Bitcoin Under $79K as $5.6B Leaves Binance in Suspected Record Hack
Binance just had the worst night in its history. About $5.6B left its hot wallets in under an hour.
If it’s confirmed as a hack, it’s the biggest in crypto history. More than 3x Bybit.
This week in 30 seconds:
-
🚨 ~$5.6B drained from Binance hot wallets across Ethereum, Bitcoin and Tron
-
🧊 Tether and Circle froze $2B+ within hours. 🛑 Aave froze its Avalanche lending markets to block the attacker
-
🏦 Binance: user funds “completely safe.” CZ: “it does look like a hack”
-
🎃 Bitcoin’s whitepaper turns 18 on Saturday
🚨 What happened
-
At 20:24 UTC on Thursday, funds started moving out of Binance hot wallets to a brand new address.
-
About $3.5B moved on Ethereum, including ~167K ETH and ~$1.6B USDT.
-
About $1.44B moved on Bitcoin, roughly 18,270 BTC.
-
About $630M moved on Tron, plus smaller amounts on Avalanche, Arbitrum, Optimism and Base. Estimates of the total range from $5.6B to $5.8B, the high end from Coinbase’s Conor Grogan.
-
Three minutes before the first transfer, a wallet funded through Tornado Cash set up an EIP-7702 delegation on a Binance hot wallet. Researchers say that could let transfers go through without a new signature. How the attacker got that far is still unknown.
🧊 $2B+ frozen in hours
Tether CEO Paolo Ardoino says it froze more than 1.5B USDT, and Circle froze $823M USDC, both in the main receiving wallet. Circle’s CEO Jeremy Allaire said it was done “in coordination with law enforcement.”
DeFi moved too. Aave froze its lending markets on Avalanche to stop the attacker from borrowing against the stolen funds, according to on-chain data. Aave hasn’t put out a statement yet. The ETH and BTC can’t be frozen by an issuer. That’s the part to watch.
🏦 What Binance says
Binance first said it was investigating a “potential security issue” and had “not confirmed any impact to user funds.” Minutes later it updated that: “user funds are completely safe.” It still hasn’t called it a hack or given an amount or cause.
CZ, who no longer runs the exchange, was more direct: “it does look like a hack on Binance.” As a shareholder, he says he expects all user funds will be fully covered.
⚠️ If you’re on Binance
-
Don’t click links in DMs, emails or “support” messages. Scammers move fast after events like this.
-
Only trust official Binance channels for updates.
-
Don’t rush funds through random bridges or apps you’ve never used.
-
Keep on any exchange only what you’re actively trading.
📉 Market reaction
-
BTC slipped below $79K
-
BNB fell about 7%
-
XMR rose about 6%
💵 Why this one hits harder
On Monday I wrote that Binance holds more than 70% of all exchange stablecoin reserves, and that the cash was already leaving. Tonight about $2.5B in USDT and USDC went out of its hot wallets in one go.
That’s the risk when one exchange holds most of the market’s dry powder. When it gets hit, everyone feels it.
🔗 Sponsored by XYO Network
The Original DePIN Protocol — Now with Its Own Layer One
10M+ nodes. A decade of proof-of-work. XYO’s Layer One is built for high-volume data, AI infrastructure, and real-world asset tokenization, with dual tokens $XYO and $XL1.
🎃 Bitcoin turns 18 on Saturday
On Halloween 2008, someone calling themselves Satoshi Nakamoto sent a nine-page PDF to a cryptography mailing list. The pitch was one sentence: a new electronic cash system, fully peer-to-peer, “with no trusted third party.”
Eighteen years later, the biggest trusted third party in crypto may have just lost $5.6B in one night. The paper’s answer still holds: hold your own keys.
🔥 Weekly signal recap
The rest of the week, one line each.
-
The OCC is telling community banks to apply for stablecoin licenses now, ahead of the January deadline. CCS →
-
Aviva Investors puts a £22bn sterling fund on the XRP Ledger. CCS →
-
The NBA names Kalshi and Polymarket its preferred prediction markets and signs a CFTC agreement. CCS →
-
Ripple adds stablecoin yield to its corporate treasury platform. CCS →
-
Bitcoin treasury buying didn’t stop. Strive is now at 6,182 BTC with Bitcoin 36% below its record high. CCS →
-
An Interpol-backed UAE operation flags $39B in fraud-linked crypto. CCS →
-
An attacker drains $2.7M in ETH from the Initia bridge. CCS →
-
Malaysia and Thailand join Singapore’s BLOOM stablecoin project, now 24 members. CCS →
✍️ Ashton’s take
I’ve covered every major exchange failure since Mt. Gox. The pattern never changes.
Exchanges get bigger, faster and more regulated. The keys stay the weakest link.
Binance has the SAFU fund and the balance sheet to make users whole, and I expect it will. But “expect” is doing a lot of work tonight. Tether, Circle and Aave all moved within hours. The ETH and BTC are still out there.
Not your keys, not your coins. It’s a cliché because it keeps being true. Full charts and the 0G interview are coming in the next issue.
Ashton Addison
CEO, Crypto Coin Show & BlockWest
💬 Your turn
After tonight, how much do you keep on exchanges? Hit reply and tell me. I read every one.
📌 Quick links
Sources: on-chain tallies via Decrypt, The Block and Unchained, Binance’s statements and CZ’s post. Figures are early and may change.
© 2026 Crypto Coin Show.
This publication is for informational and educational purposes only and does not constitute financial, investment, legal, or other professional advice. Investments in cryptocurrencies involve significant risk including loss of capital. Always conduct your own research and consult a qualified financial advisor before making investment decisions.