The short answer
The evidence now strongly suggests that Binance hot wallets were hacked, but Binance has not yet published a technical post-mortem or a final loss figure.
The incident began with more than $2 billion moving from Binance-labelled Ethereum wallets to a newly created address. CZ later said it “does look like a hack on Binance,” while adding that he expected user funds to be fully covered.
What is confirmed
- Large crypto transfers left wallets publicly labelled as belonging to Binance.
- Tether and Circle blacklisted stablecoins held by the primary recipient; the issuer transactions are visible on-chain.
- CZ publicly described the event as looking like a Binance hack and said users should be safe.
- Aave lending markets were reportedly frozen as a precaution to stop the suspected attacker from borrowing against the transferred assets. There is no indication that Aave itself was hacked.
What is not confirmed yet
- The exact attack vector or compromised signing system.
- Binance's final realised loss and the complete list of affected wallets.
- Whether every movement included in the $5.60 billion Hyperdash estimate represents stolen funds.
- How much has been frozen, recovered, returned or remains under Binance control.
The $5.60 billion figure covers assets attributed across Ethereum, Bitcoin and Tron. It is the largest current analytics estimate, but it is not yet an official Binance total.
The full Signal21 timeline
- Initial alert: more than $2 billion leaves Binance hot wallets
- CZ says it looks like a hack as Tether and Circle freeze funds
- Hyperdash raises the cross-chain estimate to $5.60 billion
- Aave reportedly freezes lending markets as a defensive measure
What users should do now
Follow Binance's official channels, be highly suspicious of “refund” links or support messages, and never share a seed phrase or private key. There is currently no verified instruction requiring users to move funds through a third-party recovery page.
The most accurate conclusion for now is simple: a hack is highly likely; its true size and mechanism are still being established.
This is a developing story. Signal21 will update the timeline when Binance publishes an official incident report.