Massive $2 Billion Outflow From Binance Triggers Hack Fears

According to Etherscan data, over $2 billion in Ethereum (ETH) and other tokens flowed out of Binance hot wallets on Thursday, moving to an address that was created just hours earlier and had been funded via Tornado Cash. The exchange has yet to clarify if customer deposits are safe.

The funds in those wallets are owned by Binance users. Should a theft be confirmed, it would surpass the $387 million Bitget hack from September in scale. If this was merely routine maintenance, the exchange transferred its reserves using a route that closely resembles the methods hackers use to obscure their activities.

Blockchain Records Detail the Transfers

At 20:24 UTC on October 29, a single transaction shifted 167,464 ETH — valued at roughly $388 million according to Etherscan — from the wallet identified as Binance 14. The same transaction sent 63 different tokens to the recipient address, among them approximately $1.6 billion in Tether (USDT).

Just 24 seconds later, a second Binance wallet, Binance 16, transferred an additional 28,005 ETH to the same destination.

The address that received these funds was created only on Thursday. Within 15 minutes, it sent 195,460 ETH (roughly $450 million) to another newly created address, while retaining approximately $1.5 billion in various tokens.

The transfer was triggered by a wallet that had been funded exclusively via Tornado Cash, a coin-mixing service designed to obscure the origin of funds. That wallet received three deposits of about 0.1 ETH each on October 28 and 29.

Was It Theft or Routine Maintenance?

A hot wallet is an online wallet that exchanges use to process withdrawals, and it is common for exchanges to move funds between such wallets. Spreek, a pseudonymous blockchain researcher, highlighted the transfer on X (formerly Twitter).

“It COULD be routine wallet maintenance, but it looks extremely sus”

Market alert service Tree News estimated the total outflow at approximately $2.53 billion, spread across over 60 tokens, and described it as a suspected key compromise — indicating that someone other than Binance might now have control over the wallet.

There are two factors that argue against the routine maintenance explanation.

• A transfer initiated by Binance would have no need to originate from a wallet funded by a mixer.
• The recipient address immediately forwarded the funds onward, a tactic observed in the Bitget hack timeline following the theft.

Who Bears the Risk?

Binance holds user funds in these hot wallets. If a key compromise is confirmed, it would challenge whether the exchange's emergency reserve fund can cover a loss of this magnitude. Tether, the company behind USDT, has the ability to freeze tokens, which could limit the attacker's gains if it intervenes.

Binance did not reply to BeInCrypto's request for comment on the matter.

Until Binance issues a statement, the only verifiable data is on the blockchain: $2 billion sits in wallets that no one has claimed ownership of.