Claims that two Binance hot wallets were compromised have come with loss estimates ranging from $2 billion to $5.8 billion. The figures do not add up, and the available information does not establish how the wallets were accessed or who was responsible.
- Wallets named: Blockaid identified “Binance 14” and “Binance 16.”
- Reported loss: $2 billion to $5.8 billion, with no clear accounting for the range.
- Response: Tether and Circle said they froze stablecoins; Aave reportedly paused lending markets.
- Attribution: No attacker has been identified. A possible DPRK link remains unconfirmed.
What was reportedly taken?
Security firm Blockaid identified two Binance hot wallets, “Binance 14” and “Binance 16, ” as targets. A hot wallet connects to online systems, making funds easy to move but exposing wallet operations to online security risks. The available information does not explain how anyone gained access to these wallets.
Blockaid’s reported analysis listed $1.6 billion in USDT, $800 million in USDC, $450 million in ETH and $62.6 million in RLUSD among the assets siphoned. It also identified 6.19 million UNI and 2.26 million LINK, but gave no dollar values for those tokens.
The listed dollar-denominated assets add up to about $2.91 billion, before UNI and LINK are valued. That still does not explain the reported range of $2 billion to $5.8 billion. No accounting shows whether the difference comes from additional assets, different valuation times or another calculation. The $5.8 billion figure should not be treated as a confirmed loss.
The destination address was described as newly created and recently funded through Tornado Cash, a privacy mixer designed to make transaction links harder to trace. That reported funding does not establish that Tornado Cash was used to move the alleged stolen assets. Nor does it reveal who controlled the address or carried out the breach.
What did the freezes and Aave pause accomplish?
Tether CEO Paolo Ardoino reportedly said Tether froze more than $1.56 billion in USDT. Circle CEO Jeremy Allaire announced a freeze of more than $800 million in USDC. The combined amount was reported as roughly $2.3 billion, though the two individual “over” figures add up to more than $2.36 billion. The precise amounts, timing and connection between the frozen tokens and the assets listed as taken remain unclear. A separate Circle freeze of $12.6 million in USDC shows that issuers can block tokens, but it is not included in the amounts reported here.
Some stablecoins have issuer-controlled mechanisms that can block specified tokens from being transferred. This can help limit the movement of funds, but it also gives issuers control over transfers. That is a key difference from assets such as ETH, UNI and LINK, which generally cannot be frozen by an issuer in the same way.
Aave reportedly paused lending markets to stop the attacker from using the funds as collateral, or assets pledged to secure a loan, to borrow other tokens that might be harder to freeze. The available information does not say which markets were paused, who initiated the action or how long it lasted. A pause can limit potential damage, but it can also disrupt access for users with no connection to an attack.
Binance co-founder Changpeng Zhao said user funds were safe and thanked Tether and Circle for their actions. That reassurance does not explain how the wallets were compromised or confirm the final value of any loss.
The record claim and the question of responsibility
The incident has been called crypto’s largest hack by total loot valuation, surpassing the cited $1.5 billion Bybit loss. That comparison depends on confirming the $5.8 billion estimate. With the figures still unreconciled, the record claim remains conditional, not a settled measure of how much was taken or retained by an attacker.
The estimate that about $3.5 billion remained unrecoverable appears to come from subtracting roughly $2.3 billion in reported freezes from the $5.8 billion upper estimate. That is an arithmetic estimate, not confirmation that exactly $3.5 billion was permanently lost or remains under the attacker’s control. A final figure would require verification of both the assets taken and the effect of the freezes.
Some have also suggested a possible connection to North Korean actors, drawing comparisons with a separate $350 million Bitget exploit. No specific evidence establishing that connection has been provided. Similarities between incidents alone do not identify the people or group behind an attack.
What remains unknown
No timestamp is given for the alleged breach, freezes or market reaction, and the figures are not linked to primary statements. That makes it hard to establish the sequence of events or compare valuations from different times. Without reliable, timestamped market data, claims that the incident caused a particular market-wide decline should also be treated cautiously.
The main questions are straightforward: how was access to the wallets compromised, what assets were actually taken, how much did the freezes prevent from moving, and can the funds be recovered? Until those details are clear, both the headline loss and claims about responsibility deserve scrutiny.
Key questions and answers
-
Which Binance wallets were reportedly targeted?
Blockaid named “Binance 14” and “Binance 16.” The available information does not explain how they were compromised.
-
How much was reportedly taken?
Estimates range from $2 billion to $5.8 billion, but the listed asset values do not account for that range. The definitive total is unclear.
-
How much was reportedly frozen?
Tether and Circle reported freezes totaling roughly $2.3 billion in USDT and USDC. The precise amount, its overlap with the alleged stolen assets and the effectiveness of the freezes remain unclear.
-
Who was responsible?
No attacker has been identified. A possible DPRK connection has been suggested, but the information provided does not establish it.
What the incident underscores
Issuer freezes and lending-market pauses can limit what an attacker does with certain assets. They do not replace the need to secure wallet systems or find out how access was obtained. The response also highlights a basic tension in crypto: centralized controls can help restrict stolen funds, while decentralized assets are designed to operate without an issuer that can stop transfers.
