The alert has moved into a new phase
The first wave of evidence was unusual but incomplete: more than $2 billion in ETH and tokens had left wallets labelled Binance, the destination was new, and part of the gas trail was linked to a privacy service. Those facts justified an alert, but not a declaration that Binance had been hacked.
That distinction has now narrowed.
Changpeng Zhao, Binance's founder and a shareholder, wrote that user funds are safe and that the activity “does look like a hack on Binance.” He also thanked Tether and Circle for freezing approximately $971 million and $823 million respectively, and said he expects users to be fully covered.
CZ was careful to add that he no longer manages Binance.com. His post is therefore a significant statement from a founder and shareholder, not an incident report from Binance's current management.
What the chain confirms
Signal21 independently queried the Ethereum contracts for USDT and USDC. At publication time, the main recipient address was blacklisted by both issuers.
The wallet held approximately:
- $975.1 million USDT
- $823 million USDC
The exact blacklist transactions are public. Tether added the address to its blacklist in transaction 0x7baba4…8659, and Circle blacklisted it in transaction 0xc954c8…fc5f.
This is strong evidence that the two issuers treated the destination as compromised or otherwise subject to an emergency freeze. It does not, by itself, identify the attack path or prove the final loss.
Frozen is not the same as recovered
The approximately $1.8 billion in USDT and USDC cannot currently be transferred by the recipient. That is containment, not necessarily recovery.
Issuer-controlled stablecoins can be blacklisted, and in some circumstances reissued or destroyed under the issuer's procedures. Native ETH is different: no company can freeze it at the token-contract level. Any ETH already moved to other addresses remains a separate recovery problem.
The gap between CZ's roughly $971 million USDT figure and the wallet's approximately $975.1 million balance at our check likely reflects timing and additional transfers. The live contract balance is the more current figure, but it may continue to change.
“User funds are safe” needs a balance sheet behind it
There is no contradiction between an exchange suffering a hack and its customers remaining whole. The decisive questions are whether Binance still controls enough reserves, whether it uses its SAFU emergency fund or corporate capital, and whether withdrawals continue to clear normally.
CZ says he expects full coverage. Until Binance's current management publishes a formal incident statement and post-mortem, that remains an expectation rather than a completed reimbursement plan.
What we still do not know
The central questions remain open:
- Which signing system, wallet service or internal control failed?
- How much ETH and how many other assets remain outside issuer freezes?
- Did the incident affect only Binance-controlled inventory, customer liabilities, or both?
- Will Binance identify the destination and publish a final accounting?
The story is no longer merely about a suspicious transfer. The stablecoin freezes and CZ's statement make a security incident the leading explanation. The technical cause and final economic loss are still unconfirmed.
For the transaction sequence and the alternative explanations considered before this update, read Signal21's initial on-chain alert.
This is a developing story. Signal21 will update the facts as Binance, Tether, Circle or independent forensic teams publish verifiable information.