ABAB News Logo
Back to Flash News

Binance hot wallet suspected of theft; about $2.7 billion in assets transferred out

Starting at about 20:24 UTC on October 29, 2026, Binance-labeled hot wallets, including Binance 14, transferred large amounts of assets to a newly created address, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c. Etherscan showed that in transaction 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3, Binance 14 transferred out about 167,464 ETH and 63 tokens, including about 1.615 billion USDT. Other reports mentioned that Binance 16, Hot Wallet 34 and others also made similar transfers, and on-chain observers put the total size at about $2.7 billion to $2.8 billion, covering multiple chains including Ethereum.

Binance’s official X account said on the same day that the team was aware of reports of a potential security issue and was actively investigating it, and had not yet confirmed any impact on user funds. Former CEO Changpeng Zhao (CZ) said on X that user funds were safe and that it looked like a hack against Binance, while also thanking Tether for freezing about $971 million USDT and Circle for freezing about $823 million USDC. As a shareholder, he expected user funds to be fully covered. The receiving address later made further splitting transfers.

The incident is still under investigation, and Binance has not confirmed a hack or losses of user funds. The market reacted with selling, and prices of bitcoin and others fell.

Original sources:

  1. Title: Ethereum Transaction Hash: 0x53bd38b816... Publisher: Etherscan Date of publication: 2026-10-29 URL: https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3 Nature of source: original data Verification status: This reading of the transaction details page confirmed the From/To, amount and status Supporting content: Binance 14 transferred about 167,464 ETH and multiple ERC-20 tokens to 0x5227..., including about 1.615 billion USDT

  2. Title: Our teams are aware of reports of a potential security issue... Publisher: Binance (@binance) Date of publication: 2026-10-29 URL: https://x.com/binance/status/2115915708504900039 Nature of source: involved party's original post Verification status: This reading of the full original post was completed Supporting content: Binance is aware of the reports and is investigating, and has not yet confirmed any impact on user funds

  3. Title: User funds are safe! It does look like a hack on Binance... Publisher: CZ 🔶 BNB (@cz_binance) Date of publication: 2026-10-29 URL: https://x.com/cz_binance/status/2115915423174853077 Nature of source: involved party's original post Verification status: This reading of the full original post was completed Supporting content: CZ said it looks like a hack, user funds are safe, mentioned the amounts frozen by Tether and Circle, and expected full coverage

  4. Title: Binance Hack Fears Shake Crypto: $2.8B Outflows Reported Publisher: Coindoo Date of publication: 2026-10-29 URL: https://coindoo.com/binance-hack-fears-shake-crypto-2-8b-outflows-reported/ Nature of source: media report Verification status: This reading of the key passages of the article was completed Supporting content: the scale of transfers from multiple wallets, Hot Wallet 34 with about $780 million USDC, and subsequent splitting of about $1.2 billion USDT

ABAB AI Insight

Changpeng Zhao (CZ) founded Binance in 2017. After an early large hot-wallet-related incident in 2019, he established the SAFU (Secure Asset Fund for Users) mechanism to cover user losses in security incidents. In this case, he made his statement as a shareholder, which is consistent with his previous approach in incidents involving Trust Wallet and others, where he emphasized that user funds were SAFU, but he clearly said that he no longer manages Binance.com operations.

The funding path this time is: multiple Binance-labeled hot wallets (14, 16, 34, etc.) → new EOA 0x5227... → further splitting into new addresses. The stablecoin portion has already been frozen by Tether and Circle, indicating that issuers can enforce blacklists on-chain and limit subsequent transfers. Hot wallets themselves are exchange operating liquidity tools rather than user cold storage, and once the private key control is lost, it constitutes a direct outflow.

Compared with the December 2025 Trust Wallet browser extension incident, CZ publicly confirmed losses of about $7 million at that time and the platform covered them; this time the scale is several times larger, and it involves abnormal activity across hot wallets on multiple chains, with the receiving address newly created and later actively splitting funds, a pattern that is closer to active extraction than routine internal rebalancing. The difference is that the previous case was a wallet-extension supply-chain issue, while this one points to operational authority over the exchange’s core hot wallets.

If unauthorized outflows are ultimately confirmed, Binance’s hot-wallet operational risk exposure and liquidity buffer will change directly: the outflow portion will need to be covered through SAFU or insurance, and the freezing of stablecoins reduces the immediately cash-outable space, but non-stablecoin assets (ETH and tokens) could still enter mixers or cross-chain paths. Indicators to watch are whether Binance suspends related withdrawals, whether the official side updates its investigation conclusion, and whether the receiving address later enters known mixer contracts.

ABAB News · Law of cognition

  1. When hot-wallet private keys fail, the scale depends on operational balances rather than cold-storage segregation.

  2. Freezing stablecoins cuts off the cash-out path, but cannot trace back all completed on-chain ownership transfers.

  3. Shareholder expectations of coverage do not mean the operator has confirmed the scope of losses.