Spokesperson Ross O'Leary told TechCrunch the pause is precautionary, and co-CEO Yi He said withdrawals will stay disabled until the environment is confirmed secure.
Binance says user funds are safe and has pointed to an emergency fund to cover users if a major loss occurs.
It has not confirmed how much was taken.
Kairos Research and a Coinbase director put the outflows at roughly $5.7 billion to $5.8 billion across Ethereum, Bitcoin and Tron, mostly from hot wallets, which are internet-connected wallets used for day-to-day holdings.
Stablecoin issuers, whose tokens are pegged to the dollar and can be frozen by their issuers, moved quickly.
Tether said on Oct.
29 that it froze more than $1.567 billion in USDT, and Circle froze about $823 million in USDC while coordinating with law enforcement.
Ripple reportedly froze about $200 million, World Liberty Financial restricted $27 million in USD1, and Paxos froze PAX Gold tokens worth more than $8 million, bringing reported freezes above $2.6 billion.
Still, about $850 million in ETH was reportedly moving between newly created wallets, which raises questions about how much can be recovered.
Kairos Research said the suspicious activity began at 4:20 p.m. ET, when an external address used Ethereum's EIP-7702 account-delegation mechanism to attach executable code to a Binance hot wallet. Other transfers included 28,000 ETH, 18,270 BTC and 613 million USDT on Tron. The firm said the suspected attacker also deposited $60 million in USDT into the lending protocol Aave and borrowed about 19,800 ETH, after which Aave froze its DAO-operated markets to stop new deposits and borrowing; Aave said its contracts are unaffected and users can still withdraw and repay. Who is responsible is unclear. Founder Changpeng Zhao, who no longer runs Binance but remains its largest shareholder, wrote on X that it looks like a hack and that he expects all user funds to be covered. Binance.us, the separate US platform, says it is operating normally, and Binance warns users to beware of scams and to rely on official channels. Separately, Polymarket briefly halted trading and withdrawals after a third-party tool, identified by researchers as DebugBear, was compromised, with about $2 million reportedly stolen; the incidents appear unrelated.
