Binance probes potential breach involving up to $5.8 billion as Tether and Circle freeze more than $2.3 billion

TLDR

• Binance is investigating a potential breach involving up to $5.8 billion in assets; BleepingComputer says no total is confirmed.¹
• Tether and Circle froze more than $2.3 billion tied to the incident; Binance says user funds are completely safe.¹
• Binance has not confirmed how it happened; founder Changpeng Zhao said on X that it appears to be a hack.¹

Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, BleepingComputer reports, in what it says could become the largest cryptocurrency hack in history.¹ A Binance spokesperson told BleepingComputer: "Our teams are aware of reports of a potential security issue and are actively investigating. Rest assured that user funds are completely safe."¹ TechCrunch reports that spokesperson Ross O'Leary said Binance had "temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure."² The Associated Press reported that Binance had not explicitly confirmed that funds had been pilfered.⁴ Binance founder Changpeng Zhao said on X that the incident appeared to be a hack, noting that he no longer manages the exchange and expects all user funds to be fully covered.¹

The freeze figures differ by outlet. BleepingComputer reports that Tether and Circle froze more than $2.3 billion, with Tether CEO Paolo Ardoino saying more than $1.567 billion in USDT was frozen and Circle CEO Jeremy Allaire saying more than $800 million in USDC was frozen in coordination with law enforcement.¹ Reuters, via CNA, put the Tether and Circle total at over $2.38 billion and said Binance's Yi He wrote on X that Ripple had frozen roughly $200 million.³ The Associated Press reported that crypto firms had frozen more than $2.5 billion by Thursday evening.⁴ FinanceFeeds reports that Binance said in a post on X that its current verified total frozen was $2.54 billion.⁵

The amount taken is not confirmed. BleepingComputer cites blockchain analysis shared on X by StarPlatinum showing a Binance hot wallet known as "Binance 14" transferring about $2.53 billion across 64 tokens to a newly created Ethereum address, and says Arkham Intelligence is tracking 55 addresses labelled "binance-hacker-1029" holding about $5.78 billion, a figure that is the value held across tracked wallets rather than a confirmed amount stolen.¹ TechCrunch reports that crypto watchers say at least $2 billion has been drained from hot wallets and that some estimates exceed $5.7 billion, but the numbers are unconfirmed and the theft may be ongoing.² FinanceFeeds reports that Binance said in an official post at 00:13 UTC on 30 October that it "will cover all losses" and had suspended all deposits and withdrawals, and that Binance had still not said how large the loss is.⁵

The cause is also unconfirmed. Blockaid chief executive Ido Ben-Natan told Cointelegraph that a preliminary assessment pointed to "key misuse", saying "It seems to be… a compromise of signing infrastructure. We don't think a key was leaked."⁷ Blockaid said the attacker bundled 50 EIP-7702 authorisations into a single transaction targeting Binance 14, and Arkham chief executive Miguel Morel told Cointelegraph there was not enough information to confirm whether keys or infrastructure were compromised.⁷ CoinDesk, by contrast, writes that the attacker used EIP-7702 after getting Binance 14's key to sign the permission.⁶ On attribution, TechCrunch says it is unclear who is behind the incident, while Ben-Natan told Cointelegraph the incident was "very, very similar" to the February 2025 Bybit attack and resembled operations linked to North Korean attackers.²⁷ BleepingComputer says the largest confirmed crypto heist on record is the $1.5 billion stolen from Bybit by North Korean hackers in February 2025, while TechCrunch puts that theft at $1.4 billion.¹²

Why it matters: if confirmed, the reported scale would far exceed the Bybit theft, but Binance has not confirmed the amount stolen, the cause or whether the transfers were unauthorised.¹