Binance is investigating reports of a potential security breach tied to an Ethereum wallet that appears to have triggered large, fast-moving stablecoin outflows. According to blockchain observers and stablecoin issuers, suspicious transfers prompted the freezing of nearly $1.8 billion across USDC and USDT, while analytics firms put the broader set of affected wallets’ reported holdings far higher.

On Thursday, blockchain researcher Spreek first flagged activity involving a Binance-linked Ethereum wallet moving funds to a newly created address via a contract call allegedly funded by Tornado Cash. Binance later confirmed it was reviewing the matter and had not confirmed any direct loss of user funds at the time of reporting.

Key takeaways

Binance says it is investigating suspicious activity tied to an Ethereum wallet, but has not yet confirmed impact to user funds.
Stablecoin issuers Circle and Tether reported freezing a combined $2.36 billion worth of tokens linked to the suspected incident.
Blockchain analytics identified “binance-hacker-1029” wallets holding about $5.84 billion in assets, though the figure reflects reported holdings rather than confirmed theft.
Reports of Tornado Cash–funded contract activity and subsequent USDT sales on decentralized exchanges have intensified scrutiny of the transfer trail.

From researcher alerts to stablecoin freezes

The incident first came into focus when Spreek posted on X that assets from a Binance-linked Ethereum wallet had been transferred to a new address through a contract call reportedly funded by Tornado Cash. Spreek subsequently reported that wallets connected to the transfers started selling USDT through decentralized exchanges, suggesting the activity may have been aimed at quickly converting stablecoins to other assets.

As additional tracking emerged, Arkham Intelligence identified a cluster of wallets labeled “binance-hacker-1029,” reporting that the wallets held approximately $5.84 billion in digital assets at the time of its update. Arkham’s figure is described as the wallets’ reported holdings, not an estimate of confirmed stolen funds.

Binance co-founder Changpeng Zhao said the activity appeared to be a hack and pointed to coordinated freezing by stablecoin issuers. Zhao stated that Tether had frozen about $971 million and Circle about $823 million and added that he expected user funds to be fully covered.

Why Tether and Circle’s actions matter

One of the most consequential developments was the rapid response from the two largest stablecoin issuers by market capitalization. Blockaid, in an X post earlier on Thursday, said it had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum, and Avalanche.

In close succession, Circle and Tether announced they had frozen a combined $2.36 billion in tokens linked to the suspected exploit. Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue supporting the investigation. A few minutes later, Tether CEO Paolo Ardoino said Tether had frozen more than $1.567 billion in USDT tied to the potential incident, emphasizing the company’s priority to protect users and ecosystem partners.

For traders and investors, such freezes can be critical because they can reduce the ability of attackers to move stablecoins off platforms where issuer-side controls can mitigate damage. The downside is that freezes can also complicate market activity around affected addresses and may create uncertainty about how much value is recoverable and when.

Binance’s review and the unresolved gap between “holdings” and “loss”

While multiple parties have tracked large flows, Binance’s position has been more cautious. In a statement provided to Cointelegraph, a Binance spokesperson said the exchange was investigating reports of a potential security issue but had not confirmed any impact on user funds. Binance also said its security teams were reviewing the activity and would share updates once additional information was verified.

This distinction—between reported wallet holdings and confirmed stolen funds—remains important. Arkham’s estimate of $5.84 billion reflects what the labeled wallets were holding, not proof that all of those assets represent successful theft. Similarly, Blockaid’s figure of $3.3 billion refers to suspicious transfers, which may include funds that could be frozen, reversed, or never actually controlled end-to-end by an attacker.

Zhao’s message that he expects all user funds to be fully covered adds to confidence, but it does not replace the need for the underlying technical findings. Until Binance completes its internal review and confirms the scope of any compromise, readers should treat circulating totals as indicators of potential impact rather than finalized loss figures.

What to watch next

Attention now turns to what Binance concludes about the initial vector—particularly the alleged role of Tornado Cash–funded contract activity—and whether any assets beyond the frozen balances are still accessible. As stablecoin issuers continue to coordinate with investigators, market participants should monitor whether additional addresses are labeled, more freezes are announced, and Binance’s investigation confirms what portion of the observed activity ultimately connects to customer funds.