Binance Hack Split in Two as Issuers Froze $2.37 Billion and the Rest Kept Moving

The transfers began at 20:24 UTC on Thursday, when 167,464 ether plus 63 other tokens left a Binance hot wallet for an address created hours earlier. Within about an hour, Tether and Circle had frozen about $1.8 billion of what left. Before the night was out, their own announcements put the frozen total above $2.37 billion. The first number came from a count taken while the transfers were still being traced.

Only one kind of loot could be stopped that way. USDT and USDC are issued by companies, and those companies can blacklist an address, which leaves the tokens sitting there but unable to be sent on. Bitcoin, ether and the rest of the tally have no issuer to call. The freezable share piled up behind two companies’ decisions, and the rest was already on the move.

Tether chief executive Paolo Ardoino posted that his firm had frozen more than $1.567 billion in USDT linked to the incident. “Protecting the industry and our partners is our main priority,” Ardoino wrote. Circle chief executive Jeremy Allaire posted that his firm had frozen more than $800 million in USDC. “In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation,” Allaire wrote.

The earlier $971 million Tether figure that circulated first was a partial count from inside that same operation, later superseded by Ardoino’s total rather than added to it. One tracker still put about $800 million more within reach of a freeze, with the attacker moving funds fast.

The widest on-chain tally counts $3.51 billion on Ethereum, $1.44 billion in 18,270 bitcoin and $630 million on Tron, for at least $5.57 billion across three chains. Trackers counted roughly $900 million already moved onward from the first receiving wallet, including about $450 million forwarded within 15 minutes of arrival. CryptoBriefing put about $700 million in USDT and ether as moved before blacklisting or outside its reach. That is the other side of the freeze ledger: the issuers caught what was still sitting in flagged addresses, not what had already left them.

On Avalanche, about 1.81 million AVAX and 8.4 million USDT were linked to the incident, and Aave froze its lending markets there to stop the attacker depositing the AVAX as collateral and borrowing against it. The protocol has put out no official statement. The freeze shows in on-chain data. On Ethereum, the exploiter had already borrowed 20,000 wrapped ether, roughly $44 million, through Aave using stolen USDT as collateral, according to CoinDesk. The Ethereum borrow got through before the Avalanche door was shut.

Three minutes before the first transfer, an address funded through Tornado Cash submitted a delegation for a Binance hot wallet using EIP-7702, an Ethereum feature that lets an ordinary wallet run smart-contract code. “7702 lets a normal wallet execute delegated code. The delegation persists; that code can authorize later transfers without another signature from the wallet,” Odysseas Lamtzidi, founder of Phylax Systems, wrote on X. A second Binance wallet sent 28,005 ether to the same destination 24 seconds after the first transfer, and the initiating address had been funded by three deposits of about 0.1 ether through Tornado Cash on October 28 and 29. How the attacker obtained the required signature is still unknown. “It COULD be routine wallet maintenance, but it looks extremely sus,” wrote Spreek, the on-chain analyst who flagged the transfers.

The delegation came from Ethereum’s Pectra upgrade on May 7, 2025, which lets a regular wallet sign an authorization pointing at a contract and then run that contract’s code with the wallet’s own assets. A peer-reviewed study for USENIX Security ’26 examined 3,664,166 such authorizations across seven chains through July 15, 2025. It found 63 percent linked to contracts the researchers identified as malicious, with 924 malicious contracts confirmed, $2.36 million in detected losses and another $10.14 million exposed. A delegation stays in place until the wallet signs a new one pointing nowhere. That persistence is what makes a single stolen signature worth more than a single stolen transfer.

February 2025 offers the comparison, and it runs the other way. Bybit lost about $1.46 billion in ether that month. Coordinated industry action froze $42.9 million in the first 24 hours, under 3 percent of the theft. By August 2026 the exchange reported $48.4 million recovered and $30.5 million frozen, about 5 percent of roughly $1.5 billion, after suing North Korea and winning a court freeze. Binance’s issuers froze more than $2.37 billion within about an hour, around 43 percent of the $5.57 billion tally, because the loot was heavily stablecoins rather than ether, which nobody can switch off.

Binance’s Secure Asset Fund for Users was built for this kind of night. The fund, created in July 2018 and funded by 10 percent of trading fees, was valued at about $1 billion in February 2026 and covered the May 2019 theft of 7,000 bitcoin, about $40 million, in full. One billion dollars is about 18 percent of the $5.57 billion tally. “User funds are safe! It does look like a hack on Binance,” wrote Changpeng Zhao, who no longer manages Binance, on X. “I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered,” he added. That is a shareholder’s expectation, not a payout announcement, and Binance itself says it has not confirmed any impact to user funds.

Binance told TechCrunch it had temporarily suspended withdrawals on multiple networks as a precaution, while its X post said its teams were investigating a potential security issue and would update through official channels. Bitcoin fell below $79,000, Binance’s BNB token fell about 7 percent, and about $600 million in leveraged positions was liquidated within an hour, according to Coinglass data cited by FXStreet. Binance co-founder Yi He wrote on X: “We are aware of reports of a potential security issue and are actively investigating.” Binance has not named an attacker, confirmed a total, or said whether any customer balance was touched.