Unconfirmed reports describe Binance wallet drained via Tornado Cash-linked call
Macro & Markets ยท
Two reports in circulation describe a Binance wallet being emptied to a newly created address after a call funded through the Tornado Cash mixer, though the claim remains unverified.
According to a post cited on ๐/@spreekaway, funds from a Binance-associated wallet moved to a new address following a Tornado Cash-funded call. A separate account in the same cluster describes Binance experiencing significant outflows to newly created addresses that were themselves funded through the Tornado Cash mixer, a pattern consistent with the initial report though not an independent confirmation of the specific wallet or amount involved.
No figures โ neither the size of the alleged outflow nor the identity of the drained wallet or the destination address โ have been disclosed in the material reviewed. Binance has not issued a statement addressing either report, and no on-chain transaction hash or block explorer link has been provided to substantiate the claim.
The mechanics described fit a familiar laundering pattern associated with Tornado Cash, the Ethereum-based privacy protocol that lets users deposit fixed denominations of ETH or ERC-20 tokens and withdraw them to a fresh wallet with no on-chain link to the depositor, using zero-knowledge proofs to shield the connection. That same anonymizing function has repeatedly appeared in exploit laundering: a KyberSwap exploiter reportedly sent another 2,000 ETH through Tornado Cash as a laundering total reached $40M, Hinkal was exploited for $820K with an attacker routing 410 ETH through the mixer, and a DLMC exploiter moved 37 ETH through it after a $222.5K BNB Chain oracle attack. Funding a call or an address through Tornado Cash before draining a wallet would mirror this broader pattern of using the protocol to obscure the origin of funds tied to an intrusion rather than to launder stolen assets after the fact.
The claim's unverified status is central: it rests on a single social post amplified by one corroborating account, with no confirmation from Binance, no identified transaction on-chain, and no independent security firm attribution. Whether this represents an actual breach of Binance infrastructure, a social-engineering call targeting an individual wallet holder, or a misreported transaction remains unclear. Confirmation would likely require Binance's own disclosure, a traceable on-chain address, or analysis from a blockchain forensics firm โ none of which has surfaced yet.