Binance Hot Wallets Drained of an Estimated $2.5 Billion to $3.5 Billion in Suspected Hack; Tether and Circle Freeze $1.8 Billion

Between 20:24 and 21:04 UTC on Thursday, Oct. 29, billions of dollars in ETH, USDT, USDC and dozens of other tokens left Binance hot wallets. Estimates of the total run from $2.5 billion to as much as $3.55 billion, depending on which on-chain tracker is counting and across how many blockchains.

Changpeng Zhao, Binance's co-founder, said on X at about 21:15 UTC that the outflows "do look like a hack." He said user funds are safe and that all of them should be fully covered.

Zhao stepped down as Binance CEO in 2023. He said he no longer runs Binance.com and was speaking as a shareholder.

Binance itself has said only that it is investigating a potential security issue. It has not confirmed any impact on user funds.

How the money moved

At 20:24 UTC, the wallet labelled "Binance 14" sent about 167,464 ETH (roughly $380 million), 1.615 billion USDT and 62 other tokens to a fresh address in one transaction worth about $2.5 billion, according to on-chain data.

Seventeen minutes later, "Binance: Hot Wallet 34" sent 780 million USDC to the same destination, followed by another 43 million USDC at 20:59 UTC. A third wallet, Binance 16, sent about 28,006 ETH. Smaller balances were still being swept from Binance 14 as late as 21:04 UTC.

The receiving address forwarded about 195,460 ETH, worth roughly $445 million, to another new wallet within minutes. It also split 1.2 billion USDT across new addresses, testing each route with a small transfer first.

Why it doesn't look like routine maintenance

Exchanges shuffle money between their own wallets constantly, and Binance had scheduled Ethereum wallet maintenance for Oct. 28. Early reports floated that as an explanation. Transaction data cuts against it.

The withdrawals were triggered by a separate address, 0x7C86…5CA0. Etherscan shows it received its first ETH from Tornado Cash on Oct. 28. Tornado Cash is the mixing service the U.S. Treasury sanctioned in 2022 and later delisted.

That same address deployed the smart contract that executed the withdrawals at 15:59 UTC, more than four hours before the drain. At 20:20 UTC, Binance 14 was set to run that contract's code through an EIP-7702 delegation. Setting such a delegation requires a valid signature from the wallet's own private key.

The address also ran identical delegate-and-sweep transactions against three smaller wallets earlier in the day. Finance Feeds, which laid out the transaction data, says the pattern suggests whoever controlled the address could sign on behalf of a Binance hot wallet. Binance has not said how that could have happened. Etherscan has tagged the sender "Binance Hot Wallet Exploiter."

The freezes

Tether blacklisted addresses holding about $971 million in USDT. Circle froze $823 million in USDC. Together that is about $1.8 billion.

Tether CEO Paolo Ardoino later said on X that the company had frozen more than $1.567 billion in USDT tied to a potential Binance exchange hack. "Protecting the industry and our partners is our main priority," he said.

One tracker put the combined freezes at $2.4 billion, a figure the issuers' own numbers don't match.

Not everything was caught. Trackers noted roughly $700 million in USDT had already left some addresses before Tether's blacklist took effect at about 21:01 UTC. Portions were swapped into ETH on decentralized venues such as UniswapX. Neither issuer can freeze ETH, and one blacklisted wallet reportedly held more than 100,000 ETH.

Market fallout

Liquidations hit $627.7 million, mostly long positions. Bitcoin slid from $80,327 to $78,763 within the hour. Ethereum fell 2% to 4%.

BNB, the token most closely tied to Binance, dropped by as much as 6.3%, from the mid-$740s toward the $670s, before partially recovering. Almost an hour passed between the first on-chain move and the first public word from anyone connected to Binance.

What Zhao's pledge does and doesn't settle

Zhao's promise to cover losses is a statement of intent. Crypto Briefing pointed out that it is not proof of solvency, and that the real test is whether Binance's investigation confirms customer balances were untouched.

Zhao's shareholder framing also matters. It treats the loss as something owners absorb rather than customers. Binance has not published a loss figure of its own or said who would fund any reimbursement.

The stablecoin freezes also put a spotlight on centralized control. Tether and Circle can blacklist any address in their token contracts, and they did so within minutes. That likely limited how much could be laundered. It also shows how much power two private issuers hold over supposedly decentralized money.

What comes next

Binance has not said when its investigation will report. Law enforcement has announced no action, and no suspect has been identified. The open questions are how the attacker obtained signing authority over a Binance hot wallet, how much of the stolen ETH can be traced, and what Binance's reserves look like when Asian markets open Friday.