On October 29, 2026, over 2 billion dollars in Ethereum and tokens left the hot wallets of Binance, triggering security reports across crypto markets as analysts and executives questioned whether the exchange was facing a security issue.
The Bottom Line
- On-chain data revealed that massive multi-token outflows, estimated by various analysts between 2.5 billion and 5.5 billion dollars, departed Binance hot wallets toward newly created addresses funded via Tornado Cash.
- Changpeng Zhao stated on X that the transfers looked like a hack, while stablecoin issuers Tether and Circle moved to freeze billions of dollars in associated assets.
- Bitcoin retreated roughly 2.6% over a 24-hour window, testing market confidence while comparing against historical incidents like the Bybit security breach.
Tracing the Blockchain Outflows from Binance Hot Wallets
The movement of assets began late Thursday when automated trackers flagged massive transactions leaving infrastructure linked to the exchange. According to on-chain data cited by BeInCrypto, a wallet identified as Binance 14 initiated a transfer of 167,464 Ethereum alongside millions in Tether and other tokens. Seconds later, a second hot wallet, Binance 16, routed an additional 28,005 Ethereum to the same destination address. Independent tracking published by Decrypt estimated that total multi-chain outflows across Ethereum, Bitcoin, and Tron reached approximately 5.57 billion dollars, though official figures from the platform remained unverified.
The recipient address possessed no prior transactional history and had been financed exclusively through Tornado Cash, a protocol designed to obscure transaction trails. Within fifteen minutes of receipt, the funds were splintered across multiple new addresses. Security analysts noted that this dispersal pattern mirrored the post-theft movements observed during the Bybit breach in February 2025. Darkfost, an analyst verified by CryptoQuant, pointed out that the Ethereum wallet may have been configured with an EIP-7702 delegation, allowing an account to execute contract code that acts as a drainer across inventory.
| Blockchain Network | Estimated Outflow Volume | Key Frozen Assets |
|---|---|---|
| Ethereum | Billions in tokens | Tether (USDT) / USD Coin (USDC) |
| Bitcoin | Significant volume | None (Unfreezable network) |
| Tron | Portion of outflows | Frozen stablecoin balances |
Emergency Freezes and Official Industry Responses
As market panic spread, major stablecoin operators intervened to mitigate the damage. Tether CEO Paolo Ardoino announced that his firm had frozen more than 1.567 billion USDT connected to the transfers. Concurrently, Circle CEO Jeremy Allaire confirmed that his company locked over 800 million USDC associated with the security incident. Because assets like Bitcoin and Ethereum cannot be frozen at the protocol level in the same manner as centralized stablecoins, the burden of absorbing unrecoverable losses fell back onto exchange reserves or emergency funds.
Initially, Binance stated that its teams were aware of reports of a potential security issue and were actively investigating, emphasizing that user funds were completely safe. However, early Friday morning on October 30, Changpeng Zhao posted on X that the transfer indeed looked like a hack, while maintaining expectations that user balances would be fully covered. The platform’s emergency SAFU reserve previously stepped in to replenish 7,000 bitcoins following a security breach in May 2019, providing an operational precedent for handling large-scale fund remediation.
Market Reaction and Competitor Price Action
Digital asset markets absorbed the news with localized corrections rather than systemic liquidation. Bitcoin dipped approximately 2.6% over 24 hours, slipping below the 79,000 dollar threshold, while BNB fell around 7% to approximately 699 dollars according to Decrypt. Against total platform assets, the initial capital loss represented a fractional percentage of holdings, provided customer withdrawals remained fully operational.
Traders weighed the potential for prolonged selling pressure if the alleged attacker attempts to liquidate significant holdings of unfreezeable assets like Ethereum. Approximately 195,460 Ethereum sat in the primary attacker address, creating a lingering supply overhang that analysts suggested could test short-term market depth. Despite the uncertainty, overall macroeconomic stability remained anchored by swift containment measures from stablecoin issuers and assurances from exchange leadership regarding customer solvency.
