Binance Froze Withdrawals After Billions Vanished From Its Hot Wallets

On Thursday afternoon, users of the world's biggest crypto exchange started posting screenshots of balances disappearing. Within hours, Binance had quietly turned off the exit door: withdrawals were paused across multiple networks. That is not the kind of move an exchange makes over a bug. It is what happens when billions of dollars are suspected to be walking out of hot wallets.

First, the company line

Binance told TechCrunch it was "aware of reports of a potential security issue" and was investigating with urgency, adding that user funds were "completely safe." Spokesperson Ross O'Leary later confirmed that withdrawals had been suspended on several networks as a precautionary measure. That phrasing matters. "Precautionary" is doing a lot of work in that sentence, especially when the freezer is still on hours later.

Binance also warned customers to ignore unofficial links and messages asking for account details — standard advice during a breach, and usually a sign that phishing crews are already circling the confusion.

Changpeng Zhao posted before Binance did

The timeline is the strange part. Hours before Binance acknowledged anything, founder Changpeng Zhao said on X that the company had probably been hacked. Zhao no longer runs the exchange but remains its largest shareholder, and he told followers he expected user funds to be "fully covered" — without explaining how he knew that or what had actually happened. An owner speaking publicly ahead of the security team is never a great look during an active incident.

Stablecoin issuers moved faster than the exchange

According to TechCrunch, Tether froze roughly $1.56 billion tied to the Binance incident, while Circle froze about $800 million in Tether as it moved through its networks. Those numbers are the clearest hint at scale so far. When two stablecoin issuers start burning keys within hours, they are working from addresses someone has already linked to the theft.

So how much was taken?

Crypto watchers tracking the wallets say at least $2 billion has drained out of Binance's internet-connected hot wallets. Some estimates put the figure as high as $5.7 billion, though none of it is confirmed and investigators have said the theft may still be in progress. Nobody has claimed responsibility, and Binance hasn't said whether the attackers have been in touch.

For context: the largest single crypto breach on record is the 2025 Bybit hack, where attackers — widely blamed on North Korean operatives — took about $1.4 billion. If even the conservative estimate here holds, this one eclipses it.

It wasn't an isolated bad day either. In what appears to be a separate incident the same Thursday, Polymarket briefly stopped trading after a third-party vendor was compromised; researchers say around $2 million in user funds was stolen after attackers hit software made by a company called DebugBear. Two exchanges, one afternoon, both bitten through the supply chain around them.

What I'd take from this

Every few months we get a reminder that "not your keys, not your coins" isn't a slogan — it's a risk model. Exchange balances are convenient, and convenience is exactly what gets targeted. If you hold serious size on any centralized platform, the boring steps still win: hardware wallet for the long-term stack, move what you're not actively trading, turn on withdrawal allowlists, and never act on a link that arrives during a hack. The next update from Binance will come through official channels only, and until then, the loudest voices are the least reliable ones.