Binance hack: a Tornado-funded operator, three test runs the same afternoon, and about 430,737 stolen ETH parked on four wallets

At about 20:05 UTC on 29 October 2026 Binance wallets began to empty: XRP Ledger first, then Solana, Optimism, Bitcoin, Tron and Ethereum, later Avalanche and Polygon. TRM Labs counts about $6.36 billion across ten chains, including 18,270 BTC and 233.46 million XRP, and attributes the attack to TraderTraitor (North Korea) with high confidence. Binance put its own estimate at about $6.3 billion, paused deposits and withdrawals and said it will cover all losses. Its preliminary account is that a compromised engineer’s laptop let an attacker reach a service container and submit withdrawals; it has not published a root cause. By the morning of 30 October Tether had frozen about 1.77 billion USDT, Circle 825 million USDC, Ripple 40.5 million RLUSD, and the Arbitrum Security Council had moved 8,426 ETH and 74.6 million ARB out of an attacker wallet. This page covers what we read ourselves on Ethereum and Tron. The Bitcoin leg is being traced and will be added here.

The wallet that started the Ethereum attack is 0x7C8601d4645b93cea45F71e118A729332e6B5CA0. Its only money before the attack came from Tornado Cash’s 0.1 ETH pool (0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc): three withdrawals of about 0.098 ETH at 07:39 and 08:53 UTC on 28 October and 08:23 UTC on 29 October.

On 29 October at 02:28 UTC it deployed a first contract (0x19beE294A6DaAb49c9e5Ab69A5Da6C035C70f2bf). At 13:51 UTC it sent EIP-7702 delegations for two fresh wallets, 0x837810E3Be7a3E89C570E7A01A13d3B566aaFBc3 and 0x9C29BA2DE4b2d6c3630685650663cFE7B70dbB6B, each funded with a few thousandths of an ETH by 0xFD41dA53D1175b29D40599A0e63545067F58f408, and called them at 14:19 and 14:24. At 15:59 it deployed the contract that would take over Binance 14, 0x63e842B054Bd624a465454D533C33F573e9c6fAe. At 16:20 it tested that contract on a third wallet, 0x43AEdb9BAD6219677a2C8D6858321C16988404BD, which 0xe4F9070e1316de2988fc6f869feaD8fb99cC74cd had funded with 1.01 ETH; the wallet was emptied at 16:30, and at 18:20 the same relay sent 1.0822 ETH back to the operator. Two hours later the operator did the same thing to Binance.

At 20:20:59 UTC the operator sent one type-4 transaction to 0x28C6c06298d514Db089934071355E5743bf21d60, the wallet Etherscan labels Binance 14, carrying 50 EIP-7702 authorizations signed by that wallet for consecutive nonces. Only the one matching the wallet’s current nonce was valid; it set Binance 14’s code to 0x63e842B054Bd624a465454D533C33F573e9c6fAe. Pre-signed authorizations for 50 future nonces mean whoever made them could make Binance 14 sign at will; that is a compromise of the signing system, not of a smart contract.

At 20:24:23 UTC the operator called the delegated wallet. In one transaction it sent 167,464.25 ETH and 63 token balances, including 1,615,409,499 USDT and 62.6 million RLUSD, to 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c. Twenty-four seconds later a second wallet, 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d (Binance 16 on Etherscan), sent 28,005.6 ETH, 55.7 million USDT and 25.9 million RLUSD to the same address with ordinary transfers and no delegation. The operator came back to Binance 14 at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:36–23:56 UTC and swept what customers had deposited in the meantime: 2,069.75 ETH and 204 million USDT more. In all, 197,540 ETH and 1,875.46 million USDT reached the collector.

Tether froze the collector at 21:01 UTC. Before that, two real USDT transfers left it: 500 million to 0x9749292D74Fd460982d0912eA9515EA24736C762 at 20:30 and 200 million to 0x0Ddf0480016e6bCb2C1F5d190D221FBA1320697e at 20:33. Block explorers also show “transfers” of 400 and 500 million USDT to 0x0DdBA7…0697E and 0x97457d…C762. They are not USDT: they come from a copycat token, sent to addresses built to match the first and last characters of the real ones. This is address poisoning, and the look-alikes are listed below so nobody mistakes them for the attacker. 1,175,464,712 USDT still sits frozen on the collector.

The 500 million went to market makers. Between 20:34 and 20:49 UTC 0x9749292D74Fd460982d0912eA9515EA24736C762 sold about 325 million USDT through UniswapX (reactor 0x00000011F84B9aa48e5f8aA8B9897600006289Be) and to four fillers, and received ETH back. At 21:47 it sent 122,310 ETH to 0xc887aF690E0301CD4edBbCe8F8d31b4EC65B286A. The other 175 million it passed to 0x811f15855476156Ebf86ba3b84faFb8Ceaa4e84C and on to 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0, which still holds 174,999,872 USDT.

The 200 million took a longer road. 190 million went to 0x8d53903625b8e839b9DF4bd28B0EFb1CD6b8639A, which supplied 60 million USDT to Aave v3 at 20:57 and 21:00 and borrowed about 19,762 ETH against it. It sent 23,314.5 ETH and the remaining 130 million USDT to 0x77EDEf23FBd05921c26FE29fcc3A65e14D2ac3eb, which sold about 50 million USDT in Uniswap pools and passed 41,397.81 ETH and 80 million USDT to 0x7Aa4D3029e4C6A8E916300014Ad95B6d6C03BFd1. That wallet sold the rest. 57,891.85 ETH then went through 0xCcBEF95633ADB5Cd2b5038DB5a38d77E726cA263 and 0xb171cA86f82070282138352Ff7111b494060c8c3 to 0x897C80d1a9729E94460e2Bd93178bD5215158DF3 at 21:35 UTC.

Four wallets hold the proceeds and have never sent a transaction:

0x8532FA14ACAf483729C449b8458aedDb900543D4 — 197,460 ETH, sent by the collector at 20:38 UTC on 29 October and 01:14 UTC on 30 October.

0xc887aF690E0301CD4edBbCe8F8d31b4EC65B286A — 137,602 ETH: the 122,310 ETH from the USDT sale, plus 15,292 ETH from 0x7f9DC988B46336aD536828fAD50fa8fA1E5415E3, which sold ENA and WBETH taken from Binance 14.

0x897C80d1a9729E94460e2Bd93178bD5215158DF3 — 78,415 ETH: the Aave and Uniswap route, plus 20,523 ETH from 0x42CDF00c85005630CC8605731B9364F712077810, which sold ONDO and UNI.

0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea — 17,260 ETH, sent by the collector at 05:15 UTC on 30 October.

Together that is about 430,737 ETH, in line with TRM’s “more than 420,000 ETH”. ETH cannot be frozen. Any exchange, bridge or swap service that receives ETH traceable to these four addresses is receiving the proceeds of this theft. 0xF977814e…, which holds about 499,000 ETH and received a batch from the second hot wallet that night, is Binance’s own wallet (Binance 8) and not part of the attacker’s holdings.

On Tron the attacker created TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi at 20:19:57 UTC. Binance’s hot wallet TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf seeded it with TRX, then sent 46,384,098 TRX at 20:21:12 and 612,729,468 USDT at 20:22:45. At 20:45 and 20:56 the attacker moved 300 million USDT to TPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN4. Tether froze the first wallet at 21:09 with 312,729,468 USDT still on it.

TRM reported that 300 million went to a wallet supplying JustLend. The chain shows that TPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN4 put only 10,000 USDT into JustLend. Between 20:47 and 21:12 it sold 199 million USDT for TRX in a SunSwap-style pool (TSUUVjysXV8YqHytSNjfkNXnnB49QDvZpx). It sent 65.99 million to TCzBTkqn66yApqbYoPezaEQosM5DAd7Y62, which Tether froze at 21:21 with all of it still there. It sent 35 million to two large wallets that also serve many unrelated users, which we do not treat as the attacker’s. At 21:42 it sent 349,860,941.68 TRX to TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A. The first wallet moved its 46.38 million TRX to TRBdWqHnDVSZCVGfgHdKFLQPirQcA2PRki at 00:06 UTC on 30 October. Frozen on Tron: 378,719,468 USDT, the same figure TRM gives.

It does not say who carried out the attack; the North Korea attribution is TRM Labs’, and Binance has not confirmed it. It does not say how the signing keys or authorizations were obtained beyond Binance’s own statement. It does not say that UniswapX, the fillers, Aave, Uniswap, SunSwap, JustLend or any other service did anything wrong: they executed valid orders. The ten-chain total, the Bitcoin, XRP, Solana, Arbitrum, Optimism, Avalanche and Polygon figures and the issuers’ freeze totals are TRM’s and Binance’s. The operator’s funding and tests, the Ethereum and Tron paths, the poisoning look-alikes, the Aave figures and the balances of the four parking wallets are PublicAML’s own reading of the chain on 30 October 2026.