Tether and Circle have reportedly frozen approximately $2.39 billion in combined stablecoin balances connected to a suspected security incident, while Binance separately investigates a potential security issue flagged by on-chain observers. Neither development has been officially confirmed, and the full scope of the incident remains unclear.

The Reported Stablecoin Freezes

Tether, the issuer of USDT, and Circle, the issuer of USDC, each hold the technical capability to blacklist wallet addresses and freeze token balances at the smart contract level. That direct, issuer-level control is a defining feature of fiat-backed stablecoins and distinguishes them from most other digital assets. With USDT and USDC ranking as the two largest such tokens by circulating supply, the issuers' blacklisting authority covers a substantial share of on-chain dollar liquidity. According to reports, the two issuers exercised that authority against roughly $2.39 billion in combined stablecoin balances believed to be linked to the suspected incident.

A freeze of this kind renders the affected tokens non-transferable unless the blacklist entry is reversed, effectively immobilizing the funds.

Tether has deployed its blacklisting mechanism in previous incidents involving exchange outflows, including cases in which USDT wallets were blacklisted following suspicious outflows from CoinDCX. The scale of the current reported freeze, however, is substantially larger than those earlier actions.

Binance's Security Probe

Binance is separately reported to be investigating a potential security issue after on-chain watchers flagged activity consistent with a Binance hot wallet being drained by a wallet with links to Tornado Cash, according to CryptoSlate reporting. Hot wallets are internet-connected wallets that exchanges use to hold immediately accessible funds for withdrawals and trading liquidity, which makes them a standard focal point in exchange security incidents.

Tornado Cash is a crypto mixing protocol that obscures the origin and destination of on-chain transfers. Its appearance in a transaction trail is a standard indicator investigators rely on when tracing suspected theft proceeds. The protocol was sanctioned by the U.S. Treasury in August 2022, a designation the Treasury lifted in March 2025 following a federal court ruling.

The two developments should be understood as parallel but distinct. The stablecoin freeze by Tether and Circle constitutes a proactive asset-protection measure. Binance's investigation is a separate inquiry into whether the exchange itself experienced a security event. As currently reported, neither action confirms the other.

What Remains Unknown

Confirmation, Scope, and Attribution

The incident is described as a suspected hack, and Binance's issue is characterized as potential. No official confirmation of a breach has been published, no attacker has been identified, and no losses have been formally quantified.

Critically, the $2.39 billion figure refers to the volume of stablecoins reportedly frozen, not a confirmed theft amount, and the two numbers should not be treated as equivalent.

On-chain analysis can flag suspicious wallet movements and trace fund flows through mixers, but it cannot independently confirm that a given exchange was compromised. Attribution in crypto security incidents typically requires forensic investigation that extends well beyond the initial on-chain signals, and conclusions drawn too early in that process have previously proven inaccurate.

Frozen Funds and Customer Impact

Whether any Binance customers have been directly affected, whether withdrawals have been restricted, and whether the exchange has issued guidance to users all remained open questions at the time of publication.

Frozen stablecoins sitting in wallets that do not belong to actual hack victims could complicate recovery efforts if the freeze was applied broadly across connected addresses rather than narrowly targeted at confirmed bad actors. The security community has grown increasingly attentive to large-scale freeze actions as a double-edged tool: effective at halting fund movement, but potentially disruptive when applied at scale to wallets that may include legitimate participants caught in the blast radius of a wide blacklist.

Observers tracking the incident should watch for official statements from Binance, Tether, and Circle. Those disclosures will form the appropriate basis for any further conclusions about the scope and impact of the event.

Until official statements from the parties involved confirm the nature, size, and origin of the incident, the $2.39 billion figure and the Binance probe should be treated as reported, not verified. The mechanisms invoked, stablecoin blacklisting and exchange-level security investigation, are real and documented tools, but the underlying facts that triggered them remain under active investigation.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.