More than $2 billion worth of Ethereum (ETH) and various tokens departed Binance hot wallets toward an address created hours earlier and funded via Tornado Cash, according to Etherscan blockchain data. While Binance initially withheld confirmation regarding whether customer deposits faced immediate risk, the scale of the movement ignited intense speculation across the cryptocurrency community regarding a potential security breach.
Because exchange hot wallets hold customer assets, a confirmed theft or key compromise would severely test whether emergency reserve funds can absorb a loss of this magnitude. A confirmed incident would also dramatically overshadow the $387 million Bitget security breach from September. Conversely, if the transfer constituted routine exchange housekeeping, critics noted that the asset migration followed a path mirroring methods used by hackers to obscure transaction tracks.
Blockchain analysis reveals suspicious routing
At 20:24 UTC on October 29, an initial transaction transferred 167,464 ETH, valued at approximately $388 million according to Etherscan valuations, out of the wallet designated as Binance 14. The transfer also pushed 63 distinct tokens to the receiving address, including roughly $1.6 billion in Tether (USDT). Just 24 seconds later, a second exchange wallet, Binance 16, transmitted an additional 28,005 ETH to the exact same destination.
The receiving address was newly created on Thursday. Within 15 minutes of receipt, it forwarded 195,460 ETH, valued at around $450 million, to another fresh address while continuing to hold roughly $1.5 billion in tokens. Crucially, the transfer was initiated by a wallet funded solely through Tornado Cash, a privacy mixer designed to obscure coin origins, which had received three deposits of approximately 0.1 ETH on October 28 and 29.
Pseudonymous on-chain researcher Spreek flagged the movement on social media, noting that while routine wallet maintenance remained a theoretical possibility, the transaction pattern appeared extremely suspicious. Market alert feed Tree News estimated total outflows at approximately $2.53 billion across more than 60 tokens, categorizing the event as a suspected private key compromise where unauthorized entities gained control of exchange wallets. Analysts emphasized that a legitimate internal transfer by Binance would have no operational reason to originate from a mixer-funded address, nor would it immediately split funds onward in a manner identical to the Bitget exploit timeline.
Leadership statements and asset freezes
Addressing the unfolding crisis, a Binance spokesperson confirmed via email that the exchange was actively investigating reports of a potential security issue, adding that no impact on user funds had been officially confirmed and that updates would follow through official channels.
Subsequent updates brought starker assessments. Binance founder Changpeng Zhao posted on X stating that the transfer “does look like a hack on Binance” while expressing expectation that user funds would be fully covered. Concurrently, Tether chief executive Paolo Ardoino announced that the firm had successfully frozen more than 1.567 billion USDT linked to the incident, while Zhao indicated that Circle had frozen approximately $823 million in USDC. Amid the uncertainty, users across the platform reported processing delays with digital asset withdrawals.
