At least $5.57 billion in cryptocurrencies rapidly exited wallets linked to Binance on Thursday, with the exchange confirming it is investigating reports of a potential security incident affecting three major blockchains: Ethereum, Bitcoin, and Tron.
Major outflows and security response
On-chain data shows $3.51 billion left the Ethereum network, $1.44 billion in 18,270 Bitcoin, and another $630 million on Tron. The movement reportedly began with a large Ethereum transaction of 167,464 ETH and 63 notable token transfers—amounting to $1.615 billion USDT—sent to a new address at 20:24 UTC, as tracked by Etherscan.
Binance, recognized as the world’s largest cryptocurrency exchange by trading volume and user count, confirmed its security teams are investigating. The exchange has yet to confirm any direct impact on client funds or provide full details on the incident’s nature.
Our security teams are urgently reviewing all relevant information regarding a potential security issue and will provide updates through official Binance channels once there is verified information, the company posted on X.
Binance hot wallets—cryptocurrency wallets connected to the internet to facilitate customer deposits and withdrawals—were at the center of the suspicious activity. Historical context shows the exchange previously suffered a $40 million loss in a 2019 hack involving 7,000 Bitcoin. If verified, the latest incident would be more than triple the $1.5 billion Bybit hack recorded in February 2025, setting a new industry record.
| Exchange/Event | Year | Amount |
|---|---|---|
| Binance (current alleged incident) | 2026 | $5.57 billion |
| Bybit hack | 2025 | $1.5 billion |
| Binance hack | 2019 | $40 million |
How the exploit unfolded
The suspicious Ethereum transaction was preceded by a delegation submitted using EIP-7702, a feature allowing a standard Ethereum wallet to execute smart contract code. This delegation, linked to Tornado Cash—an anonymizing crypto mixer—enabled persistent authorization of later transactions without further signatures.
Odysseas Lamtzidi, founder of blockchain security firm Phylax Systems, explained that EIP-7702 allows delegated code to persist in a wallet, permitting transfers without additional signatures. The critical technique raises concerns about how the attacker obtained the necessary signature.
Mini dictionary: EIP-7702 is an Ethereum feature that allows standard wallets to temporarily act like smart contracts, enabling them to delegate the authority to execute code, which can persist and trigger future transfers without new signatures.
7702 lets a normal wallet execute delegated code. The delegation persists; that code can authorize later transfers without another signature from the wallet, wrote Lamtzidi on X regarding the technical process.
Frozen assets and market reaction
In response to the outflow, leading stablecoin issuers Tether and Circle acted swiftly to freeze assets at the main receiving wallet. Tether locked 975.1 million USDT, while Circle, which operates the USDC stablecoin, froze another 823 million USDC by 21:04 UTC, bringing the total frozen to approximately $1.8 billion.
Circle CEO Jeremy Allaire confirmed on X that the company is actively monitoring the situation in coordination with law enforcement, supporting the ongoing investigation.
Both Tether and Circle possess the technical ability to block specific addresses, preventing the movement of their tokens when such incidents occur. Despite these interventions, the attacker continued to move funds rapidly, and the full scope of the breach is still under review.
The market reaction was immediate; Bitcoin dipped below $79,000, BNB fell roughly 7%, while privacy coin Monero rose approximately 6% in volatile trading following news of the incident.
