Binance Hot Wallet Sees Massive Outflow Amidst Security Concerns
Binance’s hot wallet experienced a significant asset transfer early on October 30th, Taipei time, with approximately 167,000 ETH and over 60 types of tokens moved in a single on-chain transaction, totaling an estimated $2.5 billion. The exchange has not yet confirmed whether the incident was a hack.
On-Chain Activity Raises Red Flags
Around 4:24 AM Taipei time on October 30th, a large-scale asset movement was detected from an address labeled as a Binance hot wallet. BeInCrypto reported that funds flowed from a Binance-related address to a newly created recipient address on the same day. Binance has not responded to inquiries and has not clarified if this was routine maintenance or a security breach.
On-chain alert account Tree News simultaneously flagged the event as a suspected or potential hack, involving over 60 types of tokens and valued at approximately $2.53 billion. As of this report, neither Binance’s official accounts nor its founder, Changpeng Zhao (CZ), have issued a statement.
Transaction Details and Potential Implications
An Ethereum transaction on Etherscan shows an interaction between the initiating address and a hot wallet labeled “Binance 14,” utilizing a “sweep(…)” function to transfer assets to a new address, 0x5227…2f8c.
The internal transfer involved approximately 167,500 ETH, valued at around $380 million at the time, along with 63 ERC-20 tokens. Among these were approximately 1.615 billion USDT. On-chain research indicates that the originating funds can be traced back to Tornado Cash, though this does not definitively confirm a hack.
BeInCrypto further reported that an additional 28,000 ETH were moved from “Binance 16” within the same address context. Within approximately 15 minutes, the recipient address then transferred about 195,000 ETH to another new address, still holding tokens equivalent to approximately $1.5 billion at that moment.
Routine Maintenance vs. Security Breach
Large-scale “sweeps” from hot wallets are not uncommon during exchange maintenance, such as the reallocation between cold and hot wallets, address rotation, or risk isolation, which can appear as a “one-time clear-out” on-chain. Therefore, the transfer pattern alone cannot immediately be classified as a hack.
However, the fact that the recipient address was newly created on the same day, the assets were immediately moved again, the method indicated “sweep,” and alert accounts flagged it as a “suspected/potential hack” has heightened market tension. Some observers have cautioned that despite the suspicious appearance, it could still be routine maintenance.
SAFU Fund as a Potential Buffer
If confirmed as a hack, the scale of assets visible on-chain would far exceed the approximately $388 million incident involving Bitget’s hot wallet in September 2026. Binance maintains a User Protection Fund, SAFU, which has been converted into approximately 15,000 BTC, representing reserves in the $1 billion range. This fund is often referenced as a potential buffer mechanism while the market awaits official clarification.
For users, immediate concerns will focus on the smoothness of withdrawals, the timing of Binance’s official statement regarding the nature of the transfer, and whether the funds in the new addresses continue to be moved. Should Binance confirm an anomaly, the SAFU fund will be the primary benchmark for assessing user protection.
