Estimates range from about $3.3 billion to roughly $5.8 billion, with Kairos Research putting the figure near $5.7 billion.
Binance has not confirmed the total or formally confirmed a hack.
Co-founder Yi He said the company is urgently investigating and that withdrawals are disabled until the environment is confirmed secure.
She also pointed to an emergency fund that could cover users if a major loss occurs, and told users to ignore unofficial links and requests for account information.
Tether CEO Paolo Ardoino said more than $1.567 billion in USDT was frozen, and Circle froze about $823 million in USDC while coordinating with law enforcement, according to CEO Jeremy Allaire.
Ripple reportedly froze about $200 million, World Liberty Financial restricted $27 million in USD1, and Paxos froze PAX Gold tokens worth over $8 million.
Together the reported freezes exceed $2.6 billion, a substantial share of the roughly $6 billion that reportedly left Binance-linked wallets.
If confirmed as a hack, it would be the largest crypto theft on record, surpassing last year's $1.5 billion ByBit attack, which was later blamed on North Korean hackers.
Former CEO Changpeng Zhao, who says he no longer manages the exchange, said it looks like a hack and that, as a shareholder, he expects all user funds to be fully covered.
Kairos Research said the activity began at 4:20 p.m. ET, when an external address used Ethereum's EIP-7702 account-delegation mechanism to attach executable code to a Binance hot wallet. Assets then moved, including 28,000 ETH, 18,270 BTC and 613 million USDT on Tron. The firm said the suspected attacker kept moving funds after the first freezes, deposited $60 million in USDT into Aave and borrowed about 19,800 ETH. Aave then froze its DAO-operated markets as a precaution, saying its contracts are unaffected and users can still withdraw and repay. About $850 million in ETH was reportedly still moving between new wallets, which raises questions about how much can be recovered. The apparent breach seems to affect only Binance.com, not Binance.us. Separately, prediction market Polymarket had user funds drained through a compromised third-party provider, which Hudson Rock identified as web performance service DebugBear.
