Binance has temporarily halted withdrawals on several blockchain networks after a suspected cyberattack sent billions of dollars in cryptocurrency out of wallets controlled by the exchange. The scale remains unsettled, but early blockchain analysis places the suspicious transfers anywhere from roughly $2 billion to nearly $5.8 billion. Binance’s withdrawal pause and security investigation have turned an unusual on-chain movement into a full-blown crisis for the crypto market.
The transfers originated from so-called hot wallets, internet-connected storage used to process deposits and withdrawals. Blockchain trackers identified large movements involving Ethereum, Bitcoin, stablecoins, and dozens of other tokens, with one newly created address receiving billions of dollars. Arkham Intelligence was tracking dozens of addresses associated with the suspected attacker, while other estimates counted approximately $3.51 billion on Ethereum, $1.44 billion in Bitcoin, and $630 million on Tron. Those figures remain provisional because investigators have not established which transfers were unauthorized or whether the outflows are still continuing.
Binance said its teams were investigating a potential security issue and had not confirmed an impact to customer funds. Former chief executive Changpeng Zhao separately said user funds were safe and expected to be fully covered. That distinction matters: money leaving an exchange’s operational wallets does not automatically mean customer balances have been lost, but it does raise urgent questions about wallet controls, internal authorization, and whether the exchange can isolate compromised systems without disrupting normal service.
Stablecoin issuers moved quickly to limit the damage. Tether froze roughly $971 million in USDT associated with the receiving addresses, while Circle froze approximately $823 million in USDC, according to on-chain reporting. The combined intervention approached $1.8 billion, potentially preventing a substantial portion of the assets from being laundered or sold. Freezes can protect identifiable tokens, but they do not recover other coins or explain how the transfers were authorized.
Withdrawal availability has varied by network rather than disappearing everywhere at once. Early status tracking indicated that Bitcoin, Ether, and several USDT and USDC routes remained open, while networks including Solana and XRP were among those paused. That patchwork response suggests Binance is attempting to quarantine specific chains and wallet systems while keeping unaffected services running, although customers should expect delays and changing status updates as the investigation develops.
The incident also highlights the vulnerability created by the convenience of hot-wallet infrastructure. Large exchanges need online liquidity to process transactions quickly, but those wallets are exposed to attacks that would be impossible against fully offline storage. Until Binance publishes a technical explanation, confirms the final amount involved, and explains how customer protection will work, the most important numbers will remain estimates. For now, traders are watching wallet movements, withdrawal notices, and the exchange’s next security update as closely as the price charts.
