
Binance probes potential $5.8 billion crypto-theft hack
Binance is investigating a possible breach involving up to $5.8 billion in assets, which would exceed the $1.5 billion Bybit theft of February 2025. Tether froze over $1.567 billion in USDT and Circle over $800 million in USDC. Arkham tracks 55 addresses labelled "binance-hacker-1029" holding about $5.78 billion, but that is wallet holdings, not a confirmed theft amount. The cause is not yet known.
What it is
Binance is investigating a possible breach of its hot wallets, reported by BleepingComputer as potentially the largest crypto hack on record. The page gives no date for the incident. A Binance spokesperson said the exchange is "actively investigating" and that "user funds are completely safe." Binance has not confirmed that the transfers were unauthorized, how the breach happened, or any stolen total.
How it works
The page describes on-chain activity only, not an intrusion method. It relies on blockchain analysis posted on X by crypto journalist StarPlatinum:
- A hot wallet known as "Binance 14" sent about $2.53 billion across 64 tokens to a newly created Ethereum address.
- Another $174.4 million left a second Binance wallet 24 seconds later.
- A third hot wallet then sent 780 million USDC to the same address, for a reported total of about $3.48 billion.
Etherscan labels the receiving address "Binance Hot Wallet Exploiter 2", with "Exploit" and "Heist" tags.
Arkham Intelligence tracks 55 addresses under "binance-hacker-1029", holding about $5.78 billion:
| Asset | Value |
|---|---|
| USDT | $1.77 billion |
| Bitcoin | $1.44 billion |
| Ethereum | $876 million |
| USDC | $823 million |
What to do
The page gives no technical remediation. Its one stated guidance is Binance's warning to customers to avoid unofficial links, messages and requests for account information, and to rely on official Binance channels for updates.
Caveats
- Three figures are in play: $3.48 billion (reported transfers), $5.78 billion (Arkham wallet holdings) and the "up to $5.8 billion" headline. BleepingComputer states that Arkham's number is holdings across tracked wallets, not a confirmed theft amount.
- Stablecoin issuers froze funds. Tether CEO Paolo Ardoino said more than $1.567 billion in USDT was frozen. Circle CEO Jeremy Allaire said more than $800 million in USDC was frozen and that Circle is coordinating with law enforcement.
- Binance founder Changpeng Zhao (CZ) said on X that the incident appeared to be a hack. CZ also said they no longer manage the exchange and expect all user funds to be fully covered. This is CZ's expectation, not a Binance statement.
- The story was still developing when the page was written, and the on-chain figures come from social media analysis.
Organisations named here
- Arkham Intelligence
- binance-hacker-1029
- Changpeng Zhao
- Jeremy Allaire
- Paolo Ardoino
- StarPlatinum
Technologies named here
- Ethereum
- Bitcoin
- Binance
- Tether
- USDC
- Bybit
- Circle
- Arkham Intelligence
- Binance cryptocurrency exchange (hot wallets, including the wallet known as "Binance 14"; up to $5.8 billion in digital assets potentially involved)
- Circle USDC (more than $800 million frozen, per Circle CEO Jeremy Allaire)
- Etherscan
- Tether USDT (more than $1.567 billion frozen, per Tether CEO Paolo Ardoino)
- The Blue Report 2026
Techniques named here
- Blockchain transaction analysis
- Hot wallet fund transfer to attacker-controlled address
- Stablecoin freezing
Threat actors named here
- North Korean hackers
Related in Blockchain

THORChain Exploit Report #2 — GG20 root-cause disclosure

Black Thursday revisited: MakerDAO keeper exploited for $500K
.jpg)