Stablecoin issuers have moved to restrict access to more than $2.6 billion in digital assets following a suspected security breach at Binance that resulted in approximately $6 billion in outflows from the exchange's hot wallets.
Tether froze more than $1.567 billion in USDT on October 29, with CEO Paolo Ardoino stating that protecting the industry and partners was the company's priority. Circle restricted approximately $823 million in USDC and confirmed coordination with law enforcement to prevent movement of potentially compromised assets.
Ripple froze roughly $200 million in assets, while World Liberty Financial restricted $27 million in USD1. Paxos disclosed the freezing of 1,906.67 PAX Gold tokens valued at more than $8 million. Together, the reported freezes represent a substantial portion of the suspected total breach amount.
Scope of the Suspected Breach
Crypto research firm Kairos Research estimated that approximately $5.7 billion left Binance hot wallets. The suspicious activity began when an external address used Ethereum's EIP-7702 account-delegation mechanism to attach executable code to a Binance hot wallet. A single transaction three minutes later transferred 63 tokens, including 1.6 billion USDT and 167,000 ETH.
Additional transfers included 28,000 ETH from another Binance hot wallet, while 18,270 BTC and 613 million USDT on Tron moved to new addresses around the same time. The suspected attacker continued transferring assets after initial freezes, moving another 200 million USDT through a compromised Ethereum wallet.
Wider Protocol Response
Before Tether intervened, the suspected attacker deposited $60 million in USDT into Aave and borrowed approximately 19,800 ETH, valued at $45 million. Aave subsequently paused most of its Ethereum lending markets as a precaution, restricting new deposits and borrowing activity while allowing users to withdraw and repay existing positions.
Despite these measures, approximately $850 million in ETH continued moving between newly created wallets, while 17,270 BTC remained untouched at the time of reporting.
Exchange Response
Binance confirmed that its security teams were investigating the suspicious activity and reviewing available information. The exchange assured customers that their assets were safe and pledged to provide further updates once it verified the circumstances surrounding the incident. Binance has not yet confirmed the total amount potentially compromised.
