Binance Hot Wallets Move $2 Billion in Crypto to Fresh Tornado Cash-Funded Address

167,464 ETH Left Binance 14 at 20:24 UTC

Blockchain records show more than $2 billion in Ethereum (ETH) and other tokens draining from Binance's hot wallets, the online accounts an exchange keeps connected to pay withdrawals, on Thursday. The destination was an account spun up only hours before the transfers began and funded through Tornado Cash, a mixing service that hides where coins come from. The money inside those wallets belongs to Binance users, which is why customer deposits are in question while the exchange stays silent. A confirmed theft would be far larger than the $387 million Bitget breach in September. If the movement was routine housekeeping, the exchange shifted its reserves in a sequence that copies how thieves cover their tracks.

At 20:24 UTC on October 29, a single transaction carried 167,464 ETH, valued near $388 million, out of the wallet tagged Binance 14. The same transfer pushed 63 tokens to the receiving side, including roughly $1.6 billion in USDT. Twenty-four seconds later, a second labeled exchange wallet, Binance 16, added another 28,005 ETH. The timing matters because the follow-up came within seconds rather than hours, pointing to automated or keyed control. Everything landed at a freshly created address that did not exist before Thursday. Within 15 minutes it had relayed 195,460 ETH, roughly $450 million, onward to yet another new account while retaining close to $1.5 billion in other tokens. The whole sequence was triggered by a separate crypto wallet funded exclusively through Tornado Cash, which had accepted three deposits of roughly 0.1 ETH apiece on October 28 and 29 before setting the transfers in motion. Every hop is visible in a public block explorer, and our walkthrough of how to read Etherscan follows the same method step by step.

Theft or Routine Maintenance

Exchanges do move funds between hot wallets as a matter of routine, and the sequence could in theory be maintenance. Pseudonymous on-chain researcher Spreek flagged the transfers shortly after they appeared, posting on X that it “could be routine wallet maintenance, but it looks extremely sus.” Alert feeds tracking the flows put the total closer to $2.53 billion across more than 60 token types and classified the event as a suspected key compromise, meaning someone other than Binance may now hold the keys.

Two on-chain details weigh against that reading. No Binance-operated sweep has any reason to start from a mixer-seeded account: the wallet that triggered the transfers drew its entire funding history from Tornado Cash and nothing else. The wallet address that received the funds also split them onward at once, a pattern that matches the Bitget hack timeline after stolen coins first began to move.

Heavy October flows are not new by themselves; earlier this month, dormant whales moved 56,000 coins to exchanges in routine profit-taking. Until Binance confirms anything, the Ethereum blockchain is the only place hard facts exist, and they show about $2 billion sitting in wallets nobody has claimed. Those wallets held client assets, so a confirmed compromise would test whether the exchange's emergency reserve fund can absorb a loss of this size. Tether, the issuer of USDT, can freeze tokens, which would cap an attacker's haul if it moves fast. Binance has not answered requests for comment, leaving both readings open: an elaborate internal reorganization that happened to resemble a theft, or the largest exchange breach on record.

A Trail That Points Away From Housekeeping

The on-chain trail, not any announcement, is currently the core evidence, and it points away from housekeeping. A legitimate internal sweep does not originate from a wallet whose entire funding history is three 0.1 ETH Tornado Cash deposits, and no Binance process needs to relay $1.6 billion in USDT to an account only minutes old. The immediate onward split of 195,460 ETH repeats the opening steps of the September Bitget theft. If the keys are compromised, Tether's freeze authority is the main lever to shrink the haul, and Binance's reserve fund faces its largest test since that $387 million breach. The market is already pricing the risk: Ethereum slipped 3.7% over the past 24 hours, and on-chain analyst Ali Martinez's $2,000 downside target is back in view. A confirmed compromise would also sharpen the industry's argument for holding more reserves in cold wallet storage.