Binance Hot Wallet Hack: CZ Confirms, Says User Funds Safe After $2.5 Billion Outflow

Binance co-founder Changpeng Zhao said Thursday that the exchange “was indeed hacked,” confirming what on-chain data had suggested after more than $2.5 billion left the exchange’s hot wallets for a Tornado Cash-funded address. Zhao said user funds are safe and thanked stablecoin issuers for freezing roughly $1.8 billion of the outflow, while Binance itself said it is investigating and has not yet confirmed any loss to customer assets.

The first transfer landed at 20:24 UTC on October 29, moving 167,464 ETH — worth roughly $388 million by Etherscan’s valuation — out of the wallet labeled Binance 14, along with 63 other tokens including about $1.6 billion in Tether (USDT). Twenty-four seconds later, a second wallet, Binance 16, sent another 28,005 ETH to the same destination.

What the Blockchain Shows

The on-chain trail carries the hallmarks of a compromise rather than routine housekeeping. The wallet that initiated the transfer was funded only through Tornado Cash, a mixing service, receiving three deposits of roughly 0.1 ETH on October 28 and 29. The receiving address did not exist before Thursday, and within 15 minutes it forwarded 195,460 ETH — around $450 million — to yet another fresh address while holding about $1.5 billion in tokens.

Pseudonymous on-chain researcher Spreek flagged the transfer on X: “It COULD be routine wallet maintenance, but it looks extremely sus.” The market alert feed Tree News estimated the total outflow at about $2.53 billion across more than 60 tokens and labeled it a suspected key compromise.

CZ Confirms the Hack, Says Funds Are Safe

Zhao, who stepped back from running Binance but remains a shareholder, broke from the exchange’s cautious tone in a post on X: “User funds are safe! It looks like Binance was indeed hacked.” He thanked Tether and Circle for “the swift freeze of assets of approximately $971 million and $823 million respectively,” and added, “I no longer run Binance, but as a shareholder I expect all user funds to be fully compensated.”

The combined freeze — roughly $1.8 billion — would cap a substantial portion of the stolen stablecoin balance before it can be swapped or cashed out, though the attackers’ ETH and other non-stablecoin holdings remain outside the reach of issuers.

Binance’s Official Response

Binance’s own statement was more measured. “We are aware of reports of a possible security issue with Binance. Our teams are actively investigating,” the exchange wrote. “At this time we have not confirmed that user funds have been affected.” It said security teams are “urgently reviewing all available information” and promised updates through official channels, while warning users against scammers exploiting the situation.

The gap between Zhao’s confirmation and Binance’s hedging reflects the difference between a shareholder’s public read and a company speaking for itself. Until Binance issues its own confirmation, the exchange’s position remains that it has not verified a loss.

Markets Sold First and Asked Questions Later

The derivatives market reacted before any official word. Bitcoin fell below $79,000 and Ethereum under $2,240 in the minutes after the first transfer, and total crypto liquidations reached $627.7 million in a single hour, according to Coinglass — $606.6 million of it against long positions, with Binance itself carrying $344.8 million of the total.

That sell-off was traders pricing a worst case before facts were established. Zhao’s subsequent assurance of user-fund safety may ease the panic, but the confirmation of a breach — however contained — is a separate signal for the broader market.

A Hard Year for Exchange Security

The incident lands on an already damaging stretch for centralized exchanges. In September, attackers took roughly $388 million from Bitget through a third-party security product, and the February 2025 Bybit exploit remains the largest exchange hack on record at roughly $1.5 billion, attributed by the FBI to North Korean actors.

Security firm Hacken counted $1.18 billion in crypto hacking losses in the third quarter — up 55% from the prior quarter — with 77% of the damage tied to supply-chain blind spots: third-party vendors and systems outside the scope of audits. If the full Binance outflow is confirmed as stolen, it would rank among the largest single exchange losses ever recorded.

What Comes Next

The next material updates are Binance’s own confirmation, the fate of the frozen stablecoins, and whether the exchange’s SAFU emergency fund is drawn down. Zhao’s expectation of full compensation signals where the exchange is likely to land, but the mechanics — how much is recovered, how quickly, and what Binance discloses about the entry point — remain open.

This article is not intended as financial advice. Educational purposes only.