Binance triggers Ethereum active user spike - twice

On two separate occasions this month, there were notable spikes in the number of active users on Ethereum. And both times, the 0xScope team identified Binance as the main cause.

In this article, we will take a closer look at how Binance caused these spikes, and it has something to do with taking back $ETH from users' deposit addresses. This pattern emerges amid a recent wave of bad news at one of the world's top exchanges.

September 13 Ethereum active address spike

On September 13, there were 1,002,263 active entities and 1,029,430 active addresses on the Ethereum blockchain, easily surpassing the average number of daily active addresses and entities at 300,000. This was the second-largest active entity/address number on Ethereum, only surpassed by 1.42 million active addresses back in December 9, 2022, so it merited a closer look from the 0xScope team.

What we found out is that the Binance 14 hot wallet received 703,174 transfers from 702,083 unique address. This number likely accounted for the sudden spike in daily active addresses. Upon closer inspection of the transactions involved, we saw that most of the transactions involve transfers of small amounts of $ETH back to the Binance hot wallet. And in most cases, the wallets involved have been mostly inactive.

In addition, Binance 14 recorded higher-than-usual transactions on September 11-12, preceding the record spike. The wallet received crypto from 27,914 addresses on September 11 and 53,551 the day after.

Therefore, we have come to the conclusion that Binance is likely retrieving the remaining $ETH amounts that it previously allocated for users' accounts. The total value of these transfers amounted to 90,108.20 $ETH ($146.07M). Please note that this number includes normal user deposits.

Looking at this instance alone, it had the markings of an isolated incident. However, the 0xScope team recently detected a similar, albeit less pronounced, increase in Ethereum active addresses on September 21. And like the earlier spike, we also connected it with Binance activity.

September 21 mini-spike

On September 21, the Scopescan Live Statistics dashboard showed that there were 434,112 active entities and 462,107 active addresses on the Ethereum blockchain. At around 9 AM UTC, the number of hourly active addresses on the Ethereum blockchain spiked from the usual sub-20,000 count to more than 110,000. We detected an additional 60,000 active addresses an hour later, still above the usual range, before returning to 20,000 levels in the succeeding hours.

At around the same time, the Binance 14 wallet received 149,373 transfers from 148,317 unique addresses, amounting to a total of 78,578.85 ETH ($125.1M). As we noted earlier, this includes normal deposits, but the address spike pattern has been established nonetheless.

What are the likely factors behind these two instances?

One of our takeaways from this trend is that Binance was curiously consolidating the $ETH it had previously distributed to users' deposit addresses in one fell swoop, particularly on September 13 and 21. To make sense of this action, we need to understand how Binance deposits work.

Binance's user deposit procedures

Here's a bit of context on how Binance processes this $ETH distribution. When a user creates a new account on Binance and is preparing to make a crypto deposit, the exchange creates a deposit address for each user, which is standard procedure for centralized exchanges. The user then makes his first deposit on Binance through the deposit address, typically an ETH address. Binance periodically withdraws money from these deposit addresses to consolidate funds in the centralized Binance wallet address, which is the same address users outside the exchange receive money from.

When Binance receives tokens from the user's deposit address, Binance sends a small amount of $ETH, usually 0.015 $ETH, from the Binance: Deposit Funder wallet to that deposit addresses to cover for the on-chain transaction fees on the deposit. When that user become inactive, Binance can take back the $ETH it distributed for gas fees.

Looking into the transactions we saw for the addresses that interacted with Binance on September 13 and 21, we saw a lot of addresses that have last made deposits to Binance months or even years ago. We projected that the only reason for these addresses to be active once again is due to the Binance's retrieval of $ETH that was once allocated for gas fees on each deposit address.

How much $ETH did Binance retrieve during these recent spikes? We have made estimates to project this amount by multiplying the standard 0.015 $ETH that Binance dispersed for each new deposit address with the number of addresses that had transactions with the Binance 14 wallet for reasons other than standard exchange deposits.

To get the number of addresses that are possibly subject to $ETH takebacks from Binance, we first obtained the average number of addresses that normally connect with Binance on a daily basis. On average, the Binance 14 wallet interacts with 6,115 addresses per day. This calculation excludes the days when we see spikes in Binance address interactions, specifically September 11-13 and 20.

By subtracting 6,115 from the address count during the days with noticeable spikes in ETH address activity, we have an estimate on the maximum possible number of addresses from which Binance can take back small $ETH amounts it initially distributed. Multiply that by 0.015 $ETH as mentioned earlier, and we get an estimate of up to 13,611.075 $ETH ($21.9M) for the maximum amount of $ETH that Binance can get back from these addresses.

Out of the $146.07M in $ETH that Binance received on September 13, $16.8M came from the retrieval of small $ETH amounts across hundreds of thousands of addresses. Binance then retrieved an additional $3.5M of $ETH out of the total $125.1M in total deposits made on September 21.

We also compared ETH fees spent by Binance 14 to a similar exchange wallet used by rival OKX. Binance's wallet used 388 $ETH on September 13 and 531 $ETH on September 20, based on data from Etherscan. This is way above the single- to double-digit ETH amounts it regularly uses. By comparison, the OKX wallet rarely crossed double-digit $ETH usage. What's interesting is that for several days in September, the OKX wallet also saw elevated $ETH usage, particularly during the days of the ETH active address spike, but its high usage point is just at 15 $ETH.

It is possible that Binance routinely retrieves $ETH from inactive addresses, albeit in more discrete methods compared to what has recently happened. The recent spikes in ETH address activity related to Binance, in addition to the fact that the exchanged bothered to suddenly consolidate the small gas allocations it usually ignored in the past, are noticeable enough to merit a closer look, especially given that the exchange is in hot water in the past few months.

Binance's recent woes

Since its inception, Binance has had an interesting relationship with regulators around the world, to put it mildly. The exchange had to leave China, its country of origin, just a few months after launching in July 2017 amid the government's crackdown on crypto exchanges. (Of course, this didn't stop Binance from getting up to 20% of its total trading volume from China.) Since then, the company grew to become one of the world's leading crypto exchanges, with a user base of 150 million this year and a current portfolio balance of $61.76B, according to 0xScope data.

However, Binance saw unprecedented legal scrutiny and significant outflows in 2023. Before this year even started, Binance users took out $9.7B from the exchange in December 2022. It has since seen more withdrawals than deposits in six of the past nine months, highlighted by a $3.8B loss in June, in the same month that the U.S. SEC sued the company and its American affiliate Binance.US.

At this point, Binance had already faced regulatory challenges around the world. Earlier this year, the U.S. CFTC filed a lawsuit against Binance, claiming that the exchange willfully evaded U.S. law. In April, Australia cancelled Binance's derivatives license. In June, the exchange faced investigations in France, exited Netherlands, and was ordered to stop operating in Belgium and Nigeria. A month later, the company withdrew its license application in Germany.

The strain of global regulatory pressure has affected Binance's operations. In July, Binance lost some key executives and proceeded to lay off more than 1,000 employees, or about 12.5% of its work force. Visa and MasterCard recently ended their card partnerships with Binance. This month, Binance.US lost its CEO and laid off 100 employees, around one-third of its headcount.

Given this context and the information the 0xScope team uncovered, Binance's impact on daily active address counts on Ethereum can be interpreted in various ways. The spikes that Binance's activity can be attributed to routine exchange operations that were exposed in isolated incidents. Or it can be a sign of something more significant. Nevertheless, the 0xScope team will continue monitoring the situation and watch out for other on-chain activities by Binance amid its recent situation.

‍