Binance Drained of $5.57 Billion in Suspected Hack: Attacker Swaps Into Ethereum That Nobody Can Freeze
Crypto spent eighteen years selling "trustless." Today a $5.57 billion question re-examined that claim.
Three key facts
At least $5.57 billion left Binance-linked wallets across Ethereum, Bitcoin, and Tron. According to Decrypt citing on-chain records: $3.51 billion on Ethereum, $1.44 billion in 18,270 BTC, and $630 million on Tron. The first Ethereum transaction at 20:24 UTC sent 167,464 ETH plus 63 token transfers to a brand-new address. Binance says it is aware of a "potential security issue and is actively investigating," but has "not confirmed any impact to user funds."
Stablecoin issuers froze funds fast — but only part of them. Tether froze 975.1 million USDT and Circle froze 823 million USDC in the main receiving wallet, about $1.8 billion combined. With Ripple freezing about $200 million in RLUSD, per Binance co-CEO Yi He, the total frozen tops $2 billion.
The attacker is converting freezable money into money nobody can freeze. On-chain records for 10 wallets, eight labeled as exploiters, show swaps through decentralized exchanges like Uniswap — one relay wallet received 20,940 ETH (about $45.58 million) from the UniswapX contract — and borrowing 19,762 ETH on Aave against about $60 million in USDT. The report says neither app shows signs of a flaw. As of 22:07 UTC, about 253,000 ETH (roughly $570 million) sat in two wallets with no outgoing transfers.
Wang Dou's Take
The most interesting thing here isn't the amount; it's how completely it flips both the "centralized" and "decentralized" narratives face-up.
Start with the freeze. Tether presses a key and 975 million USDT stops moving. That is exactly the power crypto purists hate most — and today it saved $1.8 billion. You spend all year cursing it for being "centralized and able to freeze at will," and the moment something breaks you want it to freeze faster. These are two sides of one capability; you can't separate them.
Then the escape. The first thing the attacker did after getting the money was swap USDT for ETH. Why? Because USDT has an issuer who can freeze it; ETH has none, so nobody can press that key. That's also why decentralized exchanges became the "exit" in this incident — they have no authority to pause and no support line to call. "Censorship resistance," when it's being used to launder, works exactly like this.
Third, and most worth watching: Binance said it "has not confirmed any impact to user funds." That line is nearly inevitable early in an incident, because it buys time — neither denying nor admitting. But on-chain data doesn't wait for press releases. When $5.5 billion moves across three networks and the only plausible source is hot wallets, the market has already voted: bitcoin fell below $79,000, BNB dropped about 7%, and Monero rose about 6% — everyone was solving the same equation, and the answer was in the prices.