Billions of dollars left wallets labelled as Binance hot wallets on Thursday afternoon, prompting a scramble across crypto markets and raising fresh questions about whether customer deposits on the world’s largest exchange are at risk.
Early on-chain reports put the Ethereum-side outflow above $2 billion. Later tallies from Decrypt and Arkham Intelligence put the total closer to $5.5 billion to $5.7 billion across Ethereum, Bitcoin and Tron.
Binance has not confirmed a hack, but founder Changpeng Zhao said the activity “does look like a hack,” while stressing that he no longer runs the exchange.
At about 20:24 UTC on 29 October, a wallet Etherscan labels Binance 14 sent 167,464 ETH and dozens of tokens, including more than $1.6 billion in USDT, to a brand-new address, according to Etherscan data cited by BeInCrypto and Unchained.
Seconds later, another labelled wallet, Binance 16, sent a further 28,005 ETH to the same destination. Within minutes, much of the ether was forwarded again to yet another fresh address, a pattern researchers often associate with theft rather than routine treasury moves.
The transfer was triggered through an EIP-7702 delegation set up by an address that had been funded via Tornado Cash, a mixer that obscures the origin of coins.
Pseudonymous researcher Spreek flagged the activity on X, noting that it “could be routine wallet maintenance, but it looks extremely sus.”
Hot wallets are the internet-connected pools exchanges use to process withdrawals. Exchanges do reshuffle those balances. What raised alarms here was the mixer-seeded trigger, the brand-new receiving addresses, and the speed at which funds were pushed onward.
Binance first said on X that it was aware of reports of a “potential security issue,” was investigating, and had “not confirmed any impact to user funds.”
It later said user funds were “completely safe,” and warned customers not to trust unofficial links or requests for account details.
Zhao posted that user funds were safe and that, as a shareholder, he expected any losses to be fully covered.
Tether CEO Paolo Ardoino said the firm had frozen more than $1.57 billion in USDT linked to the incident.
Circle CEO Jeremy Allaire said Circle had frozen more than $800 million in USDC in coordination with law enforcement. Combined freezes were reported around $1.8 billion, with some later tallies higher.
Bitcoin fell toward $79,000 and BNB dropped about 7% as the news spread, CoinDesk and Decrypt reported.
CoinDesk also said the exploiter had borrowed about 20,000 wrapped ETH on Aave using stolen USDT as collateral.
If confirmed, the drain would dwarf Binance’s 2019 theft of about 7,000 bitcoin and would exceed the roughly $1.5 billion Bybit hack of February 2025.
Until Binance publishes a verified account of what happened, the hard facts remain on-chain: billions left labelled hot wallets, stablecoin issuers froze a large share of the haul, and the exchange insists customer balances are covered.
