Report Points to Possible Exploit of Binance-Linked Wallet Amid Conflicting Estimates of Frozen Assets
Key Facts
A Cointelegraph report headline available in the news feed described a Binance-linked wallet as facing a possible exploit, a warning that does not confirm a breach. The report’s details could not be verified, and no official statement confirming the incident was found. Available information also does not establish that the wallet is directly owned by the exchange or operates on the Ethereum network. There is no reliable confirmation of the total funds that may have been affected or of any assets frozen in connection with the incident. The event therefore remains a suspected incident, not the confirmed breach described in the initial draft.
Earlier news headlines in EL7’s internal log dated October 29 show differing estimates of frozen assets: $1.79 billion, $1.8 billion and $1.567 billion in USDT. But those headlines alone do not establish the accuracy of any figure or its link to the suspected incident. The available material does not support a claim that Tether and Circle jointly froze a specific total. Nor is it enough to establish that the assets cited were frozen to prevent an attacker from moving them. Accordingly, the figures in circulation cannot be presented as a confirmed tally for the incident.
Against the backdrop of the relationship between the two companies, Circle and Binance announced on September 22, 2026, that they had expanded their commercial partnership for five years. Circle said Binance invested $100 million in it as part of the agreement. The announcement places the companies in a publicly disclosed commercial relationship, but does not establish a connection between the agreement and any possible action to freeze assets. It also does not establish that Circle took action involving a Binance-linked wallet in the reported incident. The announcement provides background on the relationship between the parties, not confirmation of the security incident.
Circle says that adding an address to a blocklist prevents it from sending or receiving USDC or EURC. But the company says completed stablecoin transactions are irreversible and that it cannot recover a transfer that has already been completed. A block therefore restricts subsequent transactions involving the address but does not automatically return funds transferred earlier. The company says it may lift a block when the security incident no longer warrants restricting the address. This means that whether a restriction remains in place or is lifted depends on developments in the security incident and related restrictions, without confirming that this policy has been applied to the current incident.
Binance previously disclosed a hack of its hot wallet on May 7, 2019, in which it said attackers withdrew 7,000 bitcoin in a single transaction. The exchange said at the time that the hot wallet held about 2% of its total bitcoin holdings. It added that its other wallets were unaffected. After the incident, Binance said it needed about a week to conduct a comprehensive security review. It announced that deposits and withdrawals would remain suspended during the review; those details concern the 2019 incident and do not establish a link to the current suspicion.
Binance said in January 2026 that its Secure Asset Fund for Users, or SAFU, held 1 billion USDC, while retaining full discretion to determine which types of losses and claims qualify for recovery from it. The announcement describes the fund’s size and the eligibility rules the exchange said it applies, but does not establish whether any losses related to the reported incident would meet those rules. The available information contains no official confirmation of a breach or of losses eligible for compensation. There are also no documented details on when a new update on the investigation or potentially restricted assets may be issued.