Binance investigates a suspected hack after billions leave its hot wallets; Tether and Circle freeze about $2.4B

One transaction moves 167,464 ETH (about $388M) and 63 tokens, including roughly $1.6B in USDT, out of the hot wallet labeled Binance 14 to a brand-new address; Binance 16 sends another 28,005 ETH 24 seconds later. The transfer is triggered by a wallet funded only through Tornado Cash.

Within 15 minutes the receiving address forwards 195,460 ETH (about $450M) to another fresh address while still holding about $1.5B in tokens.

Binance says its teams are aware of reports of a potential security issue and are actively investigating, and will post updates through official channels. CZ says it does look like a hack on Binance and thanks Tether and Circle for freezing funds.

Circle CEO Jeremy Allaire says Circle, in coordination with law enforcement, froze more than 800M USDC associated with the incident.

Tether CEO Paolo Ardoino says Tether froze more than 1.567B USDT related to a potential Binance exchange hack.

Binance updates its statement to say user funds are completely safe and warns users not to trust unofficial links, messages or requests for account information.

The Block reports about $3.55B in incoming transfers to the receiving wallet, with nearly $900M moved on to other wallets, and Blockaid says it is investigating about $3.3B in suspicious outflows from Binance hot wallets across Ethereum, Arbitrum and Avalanche. Binance still has not publicly confirmed a breach.

Binance.US says it is a separate, independent platform, is not affected by the reported Binance.com security incident, and that its customer funds and services are operating normally.

Blockaid says the hot wallet labeled Binance 14 was upgraded through an EIP-7702 authorization to an unverified sweeper contract that only the attacker's operator address can drain, so funds sent to that wallet keep getting swept. The attacker sprayed 50 authorizations for different nonces in one transaction, and one landed.

Binance co-founder Yi He thanks Ripple for freezing about 200 million and repeats that user funds are safe.

Binance says its team is conducting security checks and withdrawals will resume as soon as the security issue is fully resolved; user funds remain safe. USD1 (World Liberty Financial) says it froze $27M in USD1 associated with the Binance hack.

Replying to an estimate that the loss after the Tether and Circle freezes is about $1B, CZ says the loss might be a bit higher than that but will be covered.

BleepingComputer reports that Arkham Intelligence is tracking 55 addresses under an entity labeled binance-hacker-1029 holding about $5.78B (about $1.77B USDT, $1.44B BTC, $876M ETH and $823M USDC), a holdings figure rather than a confirmed amount stolen. Etherscan labels the first receiving address Binance Hot Wallet Exploiter 2. Binance has not confirmed whether the transfers were unauthorized, how it happened or the total loss.