Binance-Linked Outflows: What the Conflicting Estimates Show
Reports describe billions of dollars in suspicious transfers from wallets linked to Binance. The estimates conflict, and none confirms how much, if anything, was stolen.
- Reported outflows range from $2 billion to nearly $5.9 billion.
- Tether, Circle and Binance reported different totals for frozen assets.
- The cause, confirmed losses and final recovery remain unclear.
Outflows are not confirmed losses
Crypto Economy estimated hot-wallet outflows of $2 billion to $3 billion, according to a CryptoNews.net roundup. CoinTurk News EN reported an initial estimate of $5.3 billion, then described suspicious outflows close to $5.9 billion. The reports do not establish whether the estimates cover the same wallets, assets, time period or transactions.
That distinction matters. An outflow is a transfer, not proof that it was unauthorized or that the funds were lost. Until investigators establish what happened, “suspicious outflows” is more accurate than “stolen funds.”
Some reports named USDT, BTC, USDC, ETH, XRP, SOL and TRX among the assets involved. The material available here does not independently verify those details. A Glassnode report cited in coverage dates to 2020 and examines Binance’s historical growth and exchange balances. It does not analyze this reported incident or substantiate the $5.3 billion and $5.9 billion figures.
Blockchain records can show assets moving between addresses, but a transaction alone does not reveal who controlled those addresses or whether the transfer was authorized. A large total of transfers also does not necessarily mean there was a net loss. Some activity may involve movements between wallets or through intermediary addresses. That possibility does not prove the transfers were harmless. It is a reason not to treat gross movement as confirmed theft.
Freeze figures do not yet add up
Secondary reports quoted Changpeng Zhao, Binance’s co-founder and former CEO, as saying, “It does look like a hack on Binance, ” and that he expected customers’ funds to be covered. He also reportedly cited about $971 million frozen by Tether and $823 million by Circle. These statements have not been independently confirmed here through primary disclosures.
“I'm not running Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered, ” Zhao said, according to the reports.
Tether CEO Paolo Ardoino was later reported as saying the company had frozen over 1.567 billion USDT linked to the potential incident. “Protecting the industry and our partners is our main priority, ” he said. Circle CEO Jeremy Allaire was reported as saying Circle had frozen over $800 million in USDC in coordination with law enforcement.
The Circle figures, $823 million in one account and more than $800 million in another, are broadly consistent. Tether’s reported figures are not: $971 million differs substantially from over 1.567 billion USDT. Binance was also reported as putting frozen assets at $2.54 billion, but the available accounts do not explain what that total includes or how it overlaps with the figures from the issuers.
These amounts should not be added together or treated as a reconciled balance. The reports do not clarify whether the differences reflect separate time points, different asset sets or different definitions of “frozen.” A freeze restricts the movement of specific assets. It does not, by itself, mean those assets have been recovered or returned to customers.
What the evidence can and cannot say
Secondary reports say Zhao described the situation as an apparent hack. That is a reported characterization, not a forensic account of how access was obtained. The available information does not establish the method, identify who controlled the destination addresses or confirm the final amount of any loss.
Some coverage suggested the highest estimate could make this the largest crypto hack on record, surpassing the February 2025 Bybit attack, reported at about $1.5 billion. That comparison assumes the disputed Binance outflow figure represents confirmed theft. The available evidence does not support that assumption. The Bybit attack has been linked to North Korean hackers; there is no basis here to attribute the reported Binance activity to them.
Until primary disclosures or consolidated transaction analysis clarify the scope, the main questions remain unanswered: how much moved, how much was unauthorized and how much, if any, was ultimately recovered.
Key questions and answers
-
Was Binance hacked?
Zhao was quoted as saying it looked like a hack, and reports described suspicious outflows. The available information does not independently establish the cause or confirm the full nature of the incident.
-
How much was stolen?
That is unknown. Secondary reports estimated outflows of $2 billion to nearly $5.9 billion, but neither figure represents a confirmed loss.
-
How much was frozen?
Tether, Circle and Binance were reported as giving different totals, including Binance’s reported $2.54 billion figure. The amounts have not been reconciled, and a freeze is not the same as a recovery.
-
Are customer funds guaranteed?
Zhao said he expected user funds to be fully covered. That is an assurance attributed to him, not an independent accounting of losses or proof that funds have been recovered.
-
Who was responsible?
The available information does not identify an actor or establish who controlled the receiving addresses.
