Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets

Binance said on X that “user funds are completely safe” after wallets Etherscan labels as Binance hot wallets sent billions of dollars in crypto to a single new address on Thursday afternoon, and Tether and Circle froze about $2 billion in stablecoins.

That line came at 5:29 p.m. ET in a revised statement. A 5:16 p.m. ET version said its teams were “actively investigating” a “potential security issue” and had “not confirmed any impact to user funds.” The exchange has not called the outflows a hack.

Founder Changpeng Zhao, who no longer runs the exchange, posted a minute earlier that “it does look like a hack on Binance” and that, as a shareholder, he expects “all user funds will be fully covered.”

Tether blacklisted the receiving address at 5:01 p.m. ET, and Circle followed at 5:04 p.m. ET with 823 million USDC, balances Unchained read directly from the USDT and USDC token contracts; the address now holds about 1.18 billion frozen USDT. Tether also blacklisted seven downstream wallets, two of which hold about 205 million USDT combined. Tether CEO Paolo Ardoino said at 5:25 p.m. ET that Tether “froze more than 1.567B USDT related to a potential Binance exchange hack,” a figure Binance co-founder Yi He repeated. That is higher than the roughly 1.38 billion USDT Unchained can see frozen with balances on Ethereum.

The drain was still running after Binance’s statement. At 5:44 p.m. ET the address that set up the delegation swept Binance 14 again, moving about 200 million more USDT into the frozen address, and Binance 14 was still delegated to that address’s contract as of 5:48 p.m. ET.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

By Unchained’s own count of Ethereum transfers, the receiving address took in about $3.52 billion between 4:24 p.m. and 5:04 p.m. ET: 197,170 ETH (about $456 million at the time), 1.68 billion USDT, 823 million USDC and roughly $564 million across 62 other tokens, with other tokens priced when Unchained pulled the data. The total is more than double the “approximately $1.5 billion” that the FBI said in a public service announcement North Korean hackers stole from Bybit in February 2025. It leaves out other chains, and reported Bitcoin outflows remain unverified. Security firm Blockaid said at 5:11 p.m. ET that outflows from Binance hot wallets on Ethereum, Arbitrum and Avalanche “look consistent with unauthorized movement from those wallets” and put the Arbitrum and Avalanche portions at about $19.5 million and $24 million. Its approximate Ethereum figure, about $2.5 billion plus 780 million USDC, is lower than Unchained’s count and, it said, “still being reconciled.” On Avalanche, Unchained confirmed that four wallets Blockaid identifies as Binance’s sent about 1.81 million AVAX to the same receiving address, which still holds about 8.4 million USDT there.

An address funded in part through Tornado Cash’s 0.1 ETH pool set up an EIP-7702 delegation on the wallet Etherscan labels Binance 14 at 4:20 p.m. ET, pointing it at a contract the same address had deployed earlier that day. EIP-7702 lets an ordinary wallet run a smart contract’s code; how the delegation was authorized is not known.

Four minutes later it swept Binance 14, Binance 16 sent 28,005.6 ETH to the same destination, and calls through Binance 14 pulled 780 million USDC, then 43 million more, from a wallet Etherscan labels Hot Wallet 34. Before the freezes, the receiving address sent 700 million USDT to two wallets that quickly swapped much of it into ETH.

Security firm PeckShield flagged “unexpected large outflows” at 4:55 p.m. ET, more than 20 minutes after on-chain analyst Spreek raised an early public alarm. Last month, Unchained looked at how Bitget chased $388 million in funds stolen in a hack.

Related Listen: How Did Hackers Take $388M From Bitget Without a User Withdrawal?

{"@context":"http:\/\/schema.org\/","@id":"https:\/\/unchainedcrypto.com\/binance-says-user-funds-are-completely-safe-after-3-5-billion-drains-from-its-hot-wallets\/#arve-youtube-9l8jesvq7ee","@type":"VideoObject","embedURL":"https:\/\/www.youtube-nocookie.com\/embed\/9l8JEsVQ7EE?feature=oembed&iv_load_policy=3&modestbranding=1&rel=0&autohide=1&playsinline=1&autoplay=0"}

The post Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets appeared first on Unchained.