Binance Investigates Suspected $2.7 Billion Crypto Hack After Wallet Transfers in 24 Seconds

Binance, the world’s largest cryptocurrency exchange, is investigating a potential security incident after billions of dollars in digital assets moved from wallets labelled as belonging to the exchange within seconds. The transfers, which initially involved approximately $2.7 billion in cryptocurrency, have raised concerns about a possible compromise of Binance’s hot wallets.

The incident was first highlighted by on-chain analysts tracking large cryptocurrency movements on October 29, 2026. While the initial transactions prompted questions about a possible internal wallet migration, subsequent blockchain activity and reports of a potential security breach have intensified scrutiny of the transfers.

Binance has acknowledged reports of a potential security issue and said its teams are investigating. The exchange has also reassured users that their funds are safe, according to reports by BleepingComputer and The Block.

What Happened to Binance’s $2.7 Billion in Crypto?

According to transaction details shared by crypto analyst StarPlatinum on X, a Binance-labelled hot wallet known as Binance 14 transferred approximately $2.53 billion in digital assets to a newly created wallet at 20:24 UTC on October 29.

Just 24 seconds later, another Binance-labelled hot wallet transferred an additional $174.4 million to the same destination.

Together, the two transfers amounted to approximately $2.7 billion.

The assets involved included stablecoins, Ethereum and several other cryptocurrencies. The reported breakdown included approximately $1.67 billion in USDT, $454.1 million in ETH, $88.5 million in RLUSD, $77.1 million in wrapped Beacon ETH (wBETH) and additional holdings in Tether Gold (XAUt), Uniswap (UNI), Ethena (ENA), Pepe (PEPE), Chainlink (LINK) and USD1.

The destination wallet had reportedly been created on the same day, with no previous transaction history.

However, the transfers alone did not establish whether the movement was authorised or whether any funds had been stolen. Subsequent reporting has raised further concerns about the activity.

Why the Receiving Wallet Raised Concerns

The receiving address identified in the initial analysis is:

0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c

The address became a focus of blockchain monitoring after receiving billions of dollars from Binance-labelled wallets.

Investigators and blockchain analysts examine more than the value of a transaction when assessing a potential crypto exploit. They also look at the source of the transaction, the mechanism used to authorise it, the destination of the funds and whether assets are subsequently transferred to unrelated wallets or services.

In this case, later reports described suspicious activity involving a wallet linked to Tornado Cash, a cryptocurrency mixing service, and the onward movement of funds to additional addresses. These developments have made a routine wallet migration less convincing as a complete explanation of the incident.

Blockchain intelligence estimates have also expanded beyond the initial $2.7 billion figure. The Block reported approximately $3.55 billion in incoming transfers to the main destination wallet, while other estimates put the value of assets across tracked wallets at more than $5 billion. These figures represent different sets of transactions and wallet holdings and should not be treated as a single confirmed loss.

Binance’s Response and the Potential Losses

Binance has said it is investigating reports of a potential security issue. The exchange has not publicly confirmed the precise cause of the incident or provided a final, independently verified figure for any assets stolen.

Former Binance chief executive Changpeng Zhao has also addressed the incident, saying that user funds are safe and expressing the expectation that they would be fully covered.

Meanwhile, stablecoin issuers Tether and Circle have reportedly frozen significant quantities of USDT and USDC associated with the suspected incident. According to reporting by Decrypt, the combined freezes were initially reported at approximately $1.8 billion.

Asset freezes can prevent certain tokens from being transferred or redeemed, depending on the issuer’s controls. However, they do not automatically recover funds or establish the final financial impact of a suspected exploit.

What This Means for the Crypto Market

The reports emerged during a period of significant volatility in cryptocurrency markets. Bitcoin, Ethereum and BNB experienced price declines, with the extent of the moves varying across trading venues and reporting periods.

However, market movements alone cannot establish that a security incident caused the sell-off. Broader market conditions, leveraged liquidations and investor sentiment can also influence prices.

If investigators confirm that the transfers resulted from unauthorised access, the incident could become one of the largest cryptocurrency security breaches on record. The final assessment will depend on the amount of assets actually compromised, how much was frozen or recovered, and whether Binance can establish that customer funds remain fully backed.

What Happens Next?

The investigation now centres on the transactions’ authorisation, the mechanism used to initiate the transfers and the movement of assets across related wallet addresses.

Blockchain records can show where funds move, but they do not independently establish who controlled a wallet or whether a transfer was authorised by the exchange.

For now, the reported transfers and subsequent activity warrant close monitoring. The distinction between the value moved, the value potentially stolen and the value ultimately lost remains critical.

Tizona Tech will continue to track developments as Binance and blockchain investigators provide further verified information.