Stablecoin issuers, including Tether, Circle, Ripple, and World Liberty Financial, have frozen more than $2.6 billion in digital assets linked to a suspected Binance security breach involving nearly $6 billion.
On Oct. 29, Tether CEO Paolo Ardoino said the company had frozen more than $ 1.567 billion in USDT linked to the suspected incident. He wrote on X:
“Protecting the industry and our partners is our main priority.”
Circle also froze approximately $823 million in USDC linked to the incident. CEO Jeremy Allaire confirmed that the company was coordinating with law enforcement to restrict the movement of potentially compromised assets and support the investigation.
Other stablecoin issuers joined the effort, with Ripple reportedly freezing approximately $200 million and Donald Trump-linked World Liberty Financial restricting $27 million in USD1.
Paxos also disclosed that it had frozen 1,906.67 PAX Gold (PAXG) tokens valued at more than $8 million.
Together, the reported freezes exceed $2.6 billion, representing a substantial portion of the approximately $6 billion in assets reportedly transferred from Binance-linked wallets.
However, Binance has not yet confirmed the total amount potentially compromised, leaving the scale of the suspected breach unresolved.
Binance hack outflows approach $6 billion
Crypto research firm Kairos Research estimated that about $5.7 billion left Binance hot wallets. According to the firm, the suspicious activity began at 4:20 p.m. ET when an external address used Ethereum’s EIP-7702 account-delegation mechanism to attach executable code to a Binance hot wallet.
Three minutes later, a single transaction transferred 63 tokens, including 1.6 billion USDT and 167,000 ETH.
Another Binance hot wallet transferred 28,000 ETH to the same destination, while 18,270 BTC and 613 million USDT on Tron moved to new addresses around the same time.
The research firm said the attacker kept moving assets after the initial freezes, including another 200 million USDT transferred through the compromised Ethereum wallet, which was later frozen.
Before Tether intervened, the suspected attacker also deposited $60 million in USDT into Aave and borrowed about 19,800 ETH, valued at $45 million.
Kairos reported that Aave subsequently paused most of its Ethereum lending markets, restricting new deposits and borrowing activity. Aave said on X:
“Aave’s contracts are unaffected, and positions remain overcollateralized. As a precaution, all DAO-operated markets across V3 and V4 have been frozen. The freeze pauses new deposits and borrows, and users can still withdraw and repay their existing positions.”
Despite these measures, approximately $850 million in ETH continued moving between newly created wallets, while 17,270 BTC remained untouched.
Meanwhile, Binance confirmed that its security teams were investigating the suspicious activity and reviewing available information. The exchange also assured customers their assets were safe and promised further updates once it verified the circumstances.