Crypto markets sold off sharply after on-chain tracking accounts reported large, fast transfers out of wallets labeled as Binance hot wallets, with the size of the alleged outflow later estimated at roughly $5.5 billion to $5.7 billion across assets including ether, bitcoin-linked holdings and Tron. Binance has not confirmed a hack, but founder Changpeng Zhao said the activity “does look like a hack,” escalating investor concern about operational and counterparty risk at the world’s largest exchange.
Key takeaways
- Price move: Bitcoin slid toward $79,000 and BNB fell about 7% as the reports spread across markets.
- Catalyst: On-chain data cited by multiple crypto research outlets showed rapid transfers from wallets labeled as Binance 14 and Binance 16 to brand-new addresses.
- Why it matters: Researchers highlighted the speed of forwarding, mixer-linked triggering, and newly created receiving addresses—signals they associate more with theft than routine treasury operations.
- Mitigation: Stablecoin issuers including Tether and Circle said they froze large portions of the tokens linked to the incident.
- Open question: Binance’s unverified account of the event leaves investors watching for a confirmed timeline and details of any impact to customer balances.
What drove the reports
Early on Thursday, on-chain monitoring accounts suggested an ether-focused outflow of more than $2 billion from wallets identified by explorers as belonging to Binance hot infrastructure. Later tallies cited by Decrypt and Arkham Intelligence estimated the total outflow at about $5.5 billion to $5.7 billion across Ethereum, Bitcoin and Tron.
According to Etherscan data cited by BeInCrypto and Unchained, at around 20:24 UTC on 29 October, a wallet labeled by Etherscan as Binance 14 transferred 167,464 ETH and dozens of tokens—including more than $1.6 billion in USDT—to a newly created address. Moments later, a second labeled wallet, Binance 16, sent an additional 28,005 ETH to the same destination, after which researchers reported much of the ether was forwarded again to another fresh address within minutes.
That routing pattern matters because, while exchanges regularly rebalance hot wallets, researchers said the combination of a mixer-linked trigger and rapid movement to new addresses is more consistent with attempted theft than standard treasury housekeeping. The activity was executed via an EIP-7702 delegation set up by an address funded via Tornado Cash, according to the report.
A pseudonymous researcher known as Spreek flagged the activity publicly, saying it “could be routine wallet maintenance, but it looks extremely sus.”
Binance response and stablecoin freezes
Binance initially said on X that it was aware of reports of a “potential security issue,” was investigating, and had “not confirmed any impact to user funds.” It later stated that user funds were “completely safe” and urged customers not to trust unofficial links or requests for account details.
Separately, Zhao said the event looks like a hack and added that, as a shareholder, he expected any losses to be fully covered. Binance did not provide a verified, fully confirmed account of what happened as of the latest reporting.
Token issuers took immediate containment steps. Tether CEO Paolo Ardoino said Tether froze more than $1.57 billion in USDT tied to the incident. Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC in coordination with law enforcement. Combined freezes were reported around $1.8 billion, with later tallies cited as higher.
Market reaction: bitcoin and BNB fall
The sequence of reports triggered a risk-off move in crypto. CoinDesk and Decrypt reported that bitcoin fell toward $79,000 and BNB dropped about 7% as traders reassessed exchange-specific risk and potential contagion effects across the sector.
CoinDesk also reported that the exploiter borrowed about 20,000 wrapped ETH on Aave using stolen USDT as collateral, adding another layer of potential financial impact beyond the initial outflow.
If confirmed, the suspected drain would be larger than Binance’s 2019 theft of roughly 7,000 bitcoin and would exceed the approximately $1.5 billion Bybit hack reported in February 2025, according to the article’s comparisons.
Bigger picture: operational risk and what to watch
Beyond the immediate price drop, the central investor question is whether assets leaving wallets labeled as Binance hot infrastructure represent a direct breach of customer-controlled funds—or a larger operational event that Binance’s internal controls and stablecoin freezes mitigate. The on-chain mechanics described in the reports—mixer-linked triggering, newly generated receiving addresses, and rapid forwarding—suggest why traders reacted quickly despite Binance’s assurances.
Investors are likely to focus next on whether Binance publishes a verified post-incident explanation, including the precise timeline, which systems or keys were implicated, and how customer funds are being protected or repaid. Crypto markets may remain volatile until stablecoin freeze actions are fully reflected in balances on affected chains and until follow-up reporting clarifies the total extent of any realized losses.
Additional developments to watch include Binance’s confirmed findings, further details from token issuers on the scope of frozen assets, and broader market sensitivity to exchange-security headlines as traders price in operational risk across the industry.
