Binance said on X that “user funds are completely safe” after wallets Etherscan labels as Binance hot wallets sent billions of dollars in crypto to a single new address on Thursday afternoon, and Tether and Circle froze about $2 billion in stablecoins.

That line came at 5:29 p.m. ET in a revised statement. A 5:16 p.m. ET version said its teams were “actively investigating” a “potential security issue” and had “not confirmed any impact to user funds.” The exchange has not called the outflows a hack.

Founder Changpeng Zhao, who no longer runs the exchange, posted a minute earlier that “it does look like a hack on Binance” and that, as a shareholder, he expects “all user funds will be fully covered.”

Tether blacklisted the receiving address at 5:01 p.m. ET, and Circle followed at 5:04 p.m. ET with 823 million USDC, balances Unchained read directly from the USDT and USDC token contracts; the address now holds about 1.18 billion frozen USDT. Tether also blacklisted seven downstream wallets, two of which hold about 205 million USDT combined. Tether CEO Paolo Ardoino said at 5:25 p.m. ET that Tether “froze more than 1.567B USDT related to a potential Binance exchange hack,” a figure Binance co-founder Yi He repeated. That is higher than the roughly 1.38 billion USDT Unchained can see frozen with balances on Ethereum.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

A Second Sweep After Binance’s Statement

The drain was still running after Binance’s statement. At 5:44 p.m. ET the address that set up the delegation swept Binance 14 again, moving about 200 million more USDT and roughly 370 ETH that had built up in the wallet into the frozen address. As of 6:34 p.m. ET, Binance 14 was still delegated to that address’s contract, though no further sweep had followed.

The receiving address has since moved tokens that Tether and Circle cannot freeze, sending about 217.5 million ENA and 29,934 WBETH to another wallet, and one of the wallets that swapped USDT into ETH moved 122,310 ETH to a fresh address at 5:47 p.m. ET. On-chain analyst Officer’s Notes put total outflows from Binance-labeled wallets at about $5.64 billion counting Bitcoin and Tron, a figure Unchained has not verified.

About $3.5 Billion on Ethereum Alone

By Unchained’s own count of Ethereum transfers, the receiving address took in about $3.52 billion between 4:24 p.m. and 5:04 p.m. ET: 197,170 ETH (about $456 million at the time), 1.68 billion USDT, 823 million USDC and roughly $564 million across 62 other tokens, with other tokens priced when Unchained pulled the data. The total is more than double the “approximately $1.5 billion” that the FBI said in a public service announcement North Korean hackers stole from Bybit in February 2025. It leaves out other chains, and reported Bitcoin outflows remain unverified. Security firm Blockaid, which said in a note from its PR agency that it is investigating about $3.3 billion in suspicious outflows from Binance hot wallets, said at 5:11 p.m. ET that outflows from Binance hot wallets on Ethereum, Arbitrum and Avalanche “look consistent with unauthorized movement from those wallets” and put the Arbitrum and Avalanche portions at about $19.5 million and $24 million. Its approximate Ethereum figure, about $2.5 billion plus 780 million USDC, is lower than Unchained’s count and, it said, “still being reconciled.” On Avalanche, Unchained confirmed that four wallets Blockaid identifies as Binance’s sent about 1.81 million AVAX to the same receiving address, which still holds about 8.4 million USDT there.

How the Funds Moved

An address funded in part through Tornado Cash’s 0.1 ETH pool set up an EIP-7702 delegation on the wallet Etherscan labels Binance 14 at 4:20 p.m. ET, pointing it at a contract the same address had deployed earlier that day. EIP-7702 lets an ordinary wallet run a smart contract’s code, but only with an authorization signed by that wallet’s own key. The delegation transaction carried 50 such authorizations for consecutive Binance 14 nonces, and one landed, which Blockaid said on X meant the attacker “didn’t know Binance 14’s live nonce.” Binance 16’s transfer, below, was an ordinary transaction signed with that wallet’s own key.

Four minutes later it swept Binance 14, Binance 16 sent 28,005.6 ETH to the same destination, and calls through Binance 14 pulled 780 million USDC, then 43 million more, from a wallet Etherscan labels Hot Wallet 34. Before the freezes, the receiving address sent 700 million USDT to two wallets that quickly swapped much of it into ETH.

Security firm PeckShield flagged “unexpected large outflows” at 4:55 p.m. ET, more than 20 minutes after on-chain analyst Spreek raised an early public alarm. Last month, Unchained looked at how Bitget chased $388 million in funds stolen in a hack.

*This story was updated with how the Binance 14 delegation was signed, the latest fund movements and an analyst’s multichain estimate.*

Related Listen: Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?