Billions Drain From Binance Hot Wallets in Suspected Hack as Withdrawals Pause
Billions of dollars in cryptocurrency moved from wallets labelled as belonging to Binance on Thursday, October 29, prompting concerns about a possible security breach at the world’s largest crypto exchange. Binance said it was investigating reports of a potential security issue and had not confirmed a hack or any impact on customer funds. Founder Changpeng Zhao said the activity appeared to be a hack, while saying he expected user funds to be covered.
On-chain records cited by crypto news outlets showed a wallet labelled Binance 14 transferring 167,464 ether, then valued at roughly $388 million, along with dozens of tokens to a newly created address at 20:24 UTC. The reported transfers included about $1.6 billion in USDT. A second Binance-labelled wallet sent a further 28,005 ether to the same address seconds later. The figures describe observed transfers; they do not by themselves establish that the assets were stolen or belonged to customers.
Estimates of the total vary substantially. Early reports cited about $2.5 billion in transfers, while some later tracking attributed as much as $5.5 billion or more across several networks. Other analysts put the amount lower. Binance has not confirmed a loss, and the exchange’s investigation is ongoing, so these totals remain estimates of activity linked to Binance-labelled wallets rather than a verified final loss.
The unusual transaction pattern drew additional scrutiny because on-chain researchers said the address that initiated some transfers had received funding through Tornado Cash, a cryptocurrency mixer. Analysts also pointed to the use of Ethereum’s EIP-7702 delegation feature. These details have raised questions about how the transactions were authorised, but they do not identify an attacker or prove how any access was obtained.
Stablecoin issuers moved to restrict some funds associated with the receiving address. Tether chief executive Paolo Ardoino said the company had frozen more than $1.567 billion in USDT. Circle chief executive Jeremy Allaire said Circle had frozen more than $800 million in USDC. A freeze can prevent further transfers of those tokens, but it is not the same as recovering assets or confirming the overall amount involved.
Crypto markets fell as the reports spread. Bitcoin and ether moved lower, while Binance’s BNB token also declined. The incident drew attention across decentralised finance after reports that an address linked to the activity borrowed wrapped ether using USDT as collateral. Market moves and liquidation estimates varied by source and time of reporting.
Binance later said user funds were safe, and reports said withdrawals on multiple networks were temporarily suspended as a precaution. Zhao, who no longer runs the exchange, said he expected user funds to be fully covered. No attacker has been identified publicly. The central questions remain whether the transfers were unauthorised, how they were initiated, and what amount—if any—has been lost. Binance has urged users to rely on official channels and avoid unsolicited links or requests for account information.