More than $2 billion in Ethereum (ETH) and tokens left Binance hot wallets on Thursday for an address created hours earlier and funded through Tornado Cash, Etherscan data shows. Binance has not said whether customer deposits are at risk.
The money in those wallets belongs to Binance users, and a confirmed theft would dwarf the $387 million Bitget hack in September. If it was routine housekeeping, the exchange moved its reserves along a path that mirrors how hackers cover their tracks.
What the blockchain shows
At 20:24 UTC on October 29, one transaction moved 167,464 ETH, worth about $388 million by Etherscan’s valuation, out of the wallet labeled Binance 14. It also pushed 63 tokens to the receiving address, including roughly $1.6 billion in Tether (USDT).
A second exchange wallet, Binance 16, sent another 28,005 ETH to the same address 24 seconds later.
The receiving address did not exist before Thursday. Within 15 minutes it forwarded 195,460 ETH, around $450 million, to yet another fresh address while still holding about $1.5 billion in tokens.
The transfer was triggered by a wallet funded only through Tornado Cash, a mixing service that hides where coins come from. That wallet took three deposits of roughly 0.1 ETH on October 28 and 29.
Theft or housekeeping?
A hot wallet is one an exchange keeps online to pay withdrawals, and exchanges do shuffle funds between them. Spreek, a pseudonymous on-chain researcher, flagged the transfer on X.
“It COULD be routine wallet maintenance, but it looks extremely sus”
Tree News, a market alert feed, put the outflow at about $2.53 billion across more than 60 tokens and labeled it a suspected key compromise, meaning someone other than Binance may control the wallet.
Two details weigh against the maintenance reading. A Binance-run transfer has no reason to start from a mixer-seeded wallet. The receiving address also split the funds onward at once, a pattern seen in the Bitget hack timeline after the stolen coins moved.
Whose money is on the line
Binance keeps customer assets in these wallets, so a confirmed key compromise would test whether its emergency reserve fund can absorb a loss this size.
A Binance spokesperson told BeInCrypto by email that the exchange is “aware of reports of a potential security issue” and is investigating, adding that it has “not confirmed any impact to user funds” and will post updates through official channels.
Update (October 30, 00:30 UTC): Binance founder Changpeng Zhao said on X that the transfer “does look like a hack on Binance” and that he expects user funds to be fully covered. Tether chief executive Paolo Ardoino said the firm froze more than 1.567 billion USDT linked to the incident, and Zhao put Circle’s USDC freeze near $823 million. Users have also reported withdrawals stuck at processing.
Source: BeInCrypto