Binance is investigating reports of suspicious transfers from wallets associated with the exchange after onchain analysts identified multibillion-dollar movements across several networks. The largest immediate response came from stablecoin issuers Tether and Circle, which froze a combined $1.79 billion in USDT and USDC held in a wallet that had received funds linked to Binance hot wallets.
Binance co-founder and chief customer service officer Yi He said the company was actively investigating the reports. She urged users to avoid unofficial links, private messages and any requests for account credentials, a warning that reflects the heightened phishing risk that often follows alleged exchange security incidents.
The exchange had not publicly confirmed that a breach occurred at the time of publication. The available onchain activity establishes that large transfers took place, but does not by itself identify the party controlling the destination wallets or establish how the transfers were authorized.
Onchain analysts identify transfers worth billions
Blockchain analyst Spreek first flagged activity involving roughly $3.55 billion in transfers into an unlabeled wallet. Nearly $900 million was subsequently moved onward through other wallets, according to the analyst's public onchain review.
Conor Grogan, senior director and product leader at Coinbase, estimated in a public post that total suspicious outflows could reach as much as $5.8 billion. That figure is an estimate based on observed wallet movements rather than a confirmed loss disclosed by Binance.
Blockaid, a blockchain security firm, said it was investigating approximately $3.3 billion in suspicious outflows from Binance hot wallets on Ethereum, Arbitrum and Avalanche. Hot wallets are internet-connected wallets used by exchanges to process withdrawals and other routine transactions, making them operationally necessary but more exposed than offline storage systems.
The differing estimates reflect the difficulty of assessing a rapidly moving onchain event. Analysts can track transactions on public blockchains, but they must interpret wallet ownership, internal exchange movements, bridge transfers and potentially overlapping transaction flows. A large transfer associated with an exchange wallet can also be part of treasury management or a security response, though the public statements from Binance and security researchers placed the movements under investigation.
Stablecoin issuers block funds in receiving wallet
Tether and Circle acted against stablecoins held at a wallet connected to the reported transfers. Onchain data showed that $1.79 billion in USDT and USDC was frozen in the address.
Paolo Ardoino, chief executive officer of Tether, later said Tether had frozen more than 1.567 billion USDT. Circle's action, combined with Tether's, accounted for the $1.79 billion total identified onchain.
The freezes demonstrate a practical limitation for anyone moving large amounts of centralized stablecoins after a suspected exploit. USDT and USDC operate on public blockchains, but their issuers retain contract-level powers to blacklist addresses and prevent tokens from being transferred. That capability can preserve assets while an incident is assessed, although it also means these assets do not function with the same censorship resistance as native cryptocurrencies such as Bitcoin.
Freezing funds does not necessarily mean the assets will be recovered or returned. Any eventual recovery would depend on the findings of Binance, the stablecoin issuers, relevant law enforcement agencies and any legal process surrounding the wallets involved.
Binance figures urge caution as BNB falls
Yi He's warning focused on the risk of fraud exploiting confusion around the incident. Scammers frequently impersonate exchange support staff during periods of market stress, using fake compensation claims, emergency wallet-verification requests or malicious links designed to capture login details and two-factor authentication codes.
Users seeking updates should rely on Binance's verified communications channels and avoid signing wallet transactions or disclosing recovery phrases in response to unsolicited messages. No legitimate support process requires a user to disclose a seed phrase or transfer assets to a "verification" wallet.
Changpeng Zhao, Binance's former chief executive officer, said he no longer manages Binance.com. He added that he expected user funds to be fully covered. Zhao's statement was an expression of confidence rather than a public assessment of the suspected transaction flows or a formal description of Binance's liabilities and reserve arrangements.
BNB, the token associated with the BNB Chain ecosystem, was down more than 5.5% at the time referenced in the supplied reporting. The decline showed that the reports had quickly reached the market, although a single price move cannot establish the full cause of trading activity during a developing event.
The incident tests exchange security and stablecoin controls
The reported transfers arrive in a market where a small number of large platforms and asset issuers sit at critical points in cryptocurrency trading and settlement. In May 2026, the total cryptocurrency market was valued at about $2.65 trillion, according to the supplied material, while decentralized finance protocols held nearly $70 billion in locked assets.
A suspected outflow on the scale described by the analysts would place immediate pressure on an exchange's incident-response systems: identifying wallet exposure, controlling withdrawals where necessary, communicating with customers and coordinating with token issuers capable of freezing assets. The rapid blacklisting of the receiving wallet suggests that stablecoin issuers can intervene faster than traditional recovery processes, provided the funds remain in tokens under their control.
The unresolved issue is whether the transfers represent a confirmed compromise, an unauthorized withdrawal sequence, or activity that Binance can explain through its internal investigation. Until the company publishes a clearer account, the most concrete facts are the visible wallet movements, the stablecoin freezes and Binance's acknowledgement that it is examining the reports.
Worried about centralized exchange risks? Learn how to safeguard funds with cold vs hot wallet strategies after major security scares.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
