On Thursday afternoon, a massive outflow of digital assets from wallets associated with Binance, the world's largest cryptocurrency exchange, triggered widespread concern across the market. On-chain data indicated that over $5.5 billion moved from these hot wallets, with early estimates focusing on an Ethereum-side transfer exceeding $2 billion. Later tallies from Decrypt and Arkham Intelligence suggested the total could be as high as $5.7 billion across Ethereum, Bitcoin, and Tron.
Binance has not confirmed a security breach, but the unusual pattern of transactions has raised alarms. Founder Changpeng Zhao acknowledged that the activity "does look like a hack," though he emphasized he no longer runs the exchange. The company stated it is investigating the matter and assured users that their funds are "completely safe."
Blockchain Activity Raises Suspicions
The first notable transaction occurred at approximately 20:24 UTC on 29 October, when a wallet labeled Binance 14 sent 167,464 ETH and numerous tokens, including over $1.6 billion in USDT, to a newly created address. Shortly thereafter, another labeled wallet, Binance 16, transferred an additional 28,005 ETH to the same destination. Within minutes, much of the ether was forwarded again to another fresh address—a pattern that security researchers often associate with theft rather than routine treasury management.
The transfer was initiated through an EIP-7702 delegation set up by an address that had been funded via Tornado Cash, a privacy mixer that obscures the origin of coins. Pseudonymous researcher Spreek flagged the activity on X, noting that it "could be routine wallet maintenance, but it looks extremely sus."
Hot wallets are internet-connected pools that exchanges use to process withdrawals, and reshuffling balances is not uncommon. However, the combination of a mixer-seeded trigger, brand-new receiving addresses, and the rapid onward movement of funds made this event stand out.
Stablecoin Issuers Freeze Funds
In response to the incident, Tether and Circle moved to freeze assets linked to the receiving wallets. Tether CEO Paolo Ardoino announced that the firm had frozen more than $1.57 billion in USDT connected to the incident. Circle CEO Jeremy Allaire stated that Circle had frozen over $800 million in USDC in coordination with law enforcement. Combined, the freezes were reported around $1.8 billion, with some later tallies higher.
Market Impact and Comparisons
The news sent ripples through the crypto market. Bitcoin fell toward $79,000, and BNB dropped about 7% as the story spread, according to CoinDesk and Decrypt. CoinDesk also reported that the exploiter had borrowed approximately 20,000 wrapped ETH on Aave using stolen USDT as collateral.
If confirmed, this drain would dwarf Binance's 2019 theft of about 7,000 bitcoin and exceed the roughly $1.5 billion Bybit hack of February 2025. The scale of the potential loss underscores the ongoing risks in the crypto ecosystem.
Until Binance publishes a verified account of what happened, the hard facts remain on-chain: billions left labeled hot wallets, stablecoin issuers froze a large share of the haul, and the exchange insists customer balances are covered.
This article is for informational purposes only and does not constitute financial advice.
