Binance Faces Potential Record Crypto Theft as On-Chain Outflows Exceed $5.5 Billion

Binance, one of the world’s largest cryptocurrency exchanges, is investigating a major security incident after billions of dollars in digital assets were transferred from its wallets to newly created addresses.

If confirmed as a theft, the incident would rank as the largest crypto-market theft on record. Initial estimates placed the outflow between $2.4 billion and $3.5 billion, but subsequent analysis of on-chain data raised the estimated amount to at least $5.57 billion across Ethereum, Bitcoin and Tron.

The estimated outflow includes around $3.51 billion on Ethereum, $1.44 billion worth of Bitcoin involving 18,270 BTC, and approximately $630 million on Tron. Binance has not independently confirmed these figures.

The largest wave of transfers reportedly began at around 10:24 PM Cyprus time.

According to blockchain data from Etherscan, a wallet identified as Binance 14 transferred approximately 167,464 ETH, worth around $388 million at the time, along with roughly $1.6 billion in USDT and more than 60 other tokens, to a newly created address in a single transaction.

Around 24 seconds later, approximately 28,000 ETH was transferred from another wallet identified as Binance 16 to the same destination. A third Binance hot wallet subsequently transferred approximately $823 million in USDC.

The primary wave of Ethereum transfers had largely ended by around 11:04 PM.

The transaction pattern has raised concerns among blockchain researchers that the incident may have resulted from a sophisticated attack rather than a routine movement of exchange reserves.

According to Etherscan data and on-chain researchers, the address that initiated the withdrawals had been funded through Tornado Cash, a cryptocurrency mixer, with three deposits of approximately 0.1 ETH made on October 28 and 29. The receiving address itself reportedly did not exist before October 29.

Researchers also found that the same address deployed a smart contract used to execute the withdrawals several hours before the major transfers occurred.

A few minutes before the first major transfer, Binance 14 was reportedly linked to the contract through EIP-7702, a mechanism that can allow a wallet to delegate certain transaction capabilities to contract code. Once linked, the contract could move funds from the wallet without requiring additional signatures, although the initial authorization still requires the wallet’s private-key signature.

How such authorization was obtained remains unclear.

Blockchain researchers also identified similar activity involving three smaller wallets earlier in the day, suggesting that the transactions may have been used as preliminary tests before the larger transfers.

The funds were subsequently dispersed across multiple addresses.

On-chain researcher Spreek reported that within approximately 15 minutes, the recipient transferred around 195,460 ETH, worth approximately $450 million, to another newly created address. The USDT was also divided among multiple addresses and reportedly sold through decentralized exchanges.

Etherscan has subsequently labelled the relevant addresses as “Binance Hot Wallet Exploiter.”

Binance had previously announced scheduled maintenance involving its Ethereum wallets on October 28, meaning an internal movement of reserves was initially considered a possible explanation. However, analysts have said the sequence and structure of the transfers are difficult to reconcile with a routine internal wallet reshuffle.

Binance has not officially confirmed that the exchange was hacked.

The exchange said it was aware of reports concerning a potential security issue and that its security teams were investigating the matter urgently. Binance also said it had not confirmed any impact on user funds.

Binance co-founder and former chief executive Changpeng Zhao (CZ), meanwhile, wrote on X that user funds were safe and said the incident appeared to be a hack. He added that, although he no longer runs Binance, he expected users to be fully compensated if necessary.

Binance co-founder Yi He urged users to rely only on official Binance channels for updates and warned against unofficial links, messages or requests for account information.

The exchange has not announced whether it will use its SAFU emergency fund to cover any losses, and no suspension of withdrawals had been announced at the time of reporting.

Stablecoin issuers moved quickly after the suspicious transfers were identified.

Tether initially froze approximately $975 million in USDT associated with the receiving addresses, with later reports indicating that more than $1.5 billion in USDT had been frozen.

Circle also froze approximately $823 million in USDC linked to the incident.

Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement. Zhao publicly thanked both stablecoin issuers for their response.

However, unlike centrally issued stablecoins, ETH and other cryptocurrencies cannot simply be frozen by an issuer, leaving a significant portion of the transferred assets potentially accessible to whoever controls the receiving wallets.

The suspected incident also triggered volatility across the cryptocurrency market.

Bitcoin fell below $79,000, while Ether dropped below $2,300. Binance’s native BNB token declined by as much as 9%, falling below $700.

According to Coinglass, approximately $628 million worth of cryptocurrency positions were liquidated within an hour, with long positions accounting for almost all of the liquidations. Around $345 million of the liquidations occurred on Binance.

If the reported figures are confirmed as stolen funds, the Binance incident would significantly exceed the previous record for the largest cryptocurrency exchange hack.

In February 2025, approximately $1.5 billion was stolen from Bybit, an attack that the FBI attributed to North Korean hackers.

Binance itself experienced a major security breach in 2019, when attackers stole approximately 7,000 BTC, worth around $40 million at the time. The exchange covered the losses through its SAFU fund.

The latest incident comes shortly after Binance said on October 27 that its security team had successfully repelled several attacks linked to North Korea.

However, the identity of those behind the latest suspected outflow remains unknown, and Binance's investigation is ongoing.