Stablecoin Issuers Freeze Over $2.6 Billion Amid Binance Security Breach

Stablecoin issuers, including Tether, Circle, Ripple, and World Liberty Financial, have taken significant action by freezing more than $2.6 billion in digital assets linked to a suspected security breach at Binance. This breach is believed to involve nearly $6 billion in outflows from the exchange.

On October 29, Tether's CEO, Paolo Ardoino, announced that the company had frozen over $1.567 billion in USDT associated with the incident. Ardoino emphasized the importance of protecting the industry and their partners.

Circle also reported freezing approximately $823 million in USDC related to the breach, with CEO Jeremy Allaire confirming that the company is working with law enforcement to restrict the movement of potentially compromised assets and assist in the ongoing investigation.

In addition to Tether and Circle, other stablecoin issuers have joined the effort. Ripple has reportedly frozen around $200 million, while World Liberty Financial, linked to Donald Trump, has restricted $27 million in USD1. Paxos has also disclosed freezing 1,906.67 PAX Gold tokens valued at over $8 million.

The combined freezes exceed $2.6 billion, which represents a substantial portion of the estimated $6 billion in assets reportedly transferred from Binance-linked wallets. However, Binance has yet to confirm the total amount that may have been compromised, leaving the full extent of the breach unclear.

Details of Suspicious Asset Movements

Crypto research firm Kairos Research estimated that approximately $5.7 billion left Binance's hot wallets. The suspicious activity reportedly began at 4:20 p.m. ET when an external address utilized Ethereum's EIP-7702 account-delegation mechanism to attach executable code to a Binance hot wallet. Shortly thereafter, a single transaction transferred 63 tokens, including 1.6 billion USDT and 167,000 ETH.

Another Binance hot wallet transferred 28,000 ETH to the same destination, while 18,270 BTC and 613 million USDT on Tron were also moved to new addresses around the same time. The attacker continued to move assets even after the initial freezes, including an additional 200 million USDT transferred through the compromised Ethereum wallet, which was later frozen.

Intelligence Reviewed

Before Tether intervened, the suspected attacker deposited $60 million in USDT into Aave and borrowed about 19,800 ETH, valued at $45 million. In response, Aave paused most of its Ethereum lending markets to restrict new deposits and borrowing activity. Aave stated that its contracts remain unaffected and that positions are overcollateralized, but as a precaution, all DAO-operated markets across V3 and V4 have been frozen, allowing users to withdraw and repay existing positions.

Despite these measures, approximately $850 million in ETH continued to move between newly created wallets, while 17,270 BTC remained untouched. Meanwhile, Binance confirmed that its security teams are investigating the suspicious activity and reviewing available information. The exchange assured customers that their assets are safe and promised further updates once the circumstances are verified.