CoinTrust

Binance $6.3B Hack Triggers Crypto Sell-Off as Tether Freezes Funds

Binance

The cryptocurrency market came under heavy selling pressure on Friday after a suspected $6.3 billion security breach at Binance triggered fresh concerns about exchange security and investor confidence. Bitcoin fell more than 3% over 24 hours to approximately $77,400, after briefly approaching $76,000. Ether, BNB, XRP and Solana recorded steeper declines as investors reassessed the risks associated with centralized trading platforms.

The incident also prompted major stablecoin issuers to freeze billions of dollars in assets potentially connected to the attack. Meanwhile, Standard Chartered warned that cryptocurrency prices could face further declines as investigators work to establish the full extent of the breach.

Tether and Circle Freeze Billions in Suspected Stolen Assets

Stablecoin issuers moved quickly to limit the movement of potentially compromised funds. Tether Chief Executive Paolo Ardoino reported that the company had frozen more than $1.567 billion in USDT associated with the suspected Binance incident.

Circle Chief Executive Jeremy Allaire separately disclosed that the company had frozen more than $800 million in USDC in coordination with law enforcement authorities. Circle also indicated that it would continue assisting investigators.

First Digital Chief Executive Vincent Chok confirmed that FDUSD stolen in the attack had also been frozen. The company was monitoring developments and coordinating with Binance to protect token holders and prevent the movement of stolen funds.

Blockchain investigator ZachXBT estimated that more than $2.83 billion had been frozen across blockchain networks, primarily involving USDT and USDC. His investigation identified approximately 1,175.5 million USDT and 823 million USDC frozen at the attacker’s primary address.

EIP-7702 Exploit Raises Questions About Binance Security

The suspected attack reportedly targeted Binance’s hot wallet, identified as Binance 14. Blockchain analysis indicated that the attacker submitted a transaction containing 50 EIP-7702 authorizations, with one successfully executed.


The authorization mechanism, introduced through Ethereum‘s Pectra upgrade, allows externally owned wallets to delegate certain control functions to smart contracts. The attacker reportedly used this capability to associate the targeted wallet with an external contract, enabling unauthorized transfers.

Investigators suggested that the attacker submitted multiple authorizations because the wallet’s transaction nonce was changing as withdrawals continued. One authorization succeeded, allowing the attacker to execute the operation.

The incident highlights a significant security risk involving wallet-signing permissions, as access to a wallet’s signing key could potentially allow attackers to redirect substantial balances through a single transaction.


Binance reportedly traced the incident to a compromised engineer’s laptop, which may have provided access to an internal service environment. The exchange said it had found no evidence of a private-key leak.

Blockchain analytics firm TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group, based on its investigation. The firm estimated that approximately $6.36 billion had been transferred from Binance wallets across 10 blockchains, with most of the movement occurring within about 20 minutes.

Binance co-founder Yi He indicated that the company would cover customer losses using its Secure Asset Fund for Users (SAFU) and corporate resources. Deposits and withdrawals remained suspended pending further security assessments.


Standard Chartered Warns of Further Crypto Declines

Standard Chartered’s Global Head of Digital Assets Research, Geoffrey Kendrick, warned that the market could experience additional downside as uncertainty surrounding the incident persists.

He indicated that investors might remain cautious until frozen assets are addressed and investigators provide greater clarity about the attack. The simultaneous security concerns at Binance and decentralized betting platform Polymarket, which reportedly suspended international trading after hackers stole more than $2.6 million from user accounts, added to negative market sentiment.


Kendrick also suggested that the Binance incident could accelerate a longer-term shift toward decentralized exchanges. He maintained a bullish long-term outlook for Uniswap and retained his $100 UNI price target for 2030, arguing that security concerns surrounding centralized exchanges could encourage greater decentralized trading activity.

DeFi Tokens Fall Despite Growing Interest in Decentralized Exchanges

Despite the potential long-term benefits for decentralized trading platforms, their tokens also experienced selling pressure. Uniswap’s UNI declined more than 3%, while Aster, Pump.fun’s PUMP, Jupiter’s JUP, and Litentry’s LIT also traded lower.


Hyperliquid’s HYPE was a notable exception, gaining approximately 15% after Intercontinental Exchange, the parent company of the New York Stock Exchange, announced a partnership with Trade.xyz to introduce Hyperliquid-powered perpetual futures trading in the United States, subject to regulatory approval.

Meanwhile, leveraged cryptocurrency traders faced substantial losses. Total market liquidations reached approximately $1.5 billion, with long positions accounting for most of the damage. Bitcoin-related liquidations totaled $468 million, while Ether accounted for another $358 million.

The Binance incident could have broader implications for cryptocurrency exchange security, institutional confidence, and the industry’s transition toward decentralized financial infrastructure.

For Ethereum, the attacker was reportedly left holding approximately 197,460 ETH, alongside borrowed wrapped Ether and smaller token balances. The remaining assets were estimated at roughly $600 million, although the full distribution of funds across networks remained under investigation.

The immediate priority for Binance is to complete its investigation, strengthen internal security controls, and restore normal deposits and withdrawals. The incident is also likely to increase scrutiny of wallet authorization procedures and transaction-signing infrastructure across the broader cryptocurrency industry.

Exit mobile version