Is Binance Hacked? $2.38B Drained From Hot Wallet in Minutes

A possible Binance hack is under scrutiny after a Binance-labeled Ethereum hot wallet moved tokens now valued at about $2.38 billion to a previously unused address late on Thursday, October 29. Roughly $1.6 billion of that was Tether (USDT), and the rest was spread across dozens of other tokens. Binance, the world’s largest cryptocurrency exchange by trading volume, has not said whether the transfers were an internal operation, a security incident, or something else.

The transfers were recorded on-chain at 20:24 Coordinated Universal Time (UTC), which is 01:54 India Standard Time (IST) on October 30. As of about 21:00 UTC, the exchange had not reported any impact on user funds, any withdrawal suspension, or any service disruption.

What the On-Chain Data Shows

The funds left address 0x28C6c06298d514Db089934071355E5743bf21d60, which the Ethereum block explorer Etherscan labels “Binance 14”. Blockchain analytics platform Arkham Intelligence tags the same address as a Binance hot wallet. A hot wallet is connected to the internet so an exchange can process deposits and withdrawals quickly. A cold wallet keeps its private keys offline.

The primary transaction moved Ether (ETH) and a large batch of ERC-20 tokens, the standard format for fungible tokens on Ethereum, to the intermediate address 0x522…CB2f8c. Etherscan records the following major amounts:

• 1,615,409,499 USDT (about $1.61 billion). USDT is Tether’s stablecoin and is designed to track the US dollar.
• 62.6 million RLUSD. Ripple USD is the dollar-backed stablecoin issued by Ripple.
• 29,934 wBETH (about $75 million). Wrapped Beacon ETH is Binance’s liquid staking token for staked Ether.
• 11,372 XAUt. Tether Gold is a token backed by physical gold. Each token represents one troy ounce.
• 6.19 million UNI. UNI is the governance token of the decentralized exchange Uniswap.
• Dozens of other tokens, including Ethena (ENA), Pepe (PEPE), Chainlink (LINK), and Aave (AAVE).

A separate transfer then sent about 195,460 ETH to another fresh address, 0x853..543D4.

Etherscan’s multichain portfolio view puts the intermediate address’s holdings at about $2.38 billion, mostly on Ethereum. Figures shared by community trackers put the total closer to $2.77 billion once movements on other blockchains are counted. The Crypto Times has not independently verified the higher figure.

Alert Points to Tornado Cash-Linked Gas Funding

TreeNews flagged the activity at about 20:41 UTC in an alert credited to its TreeAI monitoring tool. The alert described a possible theft of billions of dollars across more than 60 tokens from Binance hot wallets. It said the funds went to an address whose gas funding was linked to Tornado Cash.

Gas is the fee paid in ETH to process transactions on Ethereum, so a new wallet needs some ETH before it can move tokens. Tornado Cash is a decentralized crypto mixer that breaks the on-chain link between the address that deposits funds and the address that withdraws them. It keeps turning up in the laundering trails of exploited funds this month, including after the X100 governance attack. The US Treasury removed Tornado Cash from its sanctions list in March 2025.

Where a receiving wallet got its gas does not, by itself, show who controls that wallet. The Crypto Times has not been able to confirm the Tornado Cash link or any compromise of Binance’s wallet keys.

Binance Has Not Commented

As of about 21:00 UTC, there had been no statement from Binance’s official channels or from Changpeng Zhao, the exchange’s founder, who is widely known as CZ. Binance is led by co-chief executive officers (CEOs) Richard Teng and Yi He.

Large movements from Binance-labeled wallets do not by themselves point to a problem. In May 2023, Binance said a spike in reported outflows was actually movements between its hot and cold wallets. The exchange also discloses its holdings on a proof-of-reserves page.

To cover confirmed security events, Binance keeps the Secure Asset Fund for Users (SAFU), an emergency reserve funded from trading fees. In February 2026, the exchange said it had finished converting the fund into 15,000 Bitcoin (BTC).

How Exchanges Disclosed Recent Hot Wallet Breaches

Hot wallets have been a target for attackers this year. On September 24, Bitget said its systems detected unauthorized transfers from some of its hot wallets at 18:31 UTC. Bitget’s CEO posted the security notice at about 21:30 UTC, roughly three hours after detection, and the exchange later revised the loss to about $387.5 million.

Market Context

Bitcoin traded between roughly $79,600 and $81,700 in the 24 hours to Thursday morning UTC, according to CoinGecko data, as it hovered near $80,000 after the Federal Reserve held rates. The Crypto Times has not found a price move that can be directly tied to the Binance transfers.

What Remains Unconfirmed

• Whether the transfers were an internal Binance operation or unauthorized
• Who controls the addresses ending 2f8c and 43D4
• Whether the Tornado Cash funding link is accurate
• The total value moved across all blockchains
• Whether any user funds are affected

Update (as of 21:55 UTC, Oct 29, 2026): On-chain analyst Emmett Gallic is tracking over $5B that has left Binance addresses today (figures remain variable and are still being counted as additional outflows are identified), with approximately $2.3B in USDT/USDC noted as eligible for freezing.

Now tracking over $5B that has left Binance today https://t.co/vXOh4cC2qY pic.twitter.com/EE3Ea3LbsU

— Emmett Gallic (@emmettgallic) October 29, 2026

This is a developing story. The Crypto Times will update this report when Binance responds, or more on-chain data becomes available.

Also Read: WazirX Hack Victims Can’t Cash a Single Recovery Token; Nischal Shetty Says Trust Is Back