Binance hit by suspected $5.57B drain as Tether and Circle freeze $1.8B
In brief
- At least $5.57 billion left Binance-linked wallets on three blockchains, per Decrypt's on-chain tally.
- Binance hasn't confirmed a hack; its security teams are reviewing the information.
- Tether froze 975.1 million USDT and Circle froze 823 million USDC in the receiving wallet.
- Etherscan data shows an EIP-7702 delegation three minutes before the first Ethereum transfer.
- If confirmed, it would be the largest crypto hack on record, surpassing Bybit's $1.5 billion.
Where the money went
The funds came from Binance hot wallets (the internet-connected wallets exchanges use to process customer withdrawals). Decrypt's tally counted $3.51 billion on Ethereum, $1.44 billion in 18,270 Bitcoin and $630 million on Tron.
The first Ethereum transaction, at 20:24 UTC, sent 167,464 ETH plus 63 token transfers (including 1.615 billion USDT) to a brand-new address, according to Etherscan. Three minutes before that, an address funded through Tornado Cash submitted a delegation for a Binance hot wallet using EIP-7702, an Ethereum feature that lets an ordinary wallet run smart-contract code.
Phylax Systems founder Odysseas Lamtzidi said that kind of delegation persists and can authorize later transfers without another signature from the wallet. He posted that the Binance-labeled wallet moved the funds 3 minutes 24 seconds after a signed delegation was installed. Nobody knows yet how the attacker got the required signature.
Stablecoin issuers step in
Tether froze 975.1 million USDT in the main receiving address, Decrypt reported. Circle froze 823 million USDC in the same wallet at 21:04 UTC, bringing the total frozen to about $1.8 billion. Circle CEO Jeremy Allaire said on X that the company froze more than 800 million USDC tied to the incident in coordination with law enforcement.
Both issuers can block specific addresses from moving their tokens. The catch? The attacker was moving funds quickly.
Binance kept its response short, saying on X that its security teams were reviewing the information with urgency.
"We have not confirmed any impact to user funds"
Market reaction and the record books
Bitcoin fell below $79,000, down about 2.6% in 24 hours. BNB, Binance's own token, dropped about 7% to roughly $699, while Monero rose about 6% to $637.
If it's confirmed as a hack, it'd be the largest crypto hack on record. The $5.57 billion tally would be more than triple the roughly $1.5 billion Bybit heist in February 2025, which is the current record.
It wouldn't be Binance's first, either.
The exchange lost 7,000 Bitcoin (about $40 million) in a 2019 hack.
Frequently asked questions
What role did EIP-7702 play in the suspected Binance drain?
EIP-7702 is an Ethereum feature that lets an ordinary wallet run smart-contract code. An address funded through Tornado Cash submitted an EIP-7702 delegation for a Binance hot wallet three minutes before the first Ethereum transfer. Phylax Systems founder Odysseas Lamtzidi said such a delegation persists and can authorize later transfers without another signature. Nobody yet knows how the attacker got the required signature.
How much of the suspected Binance drain has been frozen?
Tether froze 975.1 million USDT in the main receiving address, and Circle froze 823 million USDC in the same wallet at 21:04 UTC. That brings the total frozen to about $1.8 billion. Circle CEO Jeremy Allaire said the freeze was done in coordination with law enforcement.
