Is Binance Being Hacked? $2 Billion Outflow Puts Customer Funds in Question

More than $2 billion in Ethereum (ETH) and tokens left Binance hot wallets on Thursday for an address created hours earlier and funded through Tornado Cash, Etherscan data shows. Binance has not said whether customer deposits are at risk.

The money in those wallets belongs to Binance users, and a confirmed theft would dwarf the $387 million Bitget hack in September. If it was routine housekeeping, the exchange moved its reserves along a path that mirrors how hackers cover their tracks.

What the blockchain shows

At 20:24 UTC on October 29, one transaction moved 167,464 ETH, worth about $388 million by Etherscan’s valuation, out of the wallet labeled Binance 14. It also pushed 63 tokens to the receiving address, including roughly $1.6 billion in Tether (USDT).

A second exchange wallet, Binance 16, sent another 28,005 ETH to the same address 24 seconds later.

The receiving address did not exist before Thursday. Within 15 minutes it forwarded 195,460 ETH, around $450 million, to yet another fresh address while still holding about $1.5 billion in tokens.

The transfer was triggered by a wallet funded only through Tornado Cash, a mixing service that hides where coins come from. That wallet took three deposits of roughly 0.1 ETH on October 28 and 29.

Theft or Housekeeping?

A hot wallet is one an exchange keeps online to pay withdrawals, and exchanges do shuffle funds between them. Spreek, a pseudonymous on-chain researcher, flagged the transfer on X.

“It COULD be routine wallet maintenance, but it looks extremely sus”

Tree News, a market alert feed, put the outflow at about $2.53 billion across more than 60 tokens and labeled it a suspected key compromise, meaning someone other than Binance may control the wallet.

Two details weigh against the maintenance reading.

• A Binance-run transfer has no reason to start from a mixer-seeded wallet.
• The receiving address also split the funds onward at once, a pattern seen in the Bitget hack timeline after the stolen coins moved.

Whose Money is On the Line?

Binance keeps customer assets in these wallets, so a confirmed key compromise would test whether its emergency reserve fund can absorb a loss this size. Tether, the USDT issuer, can freeze tokens, which would cap an attacker’s haul if it acts.

Binance did not immediately respond to BeInCrypto’s request for comment.

Until Binance speaks, the only hard facts are on the chain, and they show $2 billion sitting in wallets nobody has claimed.