Billions move out of Binance wallets, sparking hack fears

On Thursday afternoon, onchain records showed billions of dollars in crypto leaving wallets linked to Binance, the world's largest crypto exchange. The transfers went to a newly created address, and the market dropped. Binance had not commented, and no one had confirmed a hack at the time of writing.

Online investigators were tracking a Binance wallet being emptied into a new externally owned account, which ended up holding more than $2 billion in ETH, USDT, USDC and other coins, CoinDesk reported. Korea-based Bloomingbit put the total outflow at $2.77 billion across five blockchains. It also said it was unclear whether the money was stolen or simply moved between wallets for another reason.coindesk.com+1

The transaction

According to Etherscan data cited by PANews, the hot wallet labeled "Binance 14" sent about 167,500 ETH, 1.615 billion USDT and more than 60 other tokens to a new address. That single transaction was worth about $2.5 billion and took place around 4:24 p.m. EDT. The address that started the transaction had been funded through the Tornado Cash mixing service, so several onchain monitoring accounts said the hot wallet appeared to be compromised, Odaily reported.panews.io+1

The Defiant reported that a Binance-labeled wallet was emptied minutes after an EIP-7702 delegation. EIP-7702 is an Ethereum feature that lets a regular account temporarily run smart-contract code. The Defiant said the delegated account later started a separate 780 million USDC transfer from a smart wallet it owns, and that it was still unconfirmed whether any of these moves were authorized. With that additional USDC transfer, the total possibly reached about $3.3 billion, Odaily reported in a follow-up.thedefiant.io+1

Market reaction

Crypto prices fell as the news spread. BNB ↗ 1.44% was hit hardest, dropping about 6% in an hour, CoinDesk reported. Over the same hour, Bitcoin ↗ 0.55% fell about 2% and Ether Ethereum ↗ 0.48% about 3%, according to the outlet.coindesk.com

Unanswered questions

Binance had not responded by press time, PANews noted. The key question is whether the transfers were theft or internal treasury moves that only looked suspicious. Big transfers between an exchange's own wallets are common, but funding from Tornado Cash and sweeps right after a delegation are signs often seen in exploits.panews.io

If a breach is confirmed, Binance has a precedent. In 2019, attackers took about 7,000 BTC from its hot wallet, and the exchange paid for the loss from its Secure Asset Fund for Users (SAFU) so customers were not affected, The Block reported. The fund is now held in Bitcoin and has a target size of about $1 billion, according to Binance. That is well below the amounts that left the wallets on Thursday.theblock.co+1