Back to Panoptic Protocol

Latest hack

Binance hack where $6.4B went

The case in numbers

Open case: coins are still movingOur reads to 07:49 UTC, 30 October 2026
$6.41B

taken from Binance's own wallets on 11 blockchains, at prices of 20:25 UTC

EthereumBitcoinTronXRP LedgerSolanaNEARArbitrum OneAvalanchePolygonOP MainnetBase
$2.65B

frozen by the companies that issue the dollar tokens

$3.28B

still held by the attacker in BTC, ETH, XRP, TRX, SOL, NEAR, coins with no freeze function; at prices of 20:25 UTC

57 min

from the first theft (20:05, XRP Ledger) to the first freeze (21:01, Tether)

On 29 October 2026, from 20:05 UTC, coins left Binance's own wallets on 11 blockchains. The companies that issue digital dollars such as USDT and USDC froze $2.65B of them, which can no longer move. Most of what remains is in coins with no freeze function.

What happened

Five moves, from the first theft to Binance's clean-up. Each card links its proof on the blockchain.

  1. 20:05XRP Ledger

    It starts on the XRP Ledger

    233.46 million XRP leave 5 Binance wallets for one new account in 4 minutes.

    Proof
  2. 20:10 to 20:22SolanaNEARBaseOP MainnetBitcoinTron

    Six more networks in 12 minutes

    Binance's own wallets on six more networks send to the attacker: 18,270 BTC in one block, 612.73 million USDT on Tron, 965,455 SOL and 12.41 million NEAR.

    Proof
  3. 20:20Ethereum

    Ethereum: the wallet runs the attacker's code

    A transaction makes Binance 14, one of Binance's Ethereum wallets, run the attacker's code, through EIP-7702 (an Ethereum feature since May 2025 that lets a wallet run a program's code). From 20:24, $3.79B leaves on Ethereum.

    Proof
  4. 21:01EthereumTron

    The race to freeze

    Tether, Circle, Ripple and the USD1 contract freeze $2.65B. Before the freezes reach them, $669M of USDT are swapped into ETH and TRX.

    Proof
  5. From 22:57TronNEARSolanaXRP LedgerBitcoin

    Binance moves funds within its list

    On Tron, NEAR, Solana, the XRP Ledger and Bitcoin, Binance moves funds from its hot wallets (the ones it pays out from) to other wallets in its own reserves list; at 00:10 it removes the attacker's code from Binance 14.

    Proof

Network by network

What was taken on each network, and where it is now
NetworkTakenWhatNowOpen
Ethereum$3.79B186 assets, USDT and USDC the largestFrozen $2.27B494,071 ETH held
Bitcoin$1.47B18,270.2 BTCHeld, not moved
Tron$628.1M612.7M USDT, 46.4M TRXFrozen $378.7M682.7M TRX held
XRP Ledger$296.6M233.5M XRPHeld, not moved
Solana$96.3M970,522 SOLHeld, not moved
NEAR$54M12.4M NEARHeld, not moved
Arbitrum One$31.8M74.6M ARB, 8,426 ETHMoved on, not followed
Avalanche$28.2M2.3M AVAX, 8.4M USDtPart held, part moved on
Polygon$10.4M6.2M USDT0, 46.6M POLHeld at the receiving address
OP Mainnet$4.79M44.2M OPHeld at the receiving address
Base$2.84M4.7M VIRTUALHeld at the receiving address

BNB Chain: the same receiving address got only dust (about $33) and has sent nothing. The other 35 networks in Binance's list are below.

Every network in Binance's list

46networks in Binance's list, 531 wallets read
11with coins taken
35with nothing taken
1,447coin and network pairs in Binance's coin list at 04:36 UTC, all with withdrawals off

Binance's list: the wallets it publishes to show that it holds its users' coins (Proof of Reserves, 1 October 2026). Ordinary payments out stopped by 20:48 UTC on every network but Ethereum, where a few small ones followed until 22:27. On the other 35 networks, every move we could read after that went between wallets in Binance's own list.

The 35 networks with nothing taken
NetworkWalletsLast payment out (UTC)Binance's own moves (UTC)
AB Chain1NoneNo moves
Algorand220:3422:57 to 23:55
Aptos1520:3623:00 to 23:16
Arc120:31No moves
Bitcoin Cash2820:4223:53 to 00:08
BNB Smart Chain3220:3622:55 to 02:02
Celo520:3323:05
Chiliz Chain619:0623:06
Chromia1NoneNo moves
Dogecoin4020:3923:09 to 23:27
Enjin Relay Chain420:28No moves
Hedera720:3523:05
Kaia220:3623:04
Kava EVM120:34No moves
Linea2NoneNo moves
Litecoin2320:4223:10 to 01:57
Manta Pacific720:3623:05 to 02:02
Metal L21NoneNo moves
opBNB320:3523:06
Plasma420:3623:01 to 23:55
Polkadot1None23:06
Polkadot Asset Hub8NoneNo moves
Robinhood Chain119:27No moves
Ronin320:3523:06 to 00:13
Scroll220:1823:55
Sei EVM220:3423:04 to 23:09
Sonic1220:3123:05 to 02:02
Starknet320:3623:05
Stellar1120:3623:55
Sui1420:3822:07 to 01:56
Tezos220:3523:07 to 23:26
TON320:3723:01 to 23:55
World Chain920:3623:55
Zcash720:3823:11 to 23:15
ZKsync Era7None23:06 to 00:18

From 19:00 UTC on 29 October to 04:00 UTC on 30 October 2026. Last payment out: from a listed wallet to an address outside the list. Own moves: between listed wallets, after 21:00 UTC. On these networks no listed wallet paid the attacker; after the last payment out, every move we could read went to another listed wallet (on opBNB, two wallets' BNB payments could not be read).

Is money held at Binance at risk?

  • Binance saysOn X at 02:25 UTC on 30 October: Binance will cover all losses, from its SAFU emergency fund and its own funds. It puts the impact at about $6.3B and the frozen part at about $3B; our reads: $6.41B taken, $2.65B frozen by the issuers. Post on X
  • How, according to BinanceIts first findings, in the same post: a DevOps engineer's compromised laptop may have let the attacker into an internal service and send unauthorized withdrawals; it found no sign of a wallet private key leak. We cannot check this on the blockchain.
  • Its founder saysChangpeng Zhao on X at 21:15 UTC on 29 October: it does look like a hack; he no longer runs Binance but, as a shareholder, expects all user funds to be fully covered. Post on X
  • WithdrawalsOff for all 1,447 coin and network pairs in Binance's public coin list, read at 04:36 UTC on 30 October. Binance at 04:36 UTC: they stay paused while it overhauls its withdrawal service, and it expects them back within 48 hours; deposits work as normal (at 02:25 it had said they were suspended). Post on X
  • What to doFake “compensation” and “verify your account” links often follow a big hack. Open the Binance app yourself, never through a link.
Minute by minute: 42 events, every one with its transaction
  1. Ethereum28 Oct, 07:39 to 29 Oct, 08:23: the sender, the address that will send the attack's transactions on Ethereum, receives money 3 times through Tornado Cash, a mixer that hides where money comes from (about 0.1 ETH each). 0xd9e590…
  2. Ethereum02:28:59 and 15:59:11: the sender creates two contracts (programs on the blockchain). The second is the one Binance 14 will later run. 0x97408e…
  3. Ethereum13:51 to 16:47: a rehearsal, in our reading. Three other wallets sign the kind of permission later used on Binance 14 (EIP-7702) for the sender's two contracts, and $13.54 in USDT and USDC is moved out of them. 0xa2e0cd…
  4. 20:04:52XRP LedgerXRP Ledger: a Binance wallet tries to send 42.75 million RLUSD to a new account. It fails: the account does not exist yet. AE08D54F…
  5. 20:05:00XRP LedgerFirst theft. 185.02 million XRP from the same wallet create that account; by 20:09:20, 5 Binance wallets have sent it 233.46 million XRP. 78E31E7B…
  6. 20:10:18SolanaSolana: 965,455.1 SOL leave Binance's main hot wallet for a new account; 4 more payments of 1,266.7 SOL follow by 20:33. 5YvwLFWu…
  7. 20:15:26NEARNEAR: 12.41 million NEAR from 3 Binance hot wallets to one new account, created by the first payment; the last arrives at 20:22:29. BTbJWuSM…
  8. 20:16:19BaseBase: 4.74 million VIRTUAL leave a Binance wallet (Binance 73) for the main receiving address. 0xc814cd…
  9. XRP Ledger20:17:30 to 20:19:51: payments of the same amounts are sent again from 4 of the emptied wallets and fail. One more, from a sixth wallet, fails too: it asks for more than that wallet holds. FE8889D1…
  10. 20:18:23OP MainnetOP Mainnet: 44.23 million OP from Binance 55. 0x10b57f…
  11. 20:20:00TronTron: Binance's hot wallet sends 10,000 TRX, then 46,384,098 TRX and, at 20:22:45, 612,729,468 USDT to a new address; the first payment creates it. 4203af9c…
  12. 20:20:06BitcoinBitcoin: 11 transactions in one block (973,732) take 18,270.2 BTC from Binance's main hot wallet to one new address, which splits them in the same block into 17 lots of 1,000 BTC and one of 832.50 BTC; the last 437.70 BTC follow at 20:48. f9dcbbc6…
  13. 20:20:59EthereumEthereum: Binance 14, a Binance hot wallet (always online; the exchange pays out from it), starts running the attacker's contract. The transaction carries 50 permissions signed by Binance 14 (EIP-7702). 0xad9926…
  14. 20:24:23EthereumSweep 1, the largest of five (a sweep moves many of a wallet's funds in one transaction): 167,464 ETH and 63 tokens, 1.615 billion USDT among them. 0x53bd38…
  15. 20:24:47EthereumBinance 16, another Binance wallet, sends 28,006 ETH and 8 tokens to the same address, in 9 ordinary transactions. 0x51f263…
  16. Ethereum20:30 to 20:38: the money moves on. 500 million USDT, then 200 million, go to two new addresses, and 195,460 ETH to a third. 0x68d7d6…
  17. Arbitrum OneArbitrum and Avalanche, 20:30 to 20:35: 74.56 million ARB and 8,426 ETH; then 1.81 million AVAX and 8.41 million USDt. 0xa18e57…
  18. Ethereum20:34 to 21:09: 435 million USDT are swapped for 160,451 ETH in 14 trades, at $2,711 per ETH on average: about 19% more than Coinbase. 0x290e94…
  19. Ethereum20:41:23 and 20:59:47: 823,000,000 USDC leave Binance Hot Wallet 34, a contract wallet, through Binance 14's new code. 0xdc102d…
  20. Tron20:47 to 21:14: on Tron, 234 million USDT are swapped for 638.17 million TRX in 16 trades, at $0.3667 per TRX on average: about 11% more than Kraken. 60a924f7…
  21. 20:57:59EthereumAave, a lending app: another address deposits 60 million USDT and borrows 19,762 WETH (ETH in token form) in 3 minutes. 0xa85ad4…
  22. 21:01:35EthereumFirst freeze. Tether freezes the main receiving address and the first new one. By 21:18 it has frozen 8 attacker addresses on Ethereum, following the USDT from one to the next. 0x7baba4…
  23. 21:04:23EthereumSweep 2: 23 more token transfers and 1,700 ETH. 0x31c4c9…
  24. 21:04:59EthereumCircle freezes the 823,000,000 USDC at the receiving address. 0xc954c8…
  25. 21:09:12TronTron: Tether freezes the first address with 312.73 million USDT inside, 46 min after they arrived; at 21:17:39 and 21:21:12 it freezes the next two, one already emptied. 71b0ec0f…
  26. 21:44:11EthereumSweep 3: 14 more token transfers and 370 ETH, with 200.40 million USDT that land in the already frozen address. 0x55ba4d…
  27. 21:47:23EthereumAave freezes 32 markets on Ethereum; Aave on Arbitrum follows at 22:15, and on Avalanche at 22:42. 0x405bee…
  28. 21:57:47EthereumSales in each token's main Uniswap pool (an automatic exchange) begin with UNI; LINK, AAVE, WBTC, ENA and ONDO follow. 0xe4430d…
  29. 22:00:59EthereumRLUSD's issuer (Ripple) freezes an attacker address, a “pause” in RLUSD's own word: 40.54 million RLUSD stuck, after 48 million had been swapped away. 0xafd52f…
  30. 22:06:23EthereumTether freezes Binance 14 itself; it held 1,351,530 USDT at 02:18 UTC. 0x312e16…
  31. 22:10:35EthereumThe USD1 contract freezes the 27,824,040 USD1 at the main receiving address (its freeze power sits with World Liberty and BitGo). 0x171ad4…
  32. 22:39:35EthereumSweep 4: 122 more token transfers and 128 ETH, to another address, 0xa97b…8d10. 0x4a4aed…
  33. Tron22:57 to 30 October, 00:36: Binance moves 81.50 million USDT, 7.15 million TRX and 11 other tokens from its Tron hot wallet to another wallet in its own list. 16cc335d…
  34. 23:01:47NEARNEAR: Binance moves the NEAR wallets' dollar tokens and 3.96 million NEAR to wallets in its own list. AZAg7GV1…
  35. 23:02:18SolanaSolana: Binance moves $1.07B in dollar tokens and 155,030 SOL from its hot wallet to two other wallets in its own list. 4Hekaqtf…
  36. 23:04:30AvalancheBinance wallets still send: 444,537 AVAX on Avalanche (from Binance 113), then 46.63 million POL and 6.19 million USDT0 on Polygon (23:05, from Binance 48). 0x167311…
  37. 23:12:10XRP LedgerXRP Ledger: Binance moves 26.20 million XRP from its hot wallets to another wallet in its list; 51.17 million RLUSD follow at 01:27 on 30 October. D5CC6F6D…
  38. 23:16:50BitcoinBitcoin: Binance moves 1,767 BTC from its hot wallet to another wallet in its list; 3 BTC more follow by 00:22 on 30 October. a2069251…
  39. 23:53:35EthereumCircle freezes Binance 14, then Hot Wallet 34 at 23:54:59 (3,008,457 USDC in the two). 0xb57c21…
  40. 23:56:47EthereumSweep 5: one more call to Binance 14 takes 2,962 ETH to the same address as Sweep 4, 13 min 48 s before Binance removes the code. 0x4395d5…
  41. Tron30 October, 00:06:09: on Tron, 46,383,069 TRX move from the first attacker address to a new one, which sends 1.87 million TRX of it on in 3 transfers from 02:19. 6adfc066…
  42. Ethereum30 October, 00:10:35: Binance 14 signs a new permission that points to nothing. The attacker's code is gone from the wallet. 0xafbf94…

All times UTC, 29 October 2026 unless another date is given.

A bright orange river of light splitting into many smaller streams in space

Where the money is now

Pick a network to follow its money step by step. Every step links the address or transaction.

Frozen: $2.65B

  • Tether, Ethereum$1.38B
  • Tether, Tron$378.7M
  • Circle$823M
  • Ripple (RLUSD)$40.5M
  • USD1$27.8M

Still with the attacker: coins with no freeze function

CoinAmountWhereAt 20:25 UTCNow
BTC18,27019 addresses, none moved$1.47Bat 20:25 UTCloadingnow
ETH494,0719 addresses of 1,000 ETH or more$1.14Bat 20:25 UTCloadingnow
XRP233.46 million1 account, it has sent nothing$296.6Mat 20:25 UTCloadingnow
TRX682.71 million2 addresses$226.1Mat 20:25 UTCloadingnow
SOL970,5491 account, it has sent nothing$96.3Mat 20:25 UTCloadingnow
NEAR12.41 million1 account, it has sent nothing$54Mat 20:25 UTCloadingnow
Total$3.28Bat 20:25 UTCloadingnow

Amounts as read on each network (Ethereum at 02:18 UTC; Bitcoin, Tron, XRP, Solana and NEAR from 03:23 to 05:51 UTC). Now: CoinGecko's price when you open the page.

Ethereum$3.79B

The 1.875 billion USDT taken on Ethereum, dollar by dollar, then where each part went.

  • Frozen by Tether1.380 billion USDT73.6%
  • Swapped for ETH before Tether could freeze it435 million USDT23.2%
  • Deposited on Aave as collateral60 million USDT3.2%

The sum closes to the cent. It counts 127.67 USDT that left 0xaa24…54a0 two minutes before its freeze, and 0.01 USDT sent in from 0x97497624…c762, an address made to look like the attacker's 0x9749292d…c762 so that people copy the wrong one.

  1. 20:24 to 21:44

    The main receiving address

    Binance wallets on six networks send to 0x5227…2f8c. On Ethereum it receives 1,875,464,711 USDT. 700 million leave before Tether freezes it at 21:01:35 with 971.15 million inside; 204.32 million more arrive after the freeze and stay stuck.

    0x5227…2f8c

  2. 20:30:11

    500 million USDT

    To 0x9749…c762. Other traders fill 9 of its orders to swap USDT for ETH, paying 122,316 ETH for 325 million USDT. The other 175 million move on through 0x811f…e84c to 0xaa24…54a0, frozen at 21:14:59.

    0x9749…c762 0x811f…e84c 0xaa24…54a0

  3. 20:33:23

    200 million USDT

    To 0x0ddf…697e. It swaps 10 million for 3,552 ETH and passes the rest to 0x8d53…639a, which deposits 60 million on Aave and borrows 19,762 WETH against them.

    0x0ddf…697e 0x8d53…639a

  4. 21:01 to 21:18

    Tether follows the USDT

    The rest hops on through 0x77ed…c3eb, 0x7aa4…bfd1 and 0xccbe…a263; the first two swap 100 million USDT for 34,583 ETH on the way. Tether freezes 0x7aa4…bfd1 84 seconds and 0xccbe…a263 36 seconds after the USDT left them, and stops the last 30 million at 0xb171…c8c3. It had not frozen 0x77ed…c3eb by 02:18 UTC.

    0x77ed…c3eb 0x7aa4…bfd1 0xccbe…a263 0xb171…c8c3

  5. 20:38:47

    195,460 ETH

    To 0x8532…43d4, an address that has never sent a transaction. It holds 197,460 ETH at 02:18 UTC.

    0x8532…43d4

  6. 22:39 and 23:56

    Two late sweeps

    Binance 14 still runs the attacker's code. At 22:39 a sweep sends 122 token transfers and 128 ETH to 0xa97b…8d10; at 23:56 one more call takes 2,962 ETH to the same address, 13 min 48 s before Binance removes the code.

    0x4a4aed… 0x4395d5…

  7. 21:22 to 00:59

    The other tokens

    10 more tokens go to 7 other wallets; most are sold for ETH (see Swaps), and the ETH is gathered in 6 moves into 4 addresses that have never sent a transaction. 29,934 wBETH stay unsold at 0x7f9d…15e3.

    0x5c7117… 0x1ef5fa… 0x2c64a2…

Bitcoin$1.47B

18,270.2 BTC in 11 transactions, all in block 973,732.

  1. 20:20:06

    From Binance's main hot wallet

    11 transactions take 18,270.2 BTC from bc1qm3…7s3h, a wallet in Binance's own list, to bc1q0m…2mnm, a new address.

    bc1qm3…7s3h f9dcbbc6… bc1q0m…2mnm

  2. 20:20:06

    Split in the same block

    In the same block, the new address splits the coins: 18 more transactions leave 17 lots of exactly 1,000 BTC and one of 832.50 BTC. At 20:48 a last one gathers 437.70 BTC.

    bc1qxg…s9ra

  3. 03:39

    Not moved since

    At 03:39 UTC on 30 October none of the 19 addresses had moved its coins. Bitcoin has no freeze function.

  4. 23:16

    Binance moves funds within its list

    Binance moves 1,770 BTC from the same hot wallet to 3M219K…xRP6, another wallet in its list, by 00:22 on 30 October.

    a2069251…

The 19 addresses that hold the 18,270.2 BTC
  • bc1qxr…968s1,000 BTC↗
  • bc1qnq…8t3s1,000 BTC↗
  • bc1qs3…7s561,000 BTC↗
  • bc1qjw…nz7w1,000 BTC↗
  • bc1q0t…mfv31,000 BTC↗
  • bc1qep…4lag1,000 BTC↗
  • bc1qm2…jaat1,000 BTC↗
  • bc1qdf…88gw1,000 BTC↗
  • bc1q2w…znn61,000 BTC↗
  • bc1qz8…updp1,000 BTC↗
  • bc1qal…tca81,000 BTC↗
  • bc1q63…sjxp1,000 BTC↗
  • bc1qf5…a35u1,000 BTC↗
  • bc1qs6…7w3v1,000 BTC↗
  • bc1qm8…s2l81,000 BTC↗
  • bc1q42…lsyx1,000 BTC↗
  • bc1qg3…3t531,000 BTC↗
  • bc1qrg…6zyt832.50 BTC↗
  • bc1qxg…s9ra437.70 BTC↗
Tron$628.1M

The 612.73 million USDT taken on Tron, dollar by dollar, and the TRX.

  • Frozen by Tether378.72 million USDT61.8%
  • Swapped for TRX before Tether could freeze it234 million USDT38.2%
  • Lent on JustLend, a lending app10,000 USDT0.0%
  1. 20:20 to 20:22

    From Binance's Tron hot wallet

    TDqSqu…hSCf, a wallet in Binance's own list, sends 46,394,098 TRX and 612,729,468 USDT to TG5iBM…zsGi, a new address that the first payment creates.

    TDqSqu…hSCf 4203af9c… TG5iBM…zsGi

  2. 20:45 and 20:56

    300 million USDT move on

    TG5iBM…zsGi passes 100 million and then 200 million USDT to TPBkSj…bKN4; Tether freezes it at 21:09:12 with 312.73 million USDT still inside.

    TPBkSj…bKN4 71b0ec0f…

  3. 20:47 to 21:14

    Swapped for TRX

    TPBkSj…bKN4 swaps 234 million USDT for 638.17 million TRX in 16 trades on an on-chain exchange. It lends 10,000 USDT on JustLend, sends 65.99 million USDT to TCzBTk…7Y62, and is frozen at 21:17:39 with none left.

    60a924f7…

  4. 21:21:12

    65.99 million USDT frozen

    Tether freezes TCzBTk…7Y62 4 min 54 s after the 65.99 million USDT arrived.

    TCzBTk…7Y62 176a5783…

  5. From 20:56

    Where the TRX is

    638.20 million TRX sit at TSpe5H…yZ8A, which has sent nothing; 44.51 million TRX at TRBdWq…PRki, which has sent 1.87 million TRX on in 3 transfers. Unlike USDT, TRX has no issuer that can freeze it.

    TSpe5H…yZ8A TRBdWq…PRki

XRP Ledger$296.6M

233.46 million XRP from 5 Binance wallets to one account, in 4 minutes.

  1. 20:04:52

    A failed first try

    A Binance wallet tries to send 42.75 million RLUSD to rK21t6…fzMx. The payment fails: that account does not exist yet.

    AE08D54F…

  2. 20:05 to 20:09

    5 payments

    8 seconds later the same wallet sends 185.02 million XRP, which creates the account; four more Binance wallets follow. All five are in Binance's own list.

    • rDAE53…JPxr185.02 million XRP20:05:00↗
    • rBtttd…eA1A14.69 million XRP20:07:00↗
    • rfQ9Ec…8Cvi13.14 million XRP20:08:20↗
    • rarG6F…bZKk11.96 million XRP20:08:50↗
    • rNU4eA…ExpK8.66 million XRP20:09:20↗

  3. 20:17 to 20:19

    The same payments again, all failed

    The same amounts are sent again from 4 of the emptied wallets and fail. A payment of 14.27 million XRP from a sixth wallet, rhWj9g…LQkK, fails too because the wallet holds less, so it keeps its 14.11 million XRP.

    F4AA3AA4…

  4. 03:34

    Not moved

    At 03:34 UTC on 30 October the account held 233,461,943.1 XRP and had sent nothing. XRP has no freeze function.

    rK21t6…fzMx

Solana$96.3M

970,521.9 SOL from Binance's main hot wallet to one new account.

  1. 20:10 to 20:33

    5 payments

    5tzFki…uAi9, a wallet in Binance's own list, sends 965,455.1 SOL to AffzFD…BEaU, an account that did not exist before; 4 payments of 1,266.7 SOL follow.

    • 965,455.1 SOL20:10:18↗
    • 1,266.7 SOL20:10:19↗
    • 1,266.7 SOL20:26:20↗
    • 1,266.7 SOL20:28:16↗
    • 1,266.7 SOL20:33:29↗

  2. 03:50

    Not moved

    At 03:50 UTC on 30 October the account held 970,549.4 SOL and had sent nothing. SOL has no freeze function.

    AffzFD…BEaU

  3. 23:02

    Binance moves funds within its list

    Binance moves $1.07B in dollar tokens and 155,030 SOL from the same hot wallet to two other wallets in its list.

    4Hekaqtf…

NEAR$54M

12.41 million NEAR from 3 Binance hot wallets to one new account, in 7 minutes.

  1. 20:15 to 20:22

    3 payments

    3 hot wallets, all in Binance's own list, send 12.41 million NEAR to efd224…e5af. The first payment creates the account.

    • 5c33c6…57d28.09 million NEAR20:15:26↗
    • 9c484f…c5c12.20 million NEAR20:22:03↗
    • 451913…7c5c2.12 million NEAR20:22:29↗

  2. 05:51

    Not moved

    At 05:51 UTC on 30 October the account held 12,410,067.6 NEAR and had sent nothing. NEAR has no freeze function.

    efd224…e5af

  3. 23:01

    Binance moves funds within its list

    Binance sends the dollar tokens of the same wallets and 3.96 million NEAR to wallets in its own list, binancecold3.near among them.

    AZAg7GV1…

Other networks$78M

Arbitrum, Avalanche, Polygon, OP Mainnet and Base: Binance wallets sent straight to the main receiving address, 0x5227…2f8c.

NetworkAssetAmountValueFirst (UTC)Now
AvalancheAVAX2.26 million$19.7M20:33:18444,537 left
Arbitrum OneETH8,426$19.5M20:32:16Moved on
Arbitrum OneARB74.56 million$12.3M20:30:34Moved on
AvalancheUSDt8.41 million$8.41M20:33:18Held
PolygonUSDT06.19 million$6.19M23:05:55Held
OP MainnetOP44.23 million$4.79M20:18:23Held
PolygonPOL46.63 million$4.26M23:05:55Held
BaseVIRTUAL4.74 million$2.84M20:16:19Held

Balances read at 00:02 UTC. The Arbitrum funds and 1.81 million AVAX moved on from the receiving address; we did not follow them.

A block of ice in space with a stack of gold coins frozen inside

What was frozen, and what cannot be

Frozen: the address can no longer send that token. Every freeze here came from a token whose code gives someone that power; for these dollar tokens, that is the company that issues them.

Tether
1,759,184,053 USDT

1.380 billion on Ethereum, in 3 of the 8 attacker addresses it blocked from 21:01 to 21:18; 378.72 million on Tron, in 2 of 3 (21:09 to 21:21).

Also Binance 14 itself, at 22:06.

Circle
823,000,000 USDC

frozen at 21:04:59, all at the main receiving address.

Also Binance 14 and Hot Wallet 34, at 23:53 and 23:54.

Ripple (RLUSD)
40,541,065 RLUSD

frozen (“paused”, in RLUSD's own word) at 22:00:59, after 48 million had been swapped away.

Also Binance 14, at 22:20.

USD1 (World Liberty, BitGo)
27,824,040 USD1

frozen by the USD1 contract at 22:10:35, at the main receiving address.

Also Binance 14, at 22:26.

Aave
54 markets

frozen on Ethereum, Arbitrum and Avalanche: no new deposits or loans; withdrawals and repayments still work.

The attacker's loan is still open: 60 million USDT deposited, 19,762.7 WETH owed.

Cannot be frozen

No one can freeze BTC, ETH, TRX, XRP, SOL, NEAR or tokens such as UNI or LINK the way these dollar tokens were frozen: their code has no such function.

The race: every attacker address Tether froze

5 freezes caught the dollars inside; 6 came seconds or minutes after the USDT had left.

  1. 21:01:35Ethereum0x5227…2f8cCaught 971.15 million USDT; 204.32 million more arrived after↗
  2. 21:01:35Ethereum0x9749…c762Empty: the USDT left 2 min 24 s earlier↗
  3. 21:01:47Ethereum0x0ddf…697eEmpty: the USDT left 8 min 48 s earlier↗
  4. 21:02:47Ethereum0x8d53…639aEmpty: the USDT left 48 s earlier↗
  5. 21:09:12TronTG5iBM…zsGiCaught 312.73 million USDT↗
  6. 21:12:35Ethereum0x7aa4…bfd1Empty: the USDT left 1 min 24 s earlier↗
  7. 21:14:59Ethereum0xaa24…54a0Caught 175 million USDT↗
  8. 21:16:47Ethereum0xccbe…a263Empty: the USDT left 36 s earlier↗
  9. 21:17:39TronTPBkSj…bKN4Empty: the USDT left 1 min 21 s earlier↗
  10. 21:18:59Ethereum0xb171…c8c3Caught 30 million USDT↗
  11. 21:21:12TronTCzBTk…7Y62Caught 65.99 million USDT↗

Frozen balances read at 02:18 UTC on Ethereum and 03:23 UTC on Tron; each freeze read from the token's own contract.

Orange coins falling into a glowing pool of light in space

Swapped at a premium, before the freezes

Before the freezes reached them, $669M of USDT were swapped into ETH and TRX, coins with no freeze function, at prices well above the market (each trade against the 5-minute price bar it fell in).

+19.0%

435 million USDT for 160,451 ETH, $2,711 per ETH

above Coinbase, in 14 trades from 20:34 to 21:09.

+10.8%

234 million USDT for 638.17 million TRX, $0.3667 per TRX

above Kraken, in 16 trades from 20:47 to 21:14.

Ethereum: the ETH price, and each of the attacker's trades

19:0020:0021:0022:0023:0000:00
ETH in the main Uniswap pool (USDC)ETH on Coinbasea trade of the attacker: USDT paid per ETHpool more than 3% above Coinbase

Tron: the TRX price, and each of the attacker's trades

20:3020:4521:0021:1521:30
TRX on Krakena trade of the attacker on Tron: USDT paid per TRX
The 14 Ethereum trades and 16 Tron trades, one by one
AddressPaidGotPer ETHvs Coinbase
0x9749…c7629 trades, filled by others325 million USDT122,316 ETH$2,657+16.3%
0x0ddf…697e1 trade10 million USDT3,552 ETH$2,815+24.6%
0x77ed…c3eb2 trades50 million USDT18,085 ETH$2,765+22.6%
0x7aa4…bfd12 trades50 million USDT16,498 ETH$3,031+34.0%
Time (UTC)PaidGotPer TRXvs Kraken
20:47:27 ↗10 million USDT30,049,681 TRX$0.3328+0.2%
20:48:06 ↗30 million USDT88,191,900 TRX$0.3402+2.4%
20:49:00 ↗30 million USDT85,903,110 TRX$0.3492+5.2%
20:51:12 ↗10 million USDT28,290,408 TRX$0.3535+6.9%
20:52:00 ↗10 million USDT28,064,383 TRX$0.3563+7.8%
20:53:06 ↗10 million USDT27,823,756 TRX$0.3594+8.7%
20:56:54 ↗30 million USDT81,592,369 TRX$0.3677+11.6%
20:57:33 ↗30 million USDT79,525,236 TRX$0.3772+14.5%
20:59:36 ↗30 million USDT77,495,565 TRX$0.3871+17.5%
21:02:42 ↗20 million USDT51,056,112 TRX$0.3917+18.5%
21:04:09 ↗10 million USDT25,248,833 TRX$0.3961+19.8%
21:05:45 ↗5 million USDT12,567,393 TRX$0.3979+18.1%
21:06:42 ↗3 million USDT7,520,337 TRX$0.3989+18.4%
21:08:18 ↗2 million USDT5,019,493 TRX$0.3984+18.2%
21:11:54 ↗2 million USDT5,006,565 TRX$0.3995+17.1%
21:14:12 ↗2 million USDT4,817,617 TRX$0.4151+21.7%

ETH and TRX received in each trade read from the transaction itself. “vs Coinbase” and “vs Kraken”: the dollars paid against what the same coins were worth there, at the 5-minute price bar of each trade.

Sold out: the price when the selling started, when it ended, and now

TokenStarted (UTC)Finished (UTC)NowSince finished
UNI7.02 million UNI swapped away$6.515started 21:51$6.519finished 22:42loadingnowsince finished
PEPE7.77 trillion PEPE swapped away$0.00000443started 22:01$0.00000455finished 23:31loadingnowsince finished
LINK2.57 million LINK swapped away$10.83started 22:37$10.58finished 00:02loadingnowsince finished
AAVE127,953 AAVE swapped away$123.20started 22:39$119.85finished 22:58loadingnowsince finished
WBTC167.14 WBTC swapped away$78,855started 22:43$78,862finished 22:45loadingnowsince finished
ENA217.50 million ENA swapped away$0.1764started 22:51$0.1722finished 00:41loadingnowsince finished
ONDO21.85 million ONDO swapped away$0.3794started 23:01$0.3826finished 23:19loadingnowsince finished

Started and finished: the first and last transfer of the token out of the wallet that held it; prices are Coinbase's at those moments (BTC for WBTC). Now: CoinGecko's price when you open this page.

Each token's price from 20:25 UTC (20:25 = 100)
UNI−8.8% since 20:25
100
LINK−8.3% since 20:25
100
AAVE−10.0% since 20:25
100
ENA−16.9% since 20:25
100
ONDO−7.8% since 20:25
100
PEPE−13.2% since 20:25
100

Orange: the token on Coinbase, to 00:10 UTC on 30 October. Grey: ETH, which moved −3.3% over the same time. Shaded: when its wallet sold it in the token's main Uniswap pool.

A magnifying lens over a chain of glowing cubes in space

The addresses in the case

92 addresses on 11 networks. Binance's wallets are the ones in its own reserves list. The attacker's are the sender, its contract, and the addresses we followed the money to, up to the ones marked “not followed further”; trades and deposits into apps are left out.

Paste any address from Bitcoin, Ethereum, Tron, XRP Ledger, Solana, NEAR or the other networks. The check runs in your browser; nothing is sent anywhere.

An arc of fifty glass cards with glowing dots and a brass key in front

How we checked

For anyone who wants to check our work: the sources, the rules we followed, and what we do not know.

Where we read each network, and when

NetworkSourceRead (UTC, 30 Oct)
Ethereumethereum-rpc.publicnode.com; traces and past balances from eth.drpc.org02:18
Bitcoinmempool.space and blockstream.info (Esplora API)03:39
Tronapi.trongrid.io03:26
XRP Ledgerxrplcluster.com (full-history servers)03:34
Solanasolana.publicnode.com, api.mainnet-beta.solana.com03:50
NEARapi.nearblocks.io, rpc.mainnet.near.org05:51
Arbitrum, OP Mainnet, Avalanche, Base, Polygonarb1.arbitrum.io, mainnet.optimism.io, publicnode.com00:02
BNB Chainbsc-rpc.publicnode.com02:10
All 46 networks in Binance's lista public node or explorer for each network, 531 wallets07:49

Each network's time is when the attacker's addresses there were read; the last row is the read of Binance's wallets on every network.

Method

What we do not know

Read our research

Donations are optionalΟι δωρεές είναι προαιρετικές
BASE · SOL · BTC · XMRBASE · SOL · BTC · XMR
DonateΔωρεά
BASE 0xa39428E62113214C7162169f602B89101d77Da61
SOL 7xqsUhqbJ7Gap8zFYRu53rp7Eeqg6fsKfmRwr42iGbtn
BTC bc1qhlzqw9hke2fcgsxp5wn69my80tqkyn0ghg3jsg
XMR 44qUeP6b4XbDBufKG9b35matsfR9A3MvZBLRCxUJRh1gGtEQYaAfD5ZTYGg11WYvKo7SUQhirBnTj7v9yfryjZyr4msVH7t
Weekly Research Analysis.Εβδομαδιαία Ανάλυση Έρευνας.
No Subs. No DMs. Let’s Bring Adoption.No Subs. No DMs. Let’s Bring Adoption.
Join ↓Είσοδος ↓

Educational only, not investment advice; do your own research. On-chain reads to 07:49 UTC, 30 October 2026; prices from Coinbase, Kraken and DefiLlama; statements as published. Powered by CoinGecko.

PANOPTIC PROTOCOL © 2026