Binance Hot Wallets Send $3.5 Billion to One Address as Stablecoins Are Frozen

The scale of Binance’s reported hot wallet outflows made the exchange’s shifting public statements only part of the story. Ethereum transfers to one address reached roughly $3.52 billion, while Tether and Circle froze large stablecoin balances. Binance said customer funds were “completely safe,” but had not identified the cause of the transfers or called them a hack.

At 5:16 p.m. ET on Thursday, Binance said it was “actively investigating” a “potential security issue” and had “not confirmed any impact to user funds.” Thirteen minutes later, the exchange revised its message to say user funds were “completely safe.” Changpeng Zhao, Binance’s founder and a shareholder who no longer runs the company, had posted shortly before the first statement that the activity looked like “a hack on Binance.” He said he expected user funds to be fully covered.

Stablecoin issuers moved quickly to block part of the funds. Tether blacklisted the receiving address at 5:01 p.m. ET; Circle followed three minutes later, freezing 823 million USDC. The address now holds about 1.18 billion frozen USDT. Tether also blocked seven downstream wallets, two of which hold roughly 205 million USDT combined.

Tether CEO Paolo Ardoino said the company had frozen more than 1.567 billion USDT connected to a potential Binance exchange hack. Binance co-founder Yi He repeated that figure. Unchained’s Ethereum balance checks showed about 1.38 billion USDT frozen, a lower total than Tether’s estimate.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

Transfers continued after the public statements

The on-chain activity didn’t stop when Binance addressed users. At 5:44 p.m. ET, the address that configured a delegation on Binance 14 swept another roughly 200 million USDT and 370 ETH from that wallet into the frozen destination. Binance 14 remained delegated to the address’s contract as of 6:34 p.m. ET, with no further sweep reported by then.

Some assets could still move despite the stablecoin freezes. The receiving address sent about 217.5 million ENA and 29,934 WBETH to another wallet. A wallet that had swapped USDT into ETH transferred 122,310 ETH to a new address at 5:47 p.m. ET.

On-chain analyst Officer’s Notes estimated total outflows of about $5.64 billion from Binance-labeled wallets when Bitcoin and Tron were included. Unchained said it had not verified that multichain figure; its own Ethereum tally was narrower.

Ethereum accounted for most of the verified total

Between 4:24 and 5:04 p.m. ET, the receiving address took in about $3.52 billion in Ethereum assets, according to Unchained’s count. That included 197,170 ETH, worth about $456 million at the time; 1.68 billion USDT; 823 million USDC; and approximately $564 million in 62 other tokens. Prices for those tokens were taken when Unchained gathered the data.

The Ethereum figure alone exceeded twice the approximately $1.5 billion the FBI said North Korean hackers stole from Bybit in February 2025. It excludes activity on other chains, and reported Bitcoin outflows had not been verified.

Security firm Blockaid said it was investigating about $3.3 billion in suspicious Binance hot wallet outflows. At 5:11 p.m. ET, it said activity on Ethereum, Arbitrum and Avalanche looked consistent with unauthorized wallet movements. Blockaid estimated about $19.5 million on Arbitrum and $24 million on Avalanche. Its Ethereum estimate—about $2.5 billion plus 780 million USDC—was below Unchained’s tally and, the firm said, was still being reconciled. On Avalanche, Unchained confirmed that four wallets Blockaid identified as Binance wallets sent about 1.81 million AVAX to the same destination, which still held around 8.4 million USDT on that chain.

A delegated wallet call preceded the sweep

The first unusual step involving Binance 14 came at 4:20 p.m. ET. An address funded in part through Tornado Cash’s 0.1 ETH pool set up an EIP-7702 delegation on the wallet Etherscan labels Binance 14, directing it to a contract deployed earlier that day by the same address.

EIP-7702 lets a standard wallet execute code from a smart contract, provided the wallet’s own key signs an authorization. The delegation transaction included 50 authorizations for consecutive Binance 14 nonces, but only one was accepted. Blockaid said that suggested the attacker didn’t know the wallet’s live nonce. A separate transfer from Binance 16 was an ordinary transaction signed with that wallet’s key.

Four minutes after the delegation, Binance 14 was swept. Binance 16 then sent 28,005.6 ETH to the same destination. Calls through Binance 14 also pulled 780 million USDC, followed by another 43 million, from a wallet labeled Hot Wallet 34. Before Tether and Circle intervened, the receiving address sent 700 million USDT to two wallets that quickly swapped much of it for ETH.

PeckShield flagged “unexpected large outflows” at 4:55 p.m. ET, more than 20 minutes after on-chain analyst Spreek had raised an early public alarm. The sequence of wallet calls, large transfers and subsequent freezes leaves the technical cause unresolved in the available on-chain data. The next clear signal will be whether Binance explains how the wallet authorizations were obtained and confirms the final scope across chains.

*This story was updated with details on the Binance 14 delegation, subsequent fund movements and an analyst’s multichain estimate.*

Related Listen: Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?

The post Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets appeared first on Unchained.