Binance has suspended withdrawals on several blockchain networks while it investigates a suspected security breach, after on-chain trackers flagged billions of dollars flowing out of its hot wallets on Thursday.
“We are aware of reports of a potential security issue and are actively investigating,” the exchange said. It added: “Rest assured that user funds are completely safe.”
A Binance spokesperson, Ross O’Leary, said the exchange had “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.”
Binance had not said how much was taken, or how the incident happened, at the time of writing.
How much may have left
Estimates of the outflows vary widely and are not confirmed.
Security firm Blockaid said it was investigating about $3.3 billion in suspicious outflows from Binance hot wallets on Ethereum, Arbitrum and Avalanche. On-chain analyst Conor Grogan put the figure as high as $5.8 billion. Other trackers put it at $2 billion or more.
Hot wallets are the internet-connected wallets exchanges use to process day-to-day deposits and withdrawals.
How the attackers got in, and who is behind the attack, had not been disclosed at the time of writing.
Stablecoin issuers freeze funds
Stablecoin issuers moved quickly to block the funds. Tether and Circle froze a combined $1.79 billion in USDT and USDC, according to reports. Tether chief executive Paolo Ardoino said Tether had frozen more than 1.567 billion USDT.
Ripple froze about $200 million of its RLUSD stablecoin, according to Binance co-founder Yi He, who wrote on X that user funds are “SAFU”, a reference to Binance’s emergency reserve fund.
Funds moved through DeFi
On-chain data shows funds being swapped out of stablecoins, which issuers can freeze, into Ether, which no issuer can freeze. The movements went through decentralised exchanges including Uniswap and lending protocol Aave.
Aave froze its lending markets on Ethereum to stop further borrowing against the funds. Solana lending protocol Kamino said it was not affected, but paused borrowing in one market as a precaution.
What Binance’s founder says
Changpeng Zhao, Binance’s founder and largest shareholder, said he expects “all user funds will be fully covered.” He did not say how.
Market reaction
BNB, the token linked to Binance’s ecosystem, fell more than 5% on Thursday, and Bitcoin slipped below $79,000.
If losses in the billions are confirmed, the attack would be one of the largest in crypto history. The Bybit hack in 2025, which cost around $1.4 billion, is widely considered the largest on record.
What happens next
The key figures still to come are Binance’s own confirmed loss total, when withdrawals will resume, and how any losses will be covered. Binance has said it will post updates through its official channels, and has warned users not to trust unofficial links or requests for account information.
