Binance hot wallets drained of billions in suspected hack; Tether and Circle freeze stablecoins, withdrawals paused
Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 30/10/2026 00:08; os links antigos trazem para cá.
Fontes: techcrunch.com ↗ securityaffairs.com ↗ bleepingcomputer.com ↗
Binance is investigating a suspected security incident after billions of dollars in assets moved on October 29 from multiple Binance hot wallets to newly created addresses. The company acknowledged "reports of a potential security issue" and said user funds are "completely safe" (bleepingcomputer.com, securityaffairs.com). It also temporarily suspended withdrawals on multiple networks as a precaution (techcrunch.com). Founder Changpeng Zhao (CZ) said on X that the activity appeared to be a hack and that he expects user funds to be fully covered. Tether (CEO Paolo Ardoino) and Circle froze stablecoins tied to the flagged addresses, but the total stolen is unconfirmed, the intrusion vector is unknown, and the theft may be ongoing (techcrunch.com). If confirmed, this would be the largest crypto theft on record, ahead of the February 2025 Bybit heist, which techcrunch.com attributes to North Korean actors. Nobody has been attributed for the Binance incident.
Detalhes técnicos
- Transfers: Blockchain analysis by journalist StarPlatinum (bleepingcomputer.com) shows the hot wallet "Binance 14" moving about $2.53 billion across 64 tokens. About 24 seconds later a second wallet sent $174.4 million, and later a third wallet sent 780 million USDC, for a total of about $3.48 billion. Etherscan labeled the receiving address "Binance Hot Wallet Exploiter 2" with "Exploit" and "Heist" tags.
- Tracked holdings: Arkham Intelligence tracks 55 addresses under the entity "binance-hacker-1029". Tracked assets include roughly $1.77B USDT, $1.44B BTC, $876M ETH and $823M USDC (bleepingcomputer.com).
- Movement across chains: Trackers suggest funds moved across Ethereum, Bitcoin and Tron. Nearly $900 million was later moved onward and layered through other wallets, which complicates tracing (securityaffairs.com).
- Freezes: Centralized stablecoin issuers can blacklist addresses at the token-contract level. That control does not exist for native assets such as BTC or ETH, so those funds cannot be frozen this way (securityaffairs.com).
- Open questions: Binance has not disclosed the initial access vector or root cause. It is unknown whether signing keys or credentials were compromised, which internal systems were involved, whether the transfers were authorized, and whether attacker access persists (securityaffairs.com). Binance has not said whether it received any communication from the attackers (techcrunch.com).
- Separate Polymarket incident: The same day, prediction market Polymarket briefly halted trading and withdrawals after its third-party supplier DebugBear was compromised. About $2 million in user funds was stolen in what looks like a supply chain compromise (techcrunch.com). The sources do not link it to the Binance incident.
Remediação
- Rely only on official Binance channels. Ignore unsolicited links, messages or "account verification" requests, and never share passwords, 2FA codes or seed phrases (all three sources).
- Security teams should expect a wave of phishing and support-impersonation scams exploiting the incident (securityaffairs.com).
- Stablecoin issuers are coordinating freezes with law enforcement (bleepingcomputer.com).
- Organizations that use third-party browser or analytics scripts should review their exposure to DebugBear (techcrunch.com).
Relatos divergentes
- Amount moved or stolen: techcrunch.com cites estimates of at least $2 billion, up to $5.7 billion. bleepingcomputer.com cites $5.78 billion (Arkham), but says that is total holdings across tracked wallets, not a confirmed theft amount, and its own on-chain tally is about $3.48B. securityaffairs.com cites $3.55 billion (Spreek) to $5.8 billion (Conor Grogan, Coinbase). None of these figures is verified; Binance has confirmed no loss amount.
- Frozen funds: techcrunch.com reports about $1.56B frozen by Tether and about $800M by Circle. bleepingcomputer.com reports over $1.567B USDT and over $800M USDC, more than $2.3B in total. securityaffairs.com reports about $1.79B combined, while also citing Ardoino's figure of more than $1.567B in USDT. The USDT figure is consistent across sources, and the combined total differs by source.
- Bybit comparison: techcrunch.com puts the Bybit theft at $1.4 billion and bleepingcomputer.com at $1.5 billion.
- Binance's stance: Binance says user funds are "completely safe" and has not confirmed that the transfers were unauthorized (bleepingcomputer.com, securityaffairs.com). CZ says it was likely a hack (all sources), and withdrawals were suspended (techcrunch.com). Treat the incident as suspected and unconfirmed until Binance publishes findings.
Linha do tempo
-
Binance halts withdrawals after suspected multi-billion dollar hot wallet drain
ler a análise desta fonte ocultar
Binance confirmed it is investigating a security incident after users reported funds being drained from the exchange's wallets, and has temporarily suspended withdrawals on multiple networks as a precaution. Crypto watchers estimate at least $2 billion was drained from Binance's hot wallets, with some estimates reaching $5.7 billion, though figures are unconfirmed and the theft may be ongoing. Founder Changpeng Zhao stated on X that the company was likely hacked but expects user funds to be fully covered. Tether froze roughly $1.56 billion and Circle froze about $800 million linked to the incident. Attribution is unknown; if confirmed, this would rank among the largest crypto breaches in history, surpassing the 2025 Bybit theft of $1.4 billion attributed to North Korean actors.
Technical Details
The compromise affected internet-connected hot wallets across multiple blockchain networks. Binance has not disclosed the intrusion vector or whether it received any communication from the attackers. In a separate incident the same day, prediction market Polymarket briefly halted trading and withdrawals after a third-party supplier, DebugBear, was compromised, leading to roughly $2 million in user funds stolen — a supply chain style compromise.
Remediation
Users should avoid unofficial links, messages or requests for account information, as scam activity typically spikes around such events. Monitor only official Binance channels for updates. Organizations relying on third-party browser/analytics scripts should review the DebugBear supply chain exposure.
-
Binance probes suspicious $5.8B crypto outflows; Tether and Circle freeze ~$1.79B in stablecoins
ler a análise desta fonte ocultar
Binance is investigating a potential security incident after large transfers moved from exchange-linked hot wallets on October 29, with on-chain estimates ranging from $3.55 billion (analyst Spreek) to as much as $5.8 billion (Conor Grogan, Coinbase). Tether and Circle froze roughly $1.79 billion in stablecoins tied to the flagged addresses, with Tether CEO Paolo Ardoino later citing more than $1.567 billion in USDT frozen. Binance publicly acknowledged "reports of a potential security issue", said its security teams were investigating and stated that user funds are "completely safe"; co-founder CZ said the activity appeared to be a hack. No technical explanation or confirmed breach has been published, so reported outflows should not be treated as verified losses. Trackers suggest funds moved across Ethereum, Bitcoin and Tron, and some balances were layered through additional wallets.
Technical Details
Blockchain records show transfers from Binance-linked hot wallets to a previously unlabeled wallet, involving ETH, stablecoins and other assets, with nearly $900 million subsequently moved onward across other wallets, complicating tracing. Open questions include whether signing keys or credentials were compromised, which internal systems were involved, whether the transfers were authorized, and whether attacker access persists. Centralized stablecoin issuers were able to blacklist addresses at the token-contract level, a control not available for native assets such as BTC or ETH.
Remediation
Users should rely solely on official Binance channels, ignore unsolicited links or "account verification" messages, and never share passwords, 2FA codes or wallet seed phrases. Security teams should anticipate a wave of phishing and support-impersonation scams exploiting the incident.
-
Binance investigates suspected hot wallet breach with up to $5.8 billion in crypto moved
ler a análise desta fonte ocultar
Cryptocurrency exchange Binance is investigating a potential security incident after billions of dollars in assets were transferred from multiple Binance hot wallets to a newly created Ethereum address. Blockchain intelligence platform Arkham Intelligence is tracking 55 addresses under an entity labeled "binance-hacker-1029" holding roughly $5.78 billion, which would exceed the $1.5 billion Bybit heist of February 2025 as the largest crypto theft on record. Tether froze over $1.567 billion in USDT and Circle froze over $800 million in USDC tied to the incident, totaling more than $2.3 billion. Binance told BleepingComputer that it is actively investigating and that user funds are "completely safe," without confirming whether the transfers were unauthorized. Founder Changpeng Zhao (CZ) said on X the incident appeared to be a hack and expects user funds to be fully covered.
Technical Details
According to blockchain analysis shared by crypto journalist StarPlatinum, the hot wallet known as "Binance 14" moved approximately $2.53 billion across 64 tokens, followed 24 seconds later by $174.4 million from a second wallet, and later 780 million USDC from a third wallet, totaling about $3.48 billion. Etherscan labeled the receiving address "Binance Hot Wallet Exploiter 2" with "Exploit" and "Heist" tags. Tracked assets include ~$1.77B USDT, ~$1.44B BTC, ~$876M ETH and ~$823M USDC. The initial access vector and root cause remain unknown; Arkham's $5.78B figure reflects total holdings across tracked wallets, not a confirmed stolen amount.
Remediation
Binance warned users to beware of scams, unofficial links, messages, or requests for account information exploiting the news. Stablecoin issuers are coordinating with law enforcement on freezes.