The cryptocurrency market has encountered an alarming signal: Ethereum (ETH) and tokens worth more than $2 billion were withdrawn from Binance hot wallets on Thursday. The funds went to an address created just a few hours before the transaction and funded through the anonymous Tornado Cash mixer. The world's largest exchange has not given official comments, leaving open the question of the safety of client deposits.
What blockchain data shows
At 20:24 UTC on October 29, a single transaction withdrew 167,464 ETH (about $388 million at the estimate at the time of transfer) from a wallet labeled Binance 14. The same address received 63 tokens, including approximately $1.6 billion in the Tether (USDT) stablecoin. The exchange's second wallet, Binance 16, sent another 28,005 ETH to the same address 24 seconds later.
The receiving address had not previously appeared on the blockchain — it was created only on Thursday. Within 15 minutes, 195,460 ETH (about $450 million) were withdrawn from it to yet another new address, while the first address retained tokens worth $1.5 billion. The trigger for the transfer was a wallet funded exclusively through Tornado Cash: on October 28 and 29, three deposits of approximately 0.1 ETH each were made to it.
Theft or routine operation
A hot wallet is an exchange's online storage for prompt client payouts, and platforms regularly move assets between them. However, two circumstances contradict the version of scheduled maintenance. First, a transfer between Binance wallets does not begin with an address that received funds through a mixer. Second, the recipient address immediately split the funds and sent them onward — an identical technique was used after the Bitget hack, when stolen coins were withdrawn.
The total outflow is estimated at more than $2.53 billion in 60-plus tokens, which points to a possible compromise of keys — an outsider could have gained access to the wallet. If the leak is confirmed, this event will surpass the record Bitget hack of $387 million in September.
Binance stores client assets in these wallets. If the key leak is confirmed, the company will have to check whether its reserve fund can withstand a loss of this magnitude. The Tether issuer may freeze the USDT, which would limit the attackers' gain. While the exchange remains silent, only one fact is visible on the blockchain: $2 billion remain in wallets that no one has claimed.
Cryptalist analysis: The structure of the transactions — a fresh address, funding through a mixer, and instant splitting of funds — is statistically closer to a compromise pattern than to a scheduled rotation of reserves. Until Binance provides official explanations, the market will price in a risk premium, and investors should closely monitor the on-chain movement of funds and the reaction of the USDT issuer.