Tether has frozen more than 1.567 billion USDT connected to what on-chain analysts are flagging as a possible exploit of Binance. The freeze followed roughly $3.3 billion in outflows from two Binance hot wallets on Ethereum on October 29, 2026. Binance has not confirmed a breach or any actual loss.

Tether and Circle moved within about an hour to lock up the stablecoins after the funds drained from the exchange's Ethereum hot wallets, according to on-chain data.

Forty Minutes, Billions of Dollars

The outflows unfolded quickly. The large transfers occurred between 20:24 and 21:04 UTC — a window of roughly 40 minutes — as funds moved out of two hot wallets on the Ethereum network.

Etherscan and a number of on-chain analysts flagged the receiving addresses, labeling them as associated with a potential hack or exploit.

Tether responded by blacklisting the wallets tied to the outflow. Reports noted an initial freeze of around $971 million, with the total later rising to more than 1.567 billion USDT.

Blacklisting works much like a bank cancelling a stolen card: the tokens still sit at the address, but the issuer blocks them from being sent anywhere.

Circle took similar action on its side. The USDC issuer froze approximately $823 million in USDC linked to the same activity. Taken together, the two issuers immobilized somewhere between $1.8 billion and $2.4 billion in stablecoins, and the freezes reportedly landed within about an hour of the outflows being detected.

Roughly $700 Million Slipped Through

Not everything was caught. Around $700 million in USDT and ETH reportedly moved before the blacklisting took effect or outside its reach.

ETH presents a different challenge, since it has no central issuer that can flip a switch. Once it leaves a wallet, there is no off button, which makes that slice of the funds a distinct problem entirely. The USDT portion of that total can still be immobilized if it lands on a newly flagged address; the ETH cannot. Either way, the trail remains visible on public blockchains, even where no one can reverse it.

What Binance and CZ Are Saying

Binance says it is investigating the incident. The exchange has not confirmed that a hack took place or that any user funds were lost.

Former Binance CEO Changpeng Zhao indicated the incident resembled a hack, while asserting that user funds were secure and that full coverage was expected.

For now, the hack characterization rests on third-party on-chain labeling rather than any statement from Binance itself, and the coverage claim remains an assertion pending confirmation. The exchange's ongoing investigation is the thread to watch for a definitive account of what happened.

Why the Freeze Matters

The speed of the response is the headline within the headline. Tether and Circle acted within roughly an hour of the outflows surfacing on-chain.

The episode also highlights a tension that never quite goes away in the stablecoin sector: stablecoins run on public blockchains, but their issuers retain the power to freeze balances at will.

What This Means for Traders and Exchanges

Hot wallets are the connected, always-online accounts exchanges use to process withdrawals, which makes them convenient and exposed at the same time.

For stablecoin issuers, the event is something of a stress test that went their way, at least partially. Tether and Circle demonstrated they can act quickly when addresses get flagged.

The roughly $700 million that reportedly slipped through is the asterisk. It shows the limits of issuer-level freezes when attackers move fast or route funds into assets no one can blacklist.

For now, roughly $1.8 billion to $2.4 billion in stablecoins sits frozen on-chain — visible to everyone, and usable by no one.