Stablecoin issuers Tether and Circle moved to freeze close to $1.8 billion in tokens on Wednesday after more than $2 billion in Ethereum and other assets left Binance wallets for newly created addresses in a transaction trail that investigators have linked to Tornado Cash, the sanctioned privacy protocol that obscures the origin of on-chain funds.
Binance confirmed it is looking into a possible security issue but said it has not identified any impact on user funds. The exchange has not described the episode as a confirmed hack.
According to on-chain data, the sequence began at 20:24 UTC, when an address identified as Binance 14 sent out 167,464 ETH, worth roughly $388 million at the time, alongside 63 other tokens, including about $1.6 billion in USDT. The destination address had been created that same day.
Fifteen minutes later, that same receiving address forwarded 195,460 ETH, worth approximately $450 million, to a second newly created address, while retaining around $1.5 billion in tokens, according to data from Etherscan.
Tracing the wallet that initiated the transfer, analysts found it had received three deposits of roughly 0.1 ETH each through Tornado Cash on 28 and 29 October, a pattern commonly used to fund addresses anonymously before larger movements.
Stablecoin issuers step in
Tether froze 975.1 million USDT held in the main receiving address. Circle followed shortly after, freezing 823 million USDC in the same address at 21:04 UTC. Combined, the two freezes immobilised approximately $1.8 billion.
Circle chief executive Jeremy Allaire confirmed the action in a post on X, stating that the company had frozen more than 800 million USDC tied to the incident.
For European users of both stablecoins, the episode is a reminder of how centralised issuers retain the ability to freeze funds on-chain, a feature that distinguishes USDT and USDC from fully permissionless assets and one that regulators overseeing stablecoins under the EU's MiCA framework have watched closely as exchanges and issuers coordinate responses to suspected illicit transfers.
Binance has not disclosed further details on the nature of the outflow, and it remains unclear whether the movement reflects an external compromise or an internal transfer of funds. The exchange's investigation is ongoing.
