Symptoms

There are many *.bin files are observed in $ORACLE_BASE/audit/$ORACLE_SID.

For example:

$ ls -ltr
total 666644
-rw-------. 1 oracle oinstall 10240512 Sep 19 15:09 ora_audit_1212246579_3985105844.bin
-rw-------. 1 oracle oinstall 10241536 Sep 20 06:52 ora_audit_1212303144_3688912851.bin
-rw-------. 1 oracle oinstall    20480 Sep 20 12:02 ora_audit_1212321763_3431476539.bin
-rw-------. 1 oracle oinstall    12288 Sep 20 12:35 ora_audit_1212323740_3065638769.bin
-rw-------. 1 oracle oinstall 10241024 Sep 20 22:35 ora_audit_1212359756_874733345.bin
-rw-------. 1 oracle oinstall  1126400 Sep 21 03:40 ora_audit_1212378045_893687335.bin
-rw-------. 1 oracle oinstall 10241024 Sep 21 06:30 ora_audit_1212388214_2015242572.bin
-rw-------. 1 oracle oinstall 10240512 Sep 21 14:19 ora_audit_1212416379_363470844.bin
-rw-------. 1 oracle oinstall 10241536 Sep 22 06:02 ora_audit_1212472944_1767466054.bin
-rw-------. 1 oracle oinstall 10241536 Sep 22 21:45 ora_audit_1212529539_1413139791.bin
-rw-------. 1 oracle oinstall 10241024 Sep 23 13:28 ora_audit_1212586104_1758745070.bin
...
..
.

CAUSE

The *.bin files are Unified Auditing OS “spillover” files.  These are generated when the audit trail records cannot be written to the database.  For example, when the database is not writable (such as during database mounts), if the database is closed, or if it is read-only, then Oracle Database writes the audit records to external files in the $ORACLE_BASE/audit/$ORACLE_SID directory.
 
This is expected behavior on 12c onwards when the DB is configured for Unified Auditing.

SOLUTION

If Unified Auditing is not necessary, disabling the default Unified Auditing policies will cause the *.bin files to stop being generated.  
 
Refer to:  The UNIFIED_AUDIT_TRAIL is Getting Populated even if Unified Auditing was not explicitly enabled in 12c (Doc ID 1624051.1)

If these policies are re-enabled, one will need to periodically maintain $ORACLE_BASE/audit/$ORACLE_SID.

If one does not require the audit data in the *.bin files, these files can be safely deleted.