The case in numbers
taken from Binance's own wallets on 11 blockchains, at prices of 20:25 UTC
frozen by the companies that issue the dollar tokens
still held by the attacker in BTC, ETH, XRP, TRX, SOL, NEAR, coins with no freeze function; at prices of 20:25 UTC
from the first theft (20:05, XRP Ledger) to the first freeze (21:01, Tether)
On 29 October 2026, from 20:05 UTC, coins left Binance's own wallets on 11 blockchains. The companies that issue digital dollars such as USDT and USDC froze $2.65B of them, which can no longer move. Most of what remains is in coins with no freeze function. By value at the time of each theft, it is the biggest crypto hack so far, ahead of the theft from the LuBian mining pool (about $3.5B, December 2020) and the Bybit hack ($1.5B, February 2025): our hacks history.
Latest update: 15:33 UTC, 30 October 2026
- ArbitrumMoved by Arbitrum74.6M ARB and 8,426 ETH moved out of the attacker's address
74.56 million ARB and 8,426 ETH, nearly all that was taken there ($31.8M at 20:25 UTC prices), left the attacker's address at 00:18 UTC in two transactions it did not sign, sent through Arbitrum's emergency route by a 9-of-12 multisig.
- Ethereum512,860 ETH heldTokens sold for ETH; the ETH sits in 7 addresses
1,262 swaps sold tokens for ETH (02:18 to 11:08 UTC). The ETH now sits in 7 addresses that have never sent a transaction: 512,860 ETH, up from 494,071 ETH in 9 at 02:18 UTC. A new one, 0x03b0…20ea, got 17,260 ETH.
- Avalanche to EthereumSwapped for ETH$1.56M frozenThe AVAX became 7,243 ETH in one new address
All but 116 of the 2.26 million AVAX were swapped for USDC and sent to Ethereum through Circle's own bridge. Circle froze the first 1.56 million USDC 4 min 24 s after they arrived (29 October). The other 16.28 million USDC were swapped for ETH within 5 minutes of arriving (11:44 to 12:37 UTC): 7,243 ETH, now in 0x2948…a0ed. Circle blacklisted it at 13:27; that cannot stop ETH.
- TronTRX moving609.6M TRX in 6 addresses we follow; one keeps sending
TSpe5H…yZ8A sent all 638.20 million TRX to 5 new addresses (10:15 to 10:20 UTC); four still hold 518.20 million TRX. TRBdWq…PRki keeps sending: 75.98 million TRX in 203 transfers to 70 addresses since 02:19 UTC, which we have not followed.
- Not movedHeldBTC, XRP, SOL and NEAR: nothing sent
Bitcoin (18,270.2 BTC in 19 addresses), XRP (233.46 million), SOL (970,554), NEAR (12.41 million), and the OP, VIRTUAL and POL at the receiving address have not moved. The frozen dollar tokens are still where they were frozen.
BinanceStatementsWithdrawals still off; over $6.34B set asideAt 08:47 UTC Binance said a further check found more points of breach, and that the outflows stopped when it paused withdrawals. At 10:55 UTC: it has set aside over $6.34B of its own funds, $5B of it already in the same tokens that were taken. Withdrawals at 15:22 UTC: off for all 1,447 coin and network pairs.
Tap a line for the detail and its proof. Prices of 20:25 UTC on 29 October.
What happened
Five moves, from the first theft to Binance's clean-up. Each card links its proof on the blockchain.
- 20:05
It starts on the XRP Ledger
233.46 million XRP leave 5 Binance wallets for one new account in 4 minutes.
Proof - 20:10 to 20:22
Six more networks in 12 minutes
Binance's own wallets on six more networks send to the attacker: 18,270 BTC in one block, 612.73 million USDT on Tron, 965,455 SOL and 12.41 million NEAR.
Proof - 20:20
Ethereum: the wallet runs the attacker's code
A transaction makes Binance 14, one of Binance's Ethereum wallets, run the attacker's code, through EIP-7702 (an Ethereum feature since May 2025 that lets a wallet run a program's code). From 20:24, $3.79B leaves on Ethereum.
Proof - 21:01
The race to freeze
Tether, Circle, Ripple and the USD1 contract freeze $2.65B. Before the freezes reach them, $669M of USDT are swapped into ETH and TRX.
Proof - From 22:57
Binance moves funds within its list
On Tron, NEAR, Solana, the XRP Ledger and Bitcoin, Binance moves funds from its hot wallets (the ones it pays out from) to other wallets in its own reserves list; at 00:10 it removes the attacker's code from Binance 14.
Proof
Network by network
| Network | Taken | What | Now | Open |
|---|---|---|---|---|
| Ethereum | $3.79B | 186 assets, USDT and USDC the largest | Frozen $2.27B512,860 ETH held | |
| Bitcoin | $1.47B | 18,270.2 BTC | Held, not moved | |
| Tron | $628.1M | 612.7M USDT, 46.4M TRX | Frozen $378.7M609.6M TRX held | |
| XRP Ledger | $296.6M | 233.5M XRP | Held, not moved | |
| Solana | $96.3M | 970,522 SOL | Held, not moved | |
| NEAR | $54M | 12.4M NEAR | Held, not moved | |
| Arbitrum One | $31.8M | 74.6M ARB, 8,426 ETH | Moved by Arbitrum's admin | |
| Avalanche | $28.2M | 2.3M AVAX, 8.4M USDt | Part held, part moved on | |
| Polygon | $10.4M | 6.2M USDT0, 46.6M POL | Held at the receiving address | |
| OP Mainnet | $4.79M | 44.2M OP | Held at the receiving address | |
| Base | $2.84M | 4.7M VIRTUAL | Held at the receiving address |
BNB Chain: the same receiving address got only dust (about $33) and has sent nothing. The other 35 networks in Binance's list are below.
Every network in Binance's list
Binance's list: the wallets it publishes to show that it holds its users' coins (Proof of Reserves, 1 October 2026). Ordinary payments out stopped by 20:48 UTC on every network but Ethereum, where a few small ones followed until 22:27. On the other 35 networks, every move we could read after that went between wallets in Binance's own list.
The 35 networks with nothing taken
| Network | Wallets | Last payment out (UTC) | Binance's own moves (UTC) |
|---|---|---|---|
| AB Chain | 1 | None | No moves |
| Algorand | 2 | 20:34 | 22:57 to 23:55 |
| Aptos | 15 | 20:36 | 23:00 to 23:16 |
| Arc | 1 | 20:31 | No moves |
| Bitcoin Cash | 28 | 20:42 | 23:53 to 00:08 |
| BNB Smart Chain | 32 | 20:36 | 22:55 to 02:02 |
| Celo | 5 | 20:33 | 23:05 |
| Chiliz Chain | 6 | 19:06 | 23:06 |
| Chromia | 1 | None | No moves |
| Dogecoin | 40 | 20:39 | 23:09 to 23:27 |
| Enjin Relay Chain | 4 | 20:28 | No moves |
| Hedera | 7 | 20:35 | 23:05 |
| Kaia | 2 | 20:36 | 23:04 |
| Kava EVM | 1 | 20:34 | No moves |
| Linea | 2 | None | No moves |
| Litecoin | 23 | 20:42 | 23:10 to 01:57 |
| Manta Pacific | 7 | 20:36 | 23:05 to 02:02 |
| Metal L2 | 1 | None | No moves |
| opBNB | 3 | 20:35 | 23:06 |
| Plasma | 4 | 20:36 | 23:01 to 23:55 |
| Polkadot | 1 | None | 23:06 |
| Polkadot Asset Hub | 8 | None | No moves |
| Robinhood Chain | 1 | 19:27 | No moves |
| Ronin | 3 | 20:35 | 23:06 to 00:13 |
| Scroll | 2 | 20:18 | 23:55 |
| Sei EVM | 2 | 20:34 | 23:04 to 23:09 |
| Sonic | 12 | 20:31 | 23:05 to 02:02 |
| Starknet | 3 | 20:36 | 23:05 |
| Stellar | 11 | 20:36 | 23:55 |
| Sui | 14 | 20:38 | 22:07 to 01:56 |
| Tezos | 2 | 20:35 | 23:07 to 23:26 |
| TON | 3 | 20:37 | 23:01 to 23:55 |
| World Chain | 9 | 20:36 | 23:55 |
| Zcash | 7 | 20:38 | 23:11 to 23:15 |
| ZKsync Era | 7 | None | 23:06 to 00:18 |
From 19:00 UTC on 29 October to 04:00 UTC on 30 October 2026. Last payment out: from a listed wallet to an address outside the list. Own moves: between listed wallets, after 21:00 UTC. On these networks no listed wallet paid the attacker; after the last payment out, every move we could read went to another listed wallet (on opBNB, two wallets' BNB payments could not be read).
Is money held at Binance at risk?
- Binance saysOn X at 02:25 UTC on 30 October: Binance will cover all losses, from its SAFU emergency fund and its own funds. It puts the impact at about $6.3B and the frozen part at about $3B; our reads: $6.41B taken, $2.65B frozen by the issuers. Post on X
- How, according to BinanceIts first findings, in the same post: a DevOps engineer's compromised laptop may have let the attacker into an internal service and send unauthorized withdrawals; it found no sign of a wallet private key leak. We cannot check this on the blockchain.
- Its founder saysChangpeng Zhao on X at 21:15 UTC on 29 October: it does look like a hack; he no longer runs Binance but, as a shareholder, expects all user funds to be fully covered. Post on X
- WithdrawalsOff for all 1,447 coin and network pairs in Binance's public coin list, read at 04:36 UTC on 30 October. Binance at 04:36 UTC: they stay paused while it overhauls its withdrawal service, and it expects them back within 48 hours; deposits work as normal (at 02:25 it had said they were suspended). Post on X
- What to doFake “compensation” and “verify your account” links often follow a big hack. Open the Binance app yourself, never through a link.
Minute by minute: 51 events, every one with its transaction
28 Oct, 07:39 to 29 Oct, 08:23: the sender, the address that will send the attack's transactions on Ethereum, receives money 3 times through Tornado Cash, a mixer that hides where money comes from (about 0.1 ETH each). 0xd9e590…- 02:28:59 and 15:59:11: the sender creates two contracts (programs on the blockchain). The second is the one Binance 14 will later run. 0x97408e…
- 13:51 to 16:47: a rehearsal, in our reading. Three other wallets sign the kind of permission later used on Binance 14 (EIP-7702) for the sender's two contracts, and $13.54 in USDT and USDC is moved out of them. 0xa2e0cd…
- 20:04:52XRP Ledger: a Binance wallet tries to send 42.75 million RLUSD to a new account. It fails: the account does not exist yet. AE08D54F…
- 20:05:00First theft. 185.02 million XRP from the same wallet create that account; by 20:09:20, 5 Binance wallets have sent it 233.46 million XRP. 78E31E7B…
- 20:10:18Solana: 965,455.1 SOL leave Binance's main hot wallet for a new account; 4 more payments of 1,266.7 SOL follow by 20:33. 5YvwLFWu…
- 20:15:26NEAR: 12.41 million NEAR from 3 Binance hot wallets to one new account, created by the first payment; the last arrives at 20:22:29. BTbJWuSM…
- 20:16:19Base: 4.74 million VIRTUAL leave a Binance wallet (Binance 73) for the main receiving address. 0xc814cd…
- 20:17:30 to 20:19:51: payments of the same amounts are sent again from 4 of the emptied wallets and fail. One more, from a sixth wallet, fails too: it asks for more than that wallet holds. FE8889D1…
- 20:18:23OP Mainnet: 44.23 million OP from Binance 55. 0x10b57f…
- 20:20:00Tron: Binance's hot wallet sends 10,000 TRX, then 46,384,098 TRX and, at 20:22:45, 612,729,468 USDT to a new address; the first payment creates it. 4203af9c…
- 20:20:06Bitcoin: 11 transactions in one block (973,732) take 18,270.2 BTC from Binance's main hot wallet to one new address, which splits them in the same block into 17 lots of 1,000 BTC and one of 832.50 BTC; the last 437.70 BTC follow at 20:48. f9dcbbc6…
- 20:20:59Ethereum: Binance 14, a Binance hot wallet (always online; the exchange pays out from it), starts running the attacker's contract. The transaction carries 50 permissions signed by Binance 14 (EIP-7702). 0xad9926…
- 20:24:23Sweep 1, the largest of five (a sweep moves many of a wallet's funds in one transaction): 167,464 ETH and 63 tokens, 1.615 billion USDT among them. 0x53bd38…
- 20:24:47Binance 16, another Binance wallet, sends 28,006 ETH and 8 tokens to the same address, in 9 ordinary transactions. 0x51f263…
- 20:30 to 20:38: the money moves on. 500 million USDT, then 200 million, go to two new addresses, and 195,460 ETH to a third. 0x68d7d6…
- Arbitrum and Avalanche, 20:30 to 20:35: 74.56 million ARB and 8,426 ETH; then 1.81 million AVAX and 8.41 million USDt. 0xa18e57…
- 20:34 to 21:09: 435 million USDT are swapped for 160,451 ETH in 14 trades, at $2,711 per ETH on average: about 19% more than Coinbase. 0x290e94…
20:41:23 and 20:59:47: 823,000,000 USDC leave Binance Hot Wallet 34, a contract wallet, through Binance 14's new code. 0xdc102d…- 20:47 to 21:14: on Tron, 234 million USDT are swapped for 638.17 million TRX in 16 trades, at $0.3667 per TRX on average: about 11% more than Kraken. 60a924f7…
- 20:57:59
Aave, a lending app: another address deposits 60 million USDT and borrows 19,762 WETH (ETH in token form) in 3 minutes. 0xa85ad4… - 21:01:35
First freeze. Tether freezes the main receiving address and the first new one. By 21:18 it has frozen 8 attacker addresses on Ethereum, following the USDT from one to the next. 0x7baba4… - 21:04:23Sweep 2: 23 more token transfers and 1,700 ETH. 0x31c4c9…
- 21:04:59Circle freezes the 823,000,000 USDC at the receiving address. 0xc954c8…
- 21:09:12Tron: Tether freezes the first address with 312.73 million USDT inside, 46 min after they arrived; at 21:17:39 and 21:21:12 it freezes the next two, one already emptied. 71b0ec0f…
- 21:40:06Avalanche, 21:40 to 21:45: the receiving address sends 1,814,099 AVAX to a new address, 0x8035…c397. 0x826a01…
- 21:44:11Sweep 3: 14 more token transfers and 370 ETH, with 200.40 million USDT that land in the already frozen address. 0x55ba4d…
- 21:47:23Aave freezes 32 markets on Ethereum; Aave on Arbitrum follows at 22:15, and on Avalanche at 22:42. 0x405bee…
- 21:57:47
Sales in each token's main Uniswap pool (an automatic exchange) begin with UNI; LINK, AAVE, WBTC, ENA and ONDO follow. 0xe4430d… - 22:00:59
RLUSD's issuer (Ripple) freezes an attacker address, a “pause” in RLUSD's own word: 40.54 million RLUSD stuck, after 48 million had been swapped away. 0xafd52f… - 22:06:23Tether freezes Binance 14 itself; it held 1,351,530 USDT at 02:18 UTC. 0x312e16…
- 22:10:35
The USD1 contract freezes the 27,824,040 USD1 at the main receiving address (its freeze power sits with World Liberty and BitGo). 0x171ad4… - 22:16:35200,000 AVAX of them are swapped for 1,563,832 USDC and sent to Ethereum through Circle's own bridge (CCTP). 0x6cee27…
- 22:39:35Sweep 4: 122 more token transfers and 128 ETH, to another address, 0xa97b…8d10. 0x4a4aed…
- 22:57 to 30 October, 00:36: Binance moves 81.50 million USDT, 7.15 million TRX and 11 other tokens from its Tron hot wallet to another wallet in its own list. 16cc335d…
- 23:01:47NEAR: Binance moves the NEAR wallets' dollar tokens and 3.96 million NEAR to wallets in its own list. AZAg7GV1…
- 23:02:18Solana: Binance moves $1.07B in dollar tokens and 155,030 SOL from its hot wallet to two other wallets in its own list. 4Hekaqtf…
- 23:04:30Binance wallets still send: 444,537 AVAX on Avalanche (from Binance 113), then 46.63 million POL and 6.19 million USDT0 on Polygon (23:05, from Binance 48). 0x167311…
- 23:12:10XRP Ledger: Binance moves 26.20 million XRP from its hot wallets to another wallet in its list; 51.17 million RLUSD follow at 01:27 on 30 October. D5CC6F6D…
- 23:16:50Bitcoin: Binance moves 1,767 BTC from its hot wallet to another wallet in its list; 3 BTC more follow by 00:22 on 30 October. a2069251…
- 23:31:59Circle freezes 0xc39e…9824, 4 min 24 s after 1,563,813 USDC from the attacker's AVAX arrived there. 0x20289a…
- 23:53:35Circle freezes Binance 14, then Hot Wallet 34 at 23:54:59 (3,008,457 USDC in the two). 0xb57c21…
- 23:56:47Sweep 5: one more call to Binance 14 takes 2,962 ETH to the same address as Sweep 4, 13 min 48 s before Binance removes the code. 0x4395d5…
- 30 October, 00:06:09: on Tron, 46,383,069 TRX move from the first attacker address to a new one, which sends 1.87 million TRX of it on in 3 transfers from 02:19. 6adfc066…
- 30 October, 00:10:35: Binance 14 signs a new permission that points to nothing. The attacker's code is gone from the wallet. 0xafbf94…
- 00:18:2030 October, 00:18:20: two transactions the attacker did not sign move all 74.56 million ARB and 8,426 ETH from its Arbitrum address to 0x0000…0da0. They come from Arbitrum's emergency admin, a 9-of-12 multisig on Ethereum. 0x75e81a…
- 05:14:3530 October, 05:14: after token sales that run from 02:18 to 11:08 (1,262 swaps), the main receiving address sends 17,260 ETH to 0x03b0…20ea, a new address. 0x9edf86…
- 10:15:2130 October, 10:15 to 10:20: on Tron, TSpe5H…yZ8A sends all its 638.20 million TRX to 5 new addresses; four of them still hold 518.20 million TRX. TSpe5H…yZ8A
- 11:41:4430 October, 11:41 to 12:36: 2,058,520 AVAX are swapped for 16,282,186 USDC in 8 swaps and sent to Ethereum through the same bridge, each lot to a new address. 0xda2c2f…
- 12:40:5930 October, 12:40 to 12:44: swapped for ETH within minutes of arrival, the USDC ends up as 7,243 ETH in 0x2948…a0ed. 0x72988b…
- 13:26:5930 October, 13:26 and 13:27: Circle blacklists 0x62b1…c82e and 0x2948…a0ed, after the USDC had become ETH. 0x884b83…
All times UTC, 29 October 2026 unless another date is given.
Where the money is now
Pick a network to follow its money step by step. Every step links the address or transaction.
Frozen: $2.65B
- Tether, Ethereum$1.38B
- Tether, Tron$378.7M
- Circle$824.6M
- Ripple (RLUSD)$40.5M
- USD1$27.8M
Still with the attacker: coins with no freeze function
| Coin | Amount | Where | At 20:25 UTC | Now |
|---|---|---|---|---|
| BTC | 18,270 | 19 addresses, none moved | $1.47Bat 20:25 UTC | loadingnow |
| ETH | 512,860 | 7 addresses of 1,000 ETH or more | $1.19Bat 20:25 UTC | loadingnow |
| XRP | 233.46 million | 1 account, it has sent nothing | $296.6Mat 20:25 UTC | loadingnow |
| TRX | 609.62 million | 6 addresses we follow | $201.9Mat 20:25 UTC | loadingnow |
| SOL | 970,554 | 1 account, it has sent nothing | $96.3Mat 20:25 UTC | loadingnow |
| NEAR | 12.41 million | 1 account, it has sent nothing | $54Mat 20:25 UTC | loadingnow |
| Total | $3.30Bat 20:25 UTC | loadingnow |
Amounts at 15:26 to 15:29 UTC on 30 October. Now: CoinGecko's price when you open the page.
Ethereum$3.79B
The 1.875 billion USDT taken on Ethereum, dollar by dollar, then where each part went.
- Frozen by Tether1.380 billion USDT73.6%
- Swapped for ETH before Tether could freeze it435 million USDT23.2%
- Deposited on Aave as collateral60 million USDT3.2%
The sum closes to the cent. It counts 127.67 USDT that left 0xaa24…54a0 two minutes before its freeze, and 0.01 USDT sent in from 0x97497624…c762, an address made to look like the attacker's 0x9749292d…c762 so that people copy the wrong one.
- 20:24 to 21:44
The main receiving address
Binance wallets on six networks send to 0x5227…2f8c. On Ethereum it receives 1,875,464,711 USDT. 700 million leave before Tether freezes it at 21:01:35 with 971.15 million inside; 204.32 million more arrive after the freeze and stay stuck.
- 20:30:11
500 million USDT
To 0x9749…c762. Other traders fill 9 of its orders to swap USDT for ETH, paying 122,316 ETH for 325 million USDT. The other 175 million move on through 0x811f…e84c to 0xaa24…54a0, frozen at 21:14:59.
- 20:33:23
200 million USDT
To 0x0ddf…697e. It swaps 10 million for 3,552 ETH and passes the rest to 0x8d53…639a, which deposits 60 million on Aave and borrows 19,762 WETH against them.
- 21:01 to 21:18
Tether follows the USDT
The rest hops on through 0x77ed…c3eb, 0x7aa4…bfd1 and 0xccbe…a263; the first two swap 100 million USDT for 34,583 ETH on the way. Tether freezes 0x7aa4…bfd1 84 seconds and 0xccbe…a263 36 seconds after the USDT left them, and stops the last 30 million at 0xb171…c8c3. It had not frozen 0x77ed…c3eb by 02:18 UTC.
- 20:38:47
195,460 ETH
To 0x8532…43d4, an address that has never sent a transaction. It holds 197,460 ETH at 02:18 UTC.
- 22:39 and 23:56
- 21:22 to 00:59
- 30 Oct, 02:18 to 12:44
Sold and grouped
From 02:18 to 11:08, 0x5227…2f8c and 0xa97b…8d10 sell tokens for ETH in 1,262 swaps. The ETH is then grouped in addresses that have never sent a transaction: 17,260 ETH go to 0x03b0…20ea, a new one, 14,418 to 0x79e7…544a and 7,647 to 0x5440…c942. At 15:26 UTC, 7 such addresses hold 512,860 ETH, 7,243 ETH from Avalanche among them (see Other networks).
Bitcoin$1.47B
18,270.2 BTC in 11 transactions, all in block 973,732.
- 20:20:06
From Binance's main hot wallet
11 transactions take 18,270.2 BTC from bc1qm3…7s3h, a wallet in Binance's own list, to bc1q0m…2mnm, a new address.
- 20:20:06
Split in the same block
In the same block, the new address splits the coins: 18 more transactions leave 17 lots of exactly 1,000 BTC and one of 832.50 BTC. At 20:48 a last one gathers 437.70 BTC.
- 15:28
Not moved since
At 15:28 UTC on 30 October none of the 19 addresses had moved its coins. Bitcoin has no freeze function.
- 23:16
Binance moves funds within its list
Binance moves 1,770 BTC from the same hot wallet to 3M219K…xRP6, another wallet in its list, by 00:22 on 30 October.
The 19 addresses that hold the 18,270.2 BTC
bc1qxr…968s1,000 BTC↗bc1qnq…8t3s1,000 BTC↗bc1qs3…7s561,000 BTC↗bc1qjw…nz7w1,000 BTC↗bc1q0t…mfv31,000 BTC↗bc1qep…4lag1,000 BTC↗bc1qm2…jaat1,000 BTC↗bc1qdf…88gw1,000 BTC↗bc1q2w…znn61,000 BTC↗bc1qz8…updp1,000 BTC↗bc1qal…tca81,000 BTC↗bc1q63…sjxp1,000 BTC↗bc1qf5…a35u1,000 BTC↗bc1qs6…7w3v1,000 BTC↗bc1qm8…s2l81,000 BTC↗bc1q42…lsyx1,000 BTC↗bc1qg3…3t531,000 BTC↗bc1qrg…6zyt832.50 BTC↗bc1qxg…s9ra437.70 BTC↗
Tron$628.1M
The 612.73 million USDT taken on Tron, dollar by dollar, and the TRX.
- Frozen by Tether378.72 million USDT61.8%
- Swapped for TRX before Tether could freeze it234 million USDT38.2%
- Lent on JustLend, a lending app10,000 USDT0.0%
- 20:20 to 20:22
From Binance's Tron hot wallet
TDqSqu…hSCf, a wallet in Binance's own list, sends 46,394,098 TRX and 612,729,468 USDT to TG5iBM…zsGi, a new address that the first payment creates.
- 20:45 and 20:56
300 million USDT move on
TG5iBM…zsGi passes 100 million and then 200 million USDT to TPBkSj…bKN4; Tether freezes it at 21:09:12 with 312.73 million USDT still inside.
- 20:47 to 21:14
Swapped for TRX
TPBkSj…bKN4 swaps 234 million USDT for 638.17 million TRX in 16 trades on an on-chain exchange. It lends 10,000 USDT on JustLend, sends 65.99 million USDT to TCzBTk…7Y62, and is frozen at 21:17:39 with none left.
- 21:21:12
65.99 million USDT frozen
Tether freezes TCzBTk…7Y62 4 min 54 s after the 65.99 million USDT arrived.
- From 20:56
Where the TRX went
By 03:23 UTC on 30 October, 638.20 million TRX sat at TSpe5H…yZ8A and 44.51 million TRX at TRBdWq…PRki. From 10:15 to 10:20, TSpe5H…yZ8A sent all of its TRX to 5 new addresses; four still hold 518.20 million TRX and have sent nothing. TRBdWq…PRki keeps sending: 75.98 million TRX in 203 transfers to 70 addresses since 02:19 UTC. Unlike USDT, TRX has no issuer that can freeze it.
XRP Ledger$296.6M
233.46 million XRP from 5 Binance wallets to one account, in 4 minutes.
- 20:04:52
A failed first try
A Binance wallet tries to send 42.75 million RLUSD to rK21t6…fzMx. The payment fails: that account does not exist yet.
- 20:05 to 20:09
5 payments
8 seconds later the same wallet sends 185.02 million XRP, which creates the account; four more Binance wallets follow. All five are in Binance's own list.
- 20:17 to 20:19
The same payments again, all failed
The same amounts are sent again from 4 of the emptied wallets and fail. A payment of 14.27 million XRP from a sixth wallet, rhWj9g…LQkK, fails too because the wallet holds less, so it keeps its 14.11 million XRP.
- 15:28
Not moved
At 15:28 UTC on 30 October the account held 233,461,943.1 XRP and had sent nothing. XRP has no freeze function.
Solana$96.3M
970,521.9 SOL from Binance's main hot wallet to one new account.
- 20:10 to 20:33
- 15:28
Not moved
At 15:28 UTC on 30 October the account held 970,554.1 SOL and had sent nothing. SOL has no freeze function.
- 23:02
Binance moves funds within its list
Binance moves $1.07B in dollar tokens and 155,030 SOL from the same hot wallet to two other wallets in its list.
NEAR$54M
12.41 million NEAR from 3 Binance hot wallets to one new account, in 7 minutes.
- 20:15 to 20:22
- 15:28
Not moved
At 15:28 UTC on 30 October the account held 12,410,067.6 NEAR and had sent nothing. NEAR has no freeze function.
- 23:01
Binance moves funds within its list
Binance sends the dollar tokens of the same wallets and 3.96 million NEAR to wallets in its own list, binancecold3.near among them.
Other networks$78M
Arbitrum, Avalanche, Polygon, OP Mainnet and Base: Binance wallets sent straight to the main receiving address, 0x5227…2f8c.
| Network | Asset | Amount | Value | First (UTC) | Now |
|---|---|---|---|---|---|
| Avalanche | AVAX | 2.26 million | $19.7M | 20:33:18 | Moved on |
| Arbitrum One | ETH | 8,426 | $19.5M | 20:32:16 | Moved on |
| Arbitrum One | ARB | 74.56 million | $12.3M | 20:30:34 | Moved on |
| Avalanche | USDt | 8.41 million | $8.41M | 20:33:18 | Held |
| Polygon | USDT0 | 6.19 million | $6.19M | 23:05:55 | Held |
| OP Mainnet | OP | 44.23 million | $4.79M | 20:18:23 | Held |
| Polygon | POL | 46.63 million | $4.26M | 23:05:55 | Held |
| Base |  VIRTUAL | 4.74 million | $2.84M | 20:16:19 | Held |
Now: balances at 15:28 UTC on 30 October. Where the Arbitrum funds and the AVAX went:
- 30 Oct, 00:18
Arbitrum: moved by its emergency admin
The attacker had moved the Arbitrum funds on to 0x3e2b…32d5. At 00:18:20 UTC, two transactions it did not sign move all 74.56 million ARB and 8,426 ETH from there to 0x0000…0da0. They come from Ethereum through Arbitrum's inbox, sent by a 9-of-12 multisig that can upgrade Arbitrum's contracts; the inbox was briefly upgraded and then set back.
- 21:40 to 23:31
Avalanche: a first try, frozen
The receiving address sends 1,814,099 AVAX to 0x8035…c397. From there 200,000 AVAX are swapped for 1,563,832 USDC at 22:16 and sent to Ethereum through Circle's own bridge (CCTP), to 0xc39e…9824. They arrive at 23:27; Circle freezes them 4 min 24 s later.
- 30 Oct, 11:41 to 12:44
Avalanche: the rest becomes ETH
In 8 swaps, 2,058,520 AVAX become 16,282,186 USDC, sent to Ethereum through the same bridge, each lot to a new address. Each address swaps its USDC for ETH within 5 minutes of arrival, before any freeze, and the ETH gathers in 0x2948…a0ed: 7,242.76 ETH by 12:44. Circle blacklists that address at 13:27, but a USDC blacklist cannot stop ETH. Of the 2,258,635.9 AVAX taken, 2,258,519.7 were swapped.
What was frozen, and what cannot be
Frozen: the address can no longer send that token. Every freeze here came from a token whose code gives someone that power; for these dollar tokens, that is the company that issues them.
Tether1.380 billion on Ethereum, in 3 of the 8 attacker addresses it blocked from 21:01 to 21:18; 378.72 million on Tron, in 2 of 3 (21:09 to 21:21).
Also Binance 14 itself, at 22:06.
Circle823 million frozen at 21:04:59 at the main receiving address; 1,563,813 more at 23:31:59, at 0xc39e…9824, which got them from the attacker's AVAX through Circle's own bridge.
Also Binance 14 and Hot Wallet 34, at 23:53 and 23:54.
Ripple (RLUSD)frozen (“paused”, in RLUSD's own word) at 22:00:59, after 48 million had been swapped away.
Also Binance 14, at 22:20.
USD1 (World Liberty, BitGo)frozen by the USD1 contract at 22:10:35, at the main receiving address.
Also Binance 14, at 22:26.
Aavefrozen on Ethereum, Arbitrum and Avalanche: no new deposits or loans; withdrawals and repayments still work.
The attacker's loan is still open: 60 million USDT deposited, 19,762.7 WETH owed.
No one can freeze BTC, ETH, TRX, XRP, SOL, NEAR or tokens such as UNI or LINK the way these dollar tokens were frozen: their code has no such function.
The race: every attacker address Tether froze
5 freezes caught the dollars inside; 6 came seconds or minutes after the USDT had left.
- 21:01:35
0x5227…2f8cCaught 971.15 million USDT; 204.32 million more arrived after↗ - 21:01:35
0x9749…c762Empty: the USDT left 2 min 24 s earlier↗ - 21:01:47
0x0ddf…697eEmpty: the USDT left 8 min 48 s earlier↗ - 21:02:47
0x8d53…639aEmpty: the USDT left 48 s earlier↗ - 21:09:12
TG5iBM…zsGiCaught 312.73 million USDT↗ - 21:12:35
0x7aa4…bfd1Empty: the USDT left 1 min 24 s earlier↗ - 21:14:59
0xaa24…54a0Caught 175 million USDT↗ - 21:16:47
0xccbe…a263Empty: the USDT left 36 s earlier↗ - 21:17:39
TPBkSj…bKN4Empty: the USDT left 1 min 21 s earlier↗ - 21:18:59
0xb171…c8c3Caught 30 million USDT↗ - 21:21:12
TCzBTk…7Y62Caught 65.99 million USDT↗
Frozen balances read at 02:18 UTC on Ethereum and 03:23 UTC on Tron; each freeze read from the token's own contract.
Swapped at a premium, before the freezes
Before the freezes reached them, $669M of USDT were swapped into ETH and TRX, coins with no freeze function, at prices well above the market (each trade against the 5-minute price bar it fell in).
435 million USDT for 160,451 ETH, $2,711 per ETH
above Coinbase, in 14 trades from 20:34 to 21:09.
234 million USDT for 638.17 million TRX, $0.3667 per TRX
above Kraken, in 16 trades from 20:47 to 21:14.
Ethereum: the ETH price, and each of the attacker's trades
Tron: the TRX price, and each of the attacker's trades
The 14 Ethereum trades and 16 Tron trades, one by one
| Address | Paid | Got | Per ETH | vs Coinbase |
|---|---|---|---|---|
| 0x9749…c7629 trades, filled by others | 325 million USDT | 122,316 ETH | $2,657 | +16.3% |
| 0x0ddf…697e1 trade | 10 million USDT | 3,552 ETH | $2,815 | +24.6% |
| 0x77ed…c3eb2 trades | 50 million USDT | 18,085 ETH | $2,765 | +22.6% |
| 0x7aa4…bfd12 trades | 50 million USDT | 16,498 ETH | $3,031 | +34.0% |
| Time (UTC) | Paid | Got | Per TRX | vs Kraken |
|---|---|---|---|---|
| 20:47:27 ↗ | 10 million USDT | 30,049,681 TRX | $0.3328 | +0.2% |
| 20:48:06 ↗ | 30 million USDT | 88,191,900 TRX | $0.3402 | +2.4% |
| 20:49:00 ↗ | 30 million USDT | 85,903,110 TRX | $0.3492 | +5.2% |
| 20:51:12 ↗ | 10 million USDT | 28,290,408 TRX | $0.3535 | +6.9% |
| 20:52:00 ↗ | 10 million USDT | 28,064,383 TRX | $0.3563 | +7.8% |
| 20:53:06 ↗ | 10 million USDT | 27,823,756 TRX | $0.3594 | +8.7% |
| 20:56:54 ↗ | 30 million USDT | 81,592,369 TRX | $0.3677 | +11.6% |
| 20:57:33 ↗ | 30 million USDT | 79,525,236 TRX | $0.3772 | +14.5% |
| 20:59:36 ↗ | 30 million USDT | 77,495,565 TRX | $0.3871 | +17.5% |
| 21:02:42 ↗ | 20 million USDT | 51,056,112 TRX | $0.3917 | +18.5% |
| 21:04:09 ↗ | 10 million USDT | 25,248,833 TRX | $0.3961 | +19.8% |
| 21:05:45 ↗ | 5 million USDT | 12,567,393 TRX | $0.3979 | +18.1% |
| 21:06:42 ↗ | 3 million USDT | 7,520,337 TRX | $0.3989 | +18.4% |
| 21:08:18 ↗ | 2 million USDT | 5,019,493 TRX | $0.3984 | +18.2% |
| 21:11:54 ↗ | 2 million USDT | 5,006,565 TRX | $0.3995 | +17.1% |
| 21:14:12 ↗ | 2 million USDT | 4,817,617 TRX | $0.4151 | +21.7% |
ETH and TRX received in each trade read from the transaction itself. “vs Coinbase” and “vs Kraken”: the dollars paid against what the same coins were worth there, at the 5-minute price bar of each trade.
Sold out: the price before the selling, its low while it lasted, at the end, and now
| Token | Before (UTC) | Lowest while selling | Finished (UTC) | Now | Since finished |
|---|---|---|---|---|---|
| UNI7.02 million UNI swapped away | $6.603before 21:51 | $6.235lowest 22:00 to 22:05, −5.6% | $6.519finished 22:42, −1.3% | loadingnow | since finished |
 PEPE7.77 trillion PEPE swapped away | $0.00000466before 22:01 | $0.00000438lowest 23:05 to 23:10, −6.0% | $0.00000455finished 23:31, −2.4% | loadingnow | since finished |
 LINK2.57 million LINK swapped away | $10.95before 22:37 | $10.51lowest 23:40 to 23:45, −4.0% | $10.58finished 00:02, −3.4% | loadingnow | since finished |
| AAVE127,953 AAVE swapped away | $124.76before 22:39 | $118.69lowest 22:55 to 23:00, −4.9% | $119.85finished 22:58, −3.9% | loadingnow | since finished |
 WBTC167.14 WBTC swapped away | $78,967before 22:43 | $78,727lowest 22:45 to 22:50, −0.3% | $78,862finished 22:45, −0.1% | loadingnow | since finished |
 ENA217.50 million ENA swapped away | $0.1788before 22:51 | $0.1655lowest 00:20 to 00:25, −7.5% | $0.1722finished 00:41, −3.7% | loadingnow | since finished |
 ONDO21.85 million ONDO swapped away | $0.3867before 23:01 | $0.3768lowest 23:10 to 23:15, −2.6% | $0.3826finished 23:19, −1.1% | loadingnow | since finished |
Before: Coinbase's price at the start of the 5-minute bar of the first transfer out of the wallet that held the token; lowest: Coinbase's lowest trade in the 5-minute bars while the wallet was selling; finished: the close of the bar of the last transfer (BTC for WBTC). The changes are against the price before. Over the same spans ETH moved between −2.8% and 0.0%. Now: CoinGecko's price when you open this page (BTC's for WBTC).
Each token's price from 20:25 UTC (20:25 = 100)
UNI−8.8% since 20:25LINK−8.3% since 20:25AAVE−10.0% since 20:25ENA−16.9% since 20:25ONDO−7.8% since 20:25PEPE−13.2% since 20:25Orange: the token on Coinbase, to 00:10 UTC on 30 October. Grey: ETH, which moved −3.3% over the same time. Shaded: when its wallet sold it in the token's main Uniswap pool.
The addresses in the case
111 addresses on 11 networks. Binance's wallets are the ones in its own reserves list. The attacker's are the sender, its contract, and the addresses we followed the money to, up to the ones marked “not followed further”; trades and deposits into apps are left out.
Paste any address from Bitcoin, Ethereum, Tron, XRP Ledger, Solana, NEAR or the other networks. The check runs in your browser; nothing is sent anywhere.
- Binance 14BinanceFrozen
Hot wallet taken over with EIP-7702; its code is empty again since 00:10 on 30 October.
- Binance 16Binance
Sent 28,006 ETH and 8 tokens in 9 ordinary transactions.
- Binance Hot Wallet 34BinanceFrozen
Contract wallet; Binance 14's new code made it send 823,000,000 USDC.
- Binance 56Binance
Sent to the main receiving address on Arbitrum One.
- Binance 73Binance
Sent to the main receiving address on Base.
- Binance 89Binance
Sent to the main receiving address on Arbitrum One.
- Binance 118Binance
Sent to the main receiving address on Avalanche.
- Binance 85Binance
Sent to the main receiving address on Avalanche.
- Binance 113Binance
Sent to the main receiving address on Avalanche.
- Binance 49Binance
Sent to the main receiving address on Avalanche.
- Binance 110Binance
Sent to the main receiving address on Avalanche.
- Binance 55Binance
Sent to the main receiving address on OP Mainnet.
- Binance 54Binance
Sent to the main receiving address on Arbitrum One.
- Binance 48Binance
Sent to the main receiving address on Polygon.
- Binance: Hot Wallet 1Binance
Sent to the main receiving address on Arbitrum One.
- Binance Tron hot walletBinance
Sent 612.73 million USDT and 46.39 million TRX to the attacker.
- Binance Tron walletBinance
Received 81.50 million USDT and other tokens from the hot wallet, from 22:57.
- Binance XRP walletBinance
Sent 185.02 million XRP to the attacker at 20:05:00.
- Binance XRP walletBinance
Sent 14.69 million XRP to the attacker at 20:07:00.
- Binance XRP walletBinance
Sent 13.14 million XRP to the attacker at 20:08:20.
- Binance XRP walletBinance
Sent 11.96 million XRP to the attacker at 20:08:50.
- Binance XRP walletBinance
Sent 8.66 million XRP to the attacker at 20:09:20.
- Binance XRP walletBinance
A payment of 14.27 million XRP to the attacker failed; Binance later moved its XRP to another wallet in its list.
- Binance XRP walletBinance
Received 26.20 million XRP from the hot wallets, from 23:12.
- Binance main Bitcoin hot walletBinance
Sent 18,270.2 BTC to the attacker in block 973,732.
- Binance Bitcoin walletBinance
Received 1,770 BTC from the hot wallet from 23:16.
- Binance main Solana hot walletBinance
Sent 970,521.9 SOL to the attacker.
- Binance Solana walletBinance
Received funds from the hot wallet at 23:02.
- Binance Solana walletBinance
Received funds from the hot wallet at 23:02.
- Binance NEAR hot walletBinance
Sent 8.09 million NEAR to the attacker at 20:15:26.
- Binance NEAR hot walletBinance
Sent 2.20 million NEAR to the attacker at 20:22:03.
- Binance NEAR hot walletBinance
Sent 2.12 million NEAR to the attacker at 20:22:29.
- Binance NEAR walletBinance
Received the NEAR hot wallets' dollar tokens from 23:01.
- Main receiving addressAttackerFrozen
All six EVM networks. Frozen: 1.175 billion USDT, 823 million USDC, 27.82 million USD1. On 30 October it sold tokens for ETH and sent 17,260 ETH to 0x03b0…20ea; it holds 4.5 ETH at 15:26 UTC.
- The senderAttacker
Paid through Tornado Cash; sent the takeover and the sweeps.
- The contract Binance 14 ranAttacker
Created 15:59:11; active on Binance 14 until 00:10:35 on 30 October.
- Attacker addressAttackerFrozen
Got 500 million USDT; frozen, empty.
- Attacker addressAttackerFrozen
Got 200 million USDT; frozen, empty.
- Attacker addressAttackerFrozen
Aave loan: 60 million USDT deposited, 19,762.7 WETH owed; frozen.
- Attacker addressAttackerFrozen
USDT hop; frozen, empty.
- Attacker addressAttackerFrozen
USDT hop; frozen, empty.
- Attacker addressAttackerFrozen
Frozen with 175 million USDT inside.
- Attacker addressAttackerFrozen
Frozen with 30 million USDT inside.
- Attacker addressAttackerFrozen
RLUSD paused: 40.54 million stuck.
- Attacker addressAttacker
USDT hop; not frozen as of 02:18 UTC.
- Attacker addressAttacker
USDT hop: got 175 million USDT from 0x9749…c762 at 20:59:11 and passed it to 0xaa24…54a0; not frozen as of 02:18 UTC.
- Attacker addressAttacker
Got 127.67 USDT from 0xaa24…54a0 at 21:12:59, before its freeze; not followed further.
- Attacker addressAttacker
Got 0.5 ETH from the main receiving address at 21:29:47. On Arbitrum it held the attacker's ARB and ETH until Arbitrum's admin moved them at 00:18:20 UTC on 30 October; on Avalanche it passed 5,009 AVAX on to 0x2ef0…f033.
- Attacker addressAttacker
Got 1.0 ETH from the main receiving address at 21:54:11; not followed further.
- Holds attacker ETHAttacker
Holds 197,460 ETH at 15:26 UTC on 30 October; never sent a transaction.
- Holds attacker ETHAttacker
Holds 137,602 ETH at 15:26 UTC on 30 October; never sent a transaction.
- Holds attacker ETHAttacker
Holds 78,415 ETH at 15:26 UTC on 30 October; never sent a transaction.
- Holds attacker ETHAttacker
Holds 40,601 ETH at 15:26 UTC on 30 October; never sent a transaction.
- Holds attacker ETHAttacker
Holds 34,280 ETH at 15:26 UTC on 30 October; never sent a transaction.
- Attacker addressAttacker
Held 11,561 ETH at 02:18 UTC; sent it to 0x79e7…544a at 05:30 to 05:33 on 30 October.
- Attacker addressAttacker
Held 2,857 ETH at 02:18 UTC; sent it to 0x79e7…544a at 05:30 to 05:33 on 30 October.
- Attacker addressAttacker
Held 1,780 ETH at 02:18 UTC; sent it to 0x5440…c942 at 06:34 to 06:36 on 30 October.
- Token walletAttacker
Received ONDO and UNI. Sold or passed on the ONDO and UNI.
- Token walletAttacker
Received RLUSD. Sold or passed on the RLUSD.
- Token walletAttacker
Received PEPE. Sold or passed on the PEPE.
- Token walletAttacker
Received ENA and wBETH. Sold or passed on the ENA. Still holds 29,934 wBETH.
- Attacker address, TronAttackerFrozen
Frozen with 312.73 million USDT inside.
- Attacker address, TronAttackerFrozen
Swapped 234 million USDT for TRX; frozen, empty.
- Attacker address, TronAttackerFrozen
Frozen with 65.99 million USDT inside.
- Attacker address, TronAttacker
Held 638.20 million TRX; sent all of it to 5 new addresses from 10:15 to 10:20 UTC on 30 October.
- Holds attacker TRXAttacker
Holds 90.40 million TRX at 15:29 UTC on 30 October; has sent 75.98 million TRX in 203 transfers to 70 addresses since 02:19 UTC.
- Attacker address, TronAttacker
Got 1.68 million TRX from TRBdWq…PRki at 02:19 on 30 October; not followed further.
- Attacker address, TronAttacker
Got 194,624 TRX from TRBdWq…PRki in 2 transfers, 03:05 to 03:23 on 30 October; not followed further.
- Attacker account, XRP LedgerAttacker
Holds 233.46 million XRP; has sent nothing.
- Attacker address, BitcoinAttacker
Received 18,270.2 BTC and split them into 19 addresses, 18 of them in the same block; now empty.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 1,000.00 BTC, not moved.
- Holds attacker BTCAttacker
Holds 832.50 BTC, not moved.
- Holds attacker BTCAttacker
Holds 437.70 BTC, not moved.
- Attacker account, SolanaAttacker
Holds 970,549 SOL; has sent nothing.
- Attacker account, NEARAttacker
Holds 12.41 million NEAR; has sent nothing.
- Look-alike addressLook-alike
Made to look like the attacker's 0x9749…c762 so that people copy the wrong one.
- Holds attacker ETHAttacker
Got 17,260.1 ETH from the main receiving address at 05:14 to 05:15 on 30 October; holds 17,260.1 ETH; never sent a transaction.
- Holds attacker ETHAttacker
Holds 7,242.76 ETH bought with the attacker's AVAX, sent in from 12:40 to 12:44 on 30 October; never sent a transaction. Circle blacklisted it at 13:27; that stops USDC, not ETH.
- Attacker addressAttackerFrozen
On Avalanche it passed the attacker's AVAX on. On Ethereum it got 1,563,813 USDC through Circle's bridge at 23:27 on 29 October; Circle froze it at 23:31 with the USDC inside.
- Attacker address, AvalancheAttacker
Got 1,814,099 AVAX from the main receiving address at 21:40 to 21:45 on 29 October and passed them on: 1,608,889 AVAX to 0xad45…e8b5 at 11:38 on 30 October.
- Attacker address, AvalancheAttacker
Swapped 200,000 AVAX for 1,563,832 USDC at 22:16 on 29 October and sent them to Ethereum through Circle's bridge, where Circle froze them.
- Attacker address, AvalancheAttacker
Swapped 1,608,876 AVAX for 12,804,977 USDC in 6 swaps from 11:41 to 12:21 on 30 October, each paid to a new address that sent it on to Ethereum.
- Attacker address, AvalancheAttacker
Got the main receiving address's last 444,536 AVAX on 30 October and swapped 449,643 AVAX for 3,477,209 USDC, paid to 0x62b1…c82e.
- Attacker addressAttacker
Got 849,491 USDC from swapped AVAX on Avalanche on 30 October, sent them to Ethereum through Circle's bridge, swapped them for ETH and sent 378.7 ETH to 0x2948…a0ed.
- Attacker addressAttacker
Got 2,025,660 USDC from swapped AVAX on Avalanche on 30 October, sent them to Ethereum through Circle's bridge, swapped them for ETH and sent 901.6 ETH to 0x2948…a0ed.
- Attacker addressAttacker
Got 2,493,207 USDC from swapped AVAX on Avalanche on 30 October, sent them to Ethereum through Circle's bridge, swapped them for ETH and sent 1,109.9 ETH to 0x2948…a0ed.
- Attacker addressAttacker
Got 2,370,641 USDC from swapped AVAX on Avalanche on 30 October, sent them to Ethereum through Circle's bridge, swapped them for ETH and sent 1,052.9 ETH to 0x56c3…2714.
- Attacker addressAttacker
Got 2,370,418 USDC from swapped AVAX on Avalanche on 30 October, sent them to Ethereum through Circle's bridge, swapped them for ETH and sent 2,107.1 ETH to 0x2948…a0ed.
- Attacker addressAttacker
Got 2,695,560 USDC from swapped AVAX on Avalanche on 30 October, sent them to Ethereum through Circle's bridge, swapped them for ETH and sent 1,199.4 ETH to 0x2948…a0ed.
- Attacker addressAttacker
Got 3,477,209 USDC from swapped AVAX on Avalanche on 30 October, sent them to Ethereum through Circle's bridge, swapped them for ETH and sent 1,545.8 ETH to 0x2948…a0ed. Circle blacklisted it at 13:26, after the USDC had left.
- Attacker address, TronAttacker
Got 120 million TRX from TSpe5H…yZ8A between 10:15 and 10:20 UTC on 30 October and passed them to TRBdWq…PRki.
- Holds attacker TRXAttacker
Got 120 million TRX from TSpe5H…yZ8A between 10:15 and 10:20 UTC on 30 October; holds 120 million TRX; has sent nothing.
- Holds attacker TRXAttacker
Got 120 million TRX from TSpe5H…yZ8A between 10:15 and 10:20 UTC on 30 October; holds 120 million TRX; has sent nothing.
- Holds attacker TRXAttacker
Got 120 million TRX from TSpe5H…yZ8A between 10:15 and 10:20 UTC on 30 October; holds 120 million TRX; has sent nothing.
- Holds attacker TRXAttacker
Got 158.20 million TRX from TSpe5H…yZ8A between 10:15 and 10:20 UTC on 30 October; holds 158.20 million TRX; has sent nothing.
How we checked
For anyone who wants to check our work: the sources, the rules we followed, and what we do not know.
Where we read each network, and when
| Network | Source | Read (UTC, 30 Oct) |
|---|---|---|
| Ethereum | ethereum-rpc.publicnode.com; traces and past balances from eth.drpc.org | 02:18 |
| Bitcoin | mempool.space and blockstream.info (Esplora API) | 03:39 |
| Tron | api.trongrid.io | 03:26 |
| XRP Ledger | xrplcluster.com (full-history servers) | 03:34 |
| Solana | solana.publicnode.com, api.mainnet-beta.solana.com | 03:50 |
| NEAR | api.nearblocks.io, rpc.mainnet.near.org | 05:51 |
| Arbitrum, OP Mainnet, Avalanche, Base, Polygon | arb1.arbitrum.io, mainnet.optimism.io, publicnode.com | 00:02 |
| BNB Chain | bsc-rpc.publicnode.com | 02:10 |
| All 46 networks in Binance's list | a public node or explorer for each network, 531 wallets | 07:49 |
Each network's time is when the attacker's addresses there were read; the last row is the read of Binance's wallets on every network. Latest update: we read every attacker address again, and the new ones, from 14:49 to 15:33 UTC on 30 October, through the same servers, with Avalanche through api.routescan.io and its public node.
Method
- Every coin amount, address and time is our own read of the blockchains through public servers (table above), not a third party's count. What counts as a transfer: on EVM networks the token's Transfer events and, for ETH moved inside contract calls, the transaction traces; on Bitcoin the transaction's inputs and outputs; on Tron the TRC-20 Transfer events and TRX transfers; on the XRP Ledger each Payment's delivered amount and result; on Solana each transaction's balance changes; on NEAR and the other networks, the transfers that each network's node or explorer reports.
- Binance's wallets: every wallet this page calls Binance's is in Binance's own Proof of Reserves list (audit PR01OCT26, balances of 1 October 2026; file wallet_address_20261001.zip, linked from Binance's Proof of Reserves page and served from public.bnbstatic.com; SHA-256 of its wallet CSV 4eb9cc23e6a7eae3…). None of the attacker's addresses is in it.
- The attacker's addresses: the sender of the takeover, the contract it ran, and every address that got the money from a Binance wallet that night or from such an address, other than in a trade or a deposit into an app. Etherscan labels 19 of the Ethereum ones “Binance Hot Wallet Exploiter”; we found them by following the transfers, not by the labels. That the same attacker controls the addresses on all 11 networks is our reading: on 10 of them the first payment came between 20:05 and 20:33 UTC, and on the six EVM networks Binance's wallets paid the same address. The blockchains cannot prove it.
- Every network in Binance's list: for each of the 46 networks we read every listed wallet (531) from 19:00 UTC on 29 October to 04:00 UTC on 30 October and sorted each payment out: to another listed wallet, to the attacker, or to anyone else. A Bitcoin-style payment counts as Binance's own move only if every coin that left came back to listed addresses. Where a first read could miss payments in a network's own coin, we then read every transaction each wallet signed after the network's last payment out (on EVM networks, found by its transaction count). Every time shown was read from its block.
- Freezes: the tokens' own events, Tether's AddedBlackList on Ethereum and Tron, Circle's Blacklisted, RLUSD's AccountPaused and USD1's Freeze, and the balances read after them. Aave's market freezes: its ReserveFrozen events on each network.
- The 50 permissions on Ethereum: each signature recovered with secp256k1 over keccak256(0x05 || rlp([chain_id, address, nonce])), as EIP-7702 defines; all 50 give Binance 14, chain 1, the same contract. Which one took effect: Binance 14's transaction count read just before and after that block (18,914,808 to 18,914,810).
- Checks that close: the USDT taken on Ethereum and on Tron each add up to the cent across frozen, swapped and lent; the 19 Bitcoin outputs add up to the 18,270.2 BTC taken, less 0.0001 BTC in fees; each ETH swap matches the address's balance change, and each TRX swap is read from the transaction's own transfers.
- Prices of 20:25 UTC (the close of the 20:20 to 20:25 bar): Coinbase for ETH, BTC and the main tokens; Kraken for TRX, XRP, SOL, NEAR and XAUt; DefiLlama for the other 158 tokens, by contract address; dollar tokens at $1.00. One token, IDRT (5.550 billion), had no price at these sources and counts as $0. Live prices: CoinGecko, through this site's own server.
- Statements: Binance's posts on X at 02:25, 04:36, 08:47 and 10:55 UTC on 30 October 2026 and its founder Changpeng Zhao's at 21:15 UTC on 29 October, as published, each read in full on its own page (the first two at 08:04 UTC, the others by 15:33 UTC). Binance also shared a video message from its co-CEO at 14:34 UTC, which we did not transcribe. We did not check what any company says about its own systems.
What we do not know
- The full attack path. Binance says a compromised computer may be the entry point and that a report with the root cause will follow (04:36 UTC); at 08:47 UTC it said its investigation had found more points of breach.
- What Binance's figures count: about $6.3B of impact against our $6.41B at 20:25 UTC prices, and about $3B frozen against the $2.65B we read frozen on the attacker's addresses.
- Who did it. Binance has named no one, and we saw no attribution backed by evidence.
- Wallets that are not in Binance's list of 1 October 2026, and its users' deposit addresses (the list's second file, 778 MB): we did not read them.
- On opBNB, the BNB payments of two listed wallets, 0x98ad…ba9d and 0xf977…acec: no public node keeps the past state we would need. Neither moved a token in the window, and the third, its busiest wallet, has every transaction accounted for.
- Where the coins went after the last addresses we followed, for example the 75.98 million TRX that TRBdWq…PRki sent to 70 addresses by 15:28 UTC on 30 October.
- What happens next to the Arbitrum funds that Arbitrum's emergency admin moved to 0x0000…0da0.
Read our research
Educational only, not investment advice; do your own research. On-chain reads to 15:33 UTC, 30 October 2026; prices from Coinbase, Kraken and DefiLlama; statements as published. Powered by CoinGecko.