Binance has now spoken directly
Binance has issued its first direct public acknowledgement of the suspected hot-wallet incident.
The exchange says its teams are aware of reports of a “potential security issue”, are actively investigating and that “user funds are completely safe.” It also says its security teams are urgently reviewing the available information and will publish updates through official Binance channels once facts are verified.
This is an important change in the status of the story. Until now, the strongest public acknowledgement came from CZ, who said the activity looked like a Binance hack while noting that he no longer manages Binance.com.
Is this confirmation of the hack?
It is effectively a confirmation from Binance that a serious security incident is being investigated and that the suspicious activity is not being dismissed as routine wallet management.
But Binance's wording remains deliberately cautious: “potential security issue” is not yet a completed technical confirmation of the attack vector, the affected systems or the final loss.
The exchange's statement does not currently confirm:
- the $5.60 billion cross-chain estimate published by Hyperdash;
- the full set of Ethereum, Bitcoin and Tron wallets attributed to the incident;
- how the attacker may have obtained signing access;
- how much has been frozen, recovered or remains mobile;
- or which balance sheet will absorb the loss.
What Binance is promising users
The clearest part of the announcement is the guarantee that user funds are safe. That aligns with CZ's earlier statement that he expected users to be fully covered.
This does not mean every transferred asset has already been recovered. Tether and Circle have frozen large stablecoin balances, but native BTC and ETH cannot be blacklisted by an issuer. The assurance instead indicates that Binance intends to protect customer balances regardless of the final size of the incident.
Beware of incident-related scams
Binance also warns users not to trust unofficial links, messages or requests for account information. That warning is especially important during a breaking exchange incident, when impersonation accounts and fake “recovery” pages can appear rapidly.
Users should rely only on official Binance channels and should never disclose a password, private key or seed phrase in response to a support message.
For the complete sequence of events, read Signal21's Binance hack recap and timeline, followed by the cross-chain $5.60 billion estimate.
The position now is clearer: Binance acknowledges a potential security incident and guarantees user funds, while the cause and final financial impact remain under investigation.
This is a developing story. Signal21 will update the coverage when Binance publishes verified technical details.