Binance probes potential $5.8 billion crypto-theft hack

Binance is investigating a potential security breach that may have moved digital assets without authorization. The exchange has not confirmed whether the transfers were unauthorized, how the suspected breach happened, or how much was stolen. It says user funds are safe and is reviewing the available information urgently.

Reports showed large transfers from several Binance hot wallets to one newly created Ethereum address. Binance 14 reportedly moved about $2.53 billion across 64 tokens. A second wallet transferred $174.4 million 24 seconds later, and a third reportedly sent another $780 million in USDC. The reported transfers totaled about $3.48 billion.

Blockchain services also identified wallets linked to a possible attacker. Arkham tracked 55 addresses with holdings valued near $5.78 billion, while Etherscan labeled the first receiving address a Binance hot wallet exploiter. These labels and movements indicate a serious potential incident, but Binance still has to verify what happened.

The suspected incident could involve up to $5.8 billion in digital assets, making it potentially the largest cryptocurrency hack in history. That estimate is based on assets held across wallets linked to the suspected attacker, not on a confirmed theft amount. Binance has not verified the total value of any stolen funds.

Arkham Intelligence tracked 55 addresses labeled “binance-hacker-1029.” Their combined holdings were valued at about $5.78 billion. The reported portfolio included approximately $1.77 billion in USDT, $1.44 billion in Bitcoin, $876 million in Ethereum, and $823 million in USDC. Separately, reports identified about $3.48 billion in transfers from Binance hot wallets.

If confirmed stolen, the possible $5.8 billion would far exceed the $1.5 billion taken from Bybit by North Korean hackers in February 2025. That Bybit theft is described as the largest confirmed crypto heist on record. Binance’s figure remains provisional while the investigation continues.

A cryptocurrency hot wallet is a wallet kept connected to online systems so an exchange can move digital assets quickly. Exchanges use such wallets for operational transfers, but their online connection also makes them important security targets. This explanation uses established cryptocurrency knowledge; the article identifies the affected wallets as Binance hot wallets.

The reported activity involved several wallets sending assets to one newly created Ethereum address. Binance 14 allegedly transferred approximately $2.53 billion across 64 tokens. Another wallet sent $174.4 million just 24 seconds later. A third reportedly transferred $780 million in USDC. The speed, size, and common destination drew attention from blockchain observers.

These transfers do not by themselves prove a theft. Binance said it was still investigating whether the movements were unauthorized. Analysts can see the transactions and follow their destinations, while the exchange must determine whether the activity was a breach, an internal movement, or another security issue.

Tether and Circle froze assets connected to the suspected incident after blockchain reports linked those tokens to wallets associated with the potential Binance hack. Their actions can limit the movement of identifiable USDT and USDC while the investigation develops. The combined amount exceeded $2.3 billion.

Tether CEO Paolo Ardoino said Tether froze more than $1.567 billion in USDT. Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC linked to the incident. Circle also said it was coordinating with law enforcement and would continue supporting the investigation.

The freezes do not establish that Binance lost those assets or prove who controlled the receiving wallets. They are a response to the reported blockchain links. Binance has not confirmed whether the transfers were unauthorized, so the final status of the assets and the incident remains unresolved.

Blockchain analysts can trace cryptocurrency movements because transaction records are visible on the relevant networks. They can identify sending and receiving addresses, track token balances, and group addresses under labels when evidence suggests a connection. The article names Arkham Intelligence, Etherscan, and transaction analysis shared by StarPlatinum as sources following the activity.

Arkham tracked 55 addresses under “binance-hacker-1029,” with combined holdings valued at approximately $5.78 billion. It listed about $1.77 billion in USDT, $1.44 billion in Bitcoin, $876 million in Ethereum, and $823 million in USDC. Etherscan labeled the first receiving address “Binance Hot Wallet Exploiter 2.”

Those tools show where assets are and how they moved, but they do not prove ownership or theft on their own. Arkham’s total counts assets across all tracked wallets. Binance still has to confirm whether the transfers were unauthorized and how much, if anything, was stolen.

Binance is the exchange investigating the possible breach. Its security teams are reviewing relevant information, and the company says user funds are safe. Binance has not confirmed whether the transfers were unauthorized, how the breach occurred, or the amount stolen. It also warned customers about scams and unofficial requests.

Tether and Circle respond by freezing linked stablecoins. Tether froze more than $1.567 billion in USDT, while Circle froze more than $800 million in USDC. Blockchain analysts provide transaction evidence by tracing wallet movements. Arkham tracked 55 addresses, and Etherscan labeled a receiving address as an exploiter.

Circle said it was coordinating with law enforcement and supporting the investigation. Binance founder Changpeng Zhao said the incident appeared to be a hack and expected user funds to be covered. These groups have different roles, but the central facts remain unverified until Binance and investigators establish what happened.

A blockchain is a shared digital record that stores cryptocurrency transactions. Once transfers are recorded, people can inspect the movement of assets between wallet addresses. This public trail is why analysts could study transfers from Binance hot wallets and identify the Ethereum address that received them.

For example, reports said Binance 14 moved approximately $2.53 billion across 64 tokens. Analysts could observe the sending wallet, the receiving address, the assets, and the timing. Arkham then tracked 55 addresses under the label “binance-hacker-1029,” while Etherscan labeled one address “Binance Hot Wallet Exploiter 2.”

A wallet address is not automatically a person’s name. The blockchain can reveal activity without identifying who controls an address. Labels such as “hacker” are analytical designations, not proof of identity or theft. Binance therefore still needs to verify whether the transfers were unauthorized and determine what happened.