value would make it the largest cryptocurrency hack on record. Binance previously lost 7,000 Bitcoin, worth about $40 million at the time, in a 2019 hack. The current tally would also exceed the roughly $1.5 billion stolen from Bybit in February 2025, described in the source material as the previous record.
Stablecoin issuers freeze $1.8 billion
Tether froze 975.1 million USDT in the main receiving wallet, while Circle froze 823 million USDC at 21:04 UTC. Together, the freezes covered about $1.8 billion.
Tether and Circle can block designated addresses from transferring their stablecoins. Circle chief executive Jeremy Allaire said the company was tracking reports of a potential Binance exploit and, in coordination with law enforcement, had frozen more than $800 million in USDC while supporting the investigation.
The freezes may limit the suspected attacker’s ability to convert or move some of the stolen assets. However, the source material said funds were still being moved quickly and that additional assets could potentially be frozen.
Market reaction and Moneyiar data
Bitcoin fell below $79,000, down about 2.6% over 24 hours. BNB, Binance’s native token, dropped about 7% to roughly $699. Monero rose about 6% to $637. Monero is a privacy coin designed to conceal information about senders and recipients; its move echoed a gain of as much as 51% after a $333 million Bitcoin theft in April 2025.
Moneyiar market data recorded at the times shown below presented a different snapshot on October 25, before the reported incident. Ethereum was $2,342.0570017305, up 0.02% over 24 hours and down 1.77% over seven days, as of 22:39 local time. Tether USDt was $0.9987425383, unchanged over 24 hours and down 0.01% over seven days, as of 22:38. BNB was $740.8618136891, up 0.81% over 24 hours and 3.32% over seven days, as of 22:39. Cronos was $0.054290275, down 1.83% over 24 hours and 3.03% over seven days, as of 22:39.
Those Moneyiar figures are earlier market data and should not be treated as a real-time measure of the prices reported after the suspected breach. Binance’s investigation and the on-chain tracing will determine whether the wallet movements represented a confirmed exchange hack and whether customer funds were affected.
