PublicAML
Live

Binance Hot Wallet Exploit

Live investigationUpdated · (new entry)

Summary

On 29 October 2026, about $6.36 billion was taken from Binance hot wallets across several chains, according to TRM Labs; on Ethereum the main drain happened at 20:24:23 UTC through an EIP-7702 delegation of the Binance 14 wallet to an attacker contract. From on-chain data we reconstructed preparation that no publication shows in full: a "rehearsal" across five wallets that began with a Tornado Cash withdrawal at 01:15 UTC, 19 hours before the drain. We found seven attacker gas wallets without Etherscan labels, two withdrawals through the Bridgers bridge, and the full attacker address on Solana holding 970,549 SOL, unmoved as of 05:09 UTC on 30 October. On TRON we traced the swap of USDT into 638.2 million TRX and clarified the role of TSUUVjys…: it is a SunSwap pool, not a holding wallet. At 05:15 UTC on 30 October the attacker's main wallet 0x5227… moved 17,260 ETH to a new address.

Status

Live investigation. Last updated: 2026-10-30 05:50 UTC.

Key numbers

Stolen
$3.82B
plus $1.64B at unconfirmed token prices, not counted
Everything that went from three Binance wallets to the attacker’s wallets since 27 Oct, at each token’s price on the day of the transfer.
Frozen
$2.17B
USDT and USDC that the issuers have blocked on the attacker’s wallets.
Held by the attacker
$1.4B
plus $0.22 at unconfirmed token prices, not counted
What the attacker’s wallets hold now, at today’s prices, minus what is frozen.

In Aave: collateral $59.9M locked · debt 19,762 WETH (~$44.4M) · health factor 1.05, close to liquidationThe attacker deposited part of the stolen funds into Aave as collateral and borrowed against it. Aave froze those markets, so the collateral cannot be withdrawn; it is counted neither as held nor as frozen. The debt is what the attacker borrowed and still owes.

According to PublicAML data, Ethereum, updated 30 Oct, 07:30 UTCChain data up to 30 Oct, 07:29 UTC

Data notes

  • Not counted, $1.62B: the price of 0xfc82…7d on 29 Oct is 326 times above its usual level, which looks like a bad quote.
  • Not counted, $19.6M: the price of 0xac51…e8 on 29 Oct is 49 times above its usual level, which looks like a bad quote.
Breakdown
AssetStolenFrozenHeld by the attacker
USDT$1.88B$1.35B$11.54
ETH$466M—$1.13B
USDC$823M$823M$2.74
0x8292…ed$88.6M—$40.5M
0xa2e3…e1$76.9M—$76.9M
0x6874…38$50.7M—$50.3M
UNI$49.5M——
0x57e1…61$44.2M——
PEPE$38.9M—$1.06
LINK$29.6M——
0x8d0d…0d$27.8M—$27.8M
AAVE$16.8M—$0

Frozen by

  • Tether: $1.35B
  • Circle: $823M
How we count (in detail)

Stolen: Sum of priced transfers from the incident's 3 victim address(es) to its perpetrator/intermediary addresses since 27 Oct 2026, 00:00 UTC, each valued at the token_price quote of its own UTC day.

Frozen: Net in minus out, over our edges since 27 Oct 2026, 00:00 UTC, of each token an issuer currently freezes (address_freezes + tether/circle blacklist claims, label 240) on a perpetrator/intermediary address, less amounts the issuer destroyed, at today's token_price quote.

Held by the attacker: Net in minus out per address and asset over our edges since 27 Oct 2026, 00:00 UTC on all perpetrator/intermediary addresses (hops between them cancel), negatives clamped to zero, at today's token_price quote, minus frozen; Aave debt tokens (liabilities) and aTokens (collateral in the pool) are not held, and dollars from an unconfirmed quote are under `unconfirmed`.

Technical notes from the data

  • stolen_usd leaves out $1.62B priced with the 29 Oct 2026 quote of 0xfc82…7d, 326 times the median of its neighbours (see unconfirmed)
  • stolen_usd leaves out $19.6M priced with the 29 Oct 2026 quote of 0xac51…e8, 49 times the median of its neighbours (see unconfirmed)
Frozen:
the stablecoin issuer (Tether, Circle) blocked the tokens on the address: they cannot move until the issuer lifts it.
Held by the attacker:
sits on the attacker’s addresses and is not frozen: it can move at any moment.
Flagged by PublicAML (CRITICAL):
the address is tied to the attack in our data; a check of any wallet that received money from it will say so.

Where the money went (Ethereum)

Loading the data.

Movement of funds (live)

Transfers by the attacker’s wallets above $100,000, newest first. Updated automatically.

Timeline

Newest first. Times are UTC.

  1. Exploiter 2 moved 17,260 ETH to a new wallet

    At 05:15:47 UTC (block 26303416), 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c (Exploiter 2) sent 17,260 ETH to a new wallet, 0x03b0ee5d82990cff1bda48651ac3e436d1a020ea (transaction 0x9edf86533e73658700c5dadb2432dd7bebb628dc0f5fe37991c241f537856071). A minute earlier, at 05:14:35, a 0.1 ETH test transfer went through (0x88e4bc31dc948ac5dedb3a9936d2e429494e0ae1ff3dfce70e673ac194b06b78). The sender of both transactions, 0x5227…, was checked against a public RPC. The recipient is fresh: it has sent no transactions (nonce 0). PublicAML automatically assigned the address critical risk 91 seconds after the block.

    Addresses:0x5227f6…cb2f8c0x03b0ee…a020ea

    Sources: transactions above; public Ethereum RPC (eth_getTransactionByHash, eth_getTransactionCount)

    XTelegram

  2. Our finding: the attacker's Solana address, 970,549 SOL still in place

    The full attacker address on Solana is AffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaU. It appears in the code of the public tracker binance.lamps.works next to the attacker's other addresses. TRM Labs, TechFlow and drk.vc give the amount (970,500-970,522 SOL) but not the address.

    On-chain: between 20:10:18 and 20:33:29 UTC on 29 October it received five transfers from the Binance hot wallet 5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9, 970,521.9 SOL in total (the first and largest, 965,455.1 SOL, in transaction 5YvwLFWubH1ob8JCNDLbPVioC3jtEZ8Maoz5WhNAs5cc8n9V2BjTWbixt6Ny5mddAKkN2SWJUR9y5kzede3ZTqk2). Balance at 04:45 UTC on 30 October: 970,549.37 SOL. Rechecked at 05:09 UTC: same value. Nothing has been withdrawn. The address is a plain wallet (owner: System Program), not a contract.

    Addresses:AffzFDKZ…igBEaU5tzFkiKs…UvuAi9

    Sources: binance.lamps.works; techflowpost.com; public Solana RPC (getBalance, getTransaction)

    XTelegram

  3. Our finding: TSUUVjys… is a SunSwap pool, not the recipient of 199 million USDT

    The drk.vc analysis describes TSUUVjysXV8YqHytSNjfkNXnnB49QDvZpx as the address that 199 million USDT reached and where it remains unfrozen. On-chain, this is the SunSwap V3 WTRX/USDT pool with a 0.05% fee: the contract was created by the SunSwap V3 factory TThJt8zaJzJMhCEScH7zWKnp5buVZqys9x, and that factory's getPool(WTRX, USDT, 500) returns exactly TSUUVjys….

    Between 20:47 and 21:11 UTC, the attacker wallet TPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN4 sent 13 batches of USDT, 199 million in total, into this pool and received TRX in the same transactions through SunSwap UniversalRouter TQqgNg13s2DjvXhW1ky4v6TsR8wZGvb7Y4. Example: 30 million USDT at 20:56:54, 81.59 million TRX back (transaction 0c2562ae7c9a628103d20ca2ebfe77a2c00625508b51faf8e6cae09c81a18eae). So the 199 million is not sitting on TSUUVjys…; it was swapped into TRX, and that TRX moved on (see the 04:45 entry).

    The pool and the router are used by hundreds of unrelated users. They should not be added to lists of attacker addresses.

    Addresses:TSUUVjys…QDvZpxTQqgNg13…Gvb7Y4TPBkSjkC…76bKN4

    Sources: drk.vc; TRON transactions listed above

    XTelegram

  4. Our finding: the TRON route, 638.2 million TRX in one wallet

    Route on-chain:

    • TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi received 612,729,468 USDT (20:22:45) and 46,384,098 TRX (20:21:12);
    • it sent 100 million USDT to TPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN4 at 20:45:51 (fd8061aaa787ce89d707184dbfdd436a578c7840d674505067725de727c06222) and 200 million USDT at 20:56:09 (d40f96e23e95b7ace0ebacd3892f0a1f37555a64da69feedba73443dee4920ee);
    • TPBk… swapped USDT for TRX through the SunSwap pool TSUUVjys… (04:50 entry);
    • TPBk… sent 288,330,000 TRX to TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A at 20:56:12 (4b329d4495bcdd8df40117cd478f13c5027988147c7deb9add5e4aee3b8107c4) and 349,860,941.68 TRX at 21:42:42 (fb5089f5ce2ae9be6f8e5e3f78470a5a8d694879ac68f6c8cfe3d81450fa6149), 638.2 million TRX in total on TSpe5HC3…;
    • separately, TG5i… sent 46,383,069.13 TRX to TRBdWqHnDVSZCVGfgHdKFLQPirQcA2PRki at 00:06:09 on 30 October (6adfc066520a5880df18eebc61bf048d03e8d7a0fca23b04a6b36c9723892736).

    TSpe5HC3… is not a contract. Since 02:19 UTC on 30 October, TRBd… has been sending TRX out in parts to other addresses; we have not analysed them yet.

    Addresses:TG5iBMQP…wvzsGiTPBkSjkC…76bKN4TSpe5HC3…tkyZ8ATRBdWqHn…A2PRkiTSUUVjys…QDvZpx

    Sources: TRON transactions above; binance.lamps.works

    XTelegram

  5. Our finding: two withdrawals through the Bridgers bridge

    The drk.vc analysis says "no mixer or bridge use seen yet". On-chain, two attacker gas wallets moved ETH out through the Bridgers bridge. The path is the same in both cases: the MetaMask contract 0x0439e60f02a8900a951603950d8d4527f400c3f1, then the Bridgers address 0xc1d13492285eb664951e201bf7c80c7c6318a1b5.

    • Exploiter 9, 0x3e2bf1ac6bf0934bbba6456c341c2ecbced632d5: received 0.5 ETH from 0x5227f603… at 21:29:47 and sent 0.486 ETH at 21:31:11 (transaction 0xc5892899fa23a64ab99339b8a3bd9e1ef00c81319b33bbd77467f4b55df1ec2c).
    • Exploiter 13, 0x0e772ee615c7f93373c7519f2c36e780696477d3: received 1 ETH at 21:54:11 and sent 0.5 ETH at 21:57:23 (transaction 0xa5b80a23f712bdec620197e20c92808720665298f6afaf27b3aa7264aedbd6f9).

    We cannot see where, or on which chain, the funds arrived on the other side of the bridge.

    Hypothesis, not verified: according to drk.vc, on Arbitrum Binance funds reached the same address 0x3e2b…32d5 at 21:36, five minutes after Exploiter 9 used Bridgers. The attacker may have used the bridge to get gas onto Arbitrum. We have no confirmation from the Arbitrum side.

    Addresses:0x3e2bf1…d632d50x0e772e…6477d30x0439e6…00c3f10xc1d134…18a1b5

    Sources: transactions above; drk.vc

    XTelegram

  6. Our finding: a "rehearsal" across five wallets, started 19 hours before the drain

    TRM Labs and drk.vc report that the attacker tested the scheme on test wallets beforehand; drk names two of them in shortened form, 0x9C29…bB6B and 0x43AE…04BD. On-chain we found where these wallets got their funds, plus two more wallets from the same setup.

    The root is 0xfd41da53d1175b29d40599a0e63545067f58f408. At 01:15:35 UTC on 29 October it received 0.098 ETH from the Tornado Cash 0.1 ETH pool 0x12d66f87a04a9e220743712ce6d9bb1b5616b8fc (transaction 0x6f713d8c5d5ffe323d761a5c30c5c1d534e16f292232277516f48f466ae9bbdb). That is 19 hours before the drain and six hours before the preparation wallet 0xe4f9… (Exploiter 23, first funds at 07:08). The executor 0x7c86… had already received Tornado funds on 28 October.

    Sequence on 29 October (UTC):

    • 13:57: 0xfd41… sends ETH dust to 0x837810e3be7a3e89c570e7a01a13d3b566aafbc3 (0x4e4e44a38920677f26ca61678e8e783b54bca30ece2c0ff7aeb9b27aeeb0f9fb) and to 0x9c29ba2de4b2d6c3630685650663cfe7b70dbb6b (0x87add0f97fe300d9a1da69a0900ce2c0976cec8f2e32aa5f90ae17a4cadaba00);
    • 13:59-14:02: two swaps through MetaMask Swaps, yielding 11.54 USDT and 2.30 USDC;
    • 14:04-14:06: 6 USDT and 1 USDC to 0x8378…, 3 USDT and 1 USDC to 0x9c29…;
    • 14:19 and 14:24: both wallets forward everything to the test receiver 0x24a4ae3674f08b70665fcb91f2aa6ad204aba4de (0xa2e0cd4123cf4463cf43685232142d680e9994f5bd29f0540bf977a158216c4c, 0x6aaae5bcb5e0bafd1e79e70670864f8f726624d50d99d16152c5e684f571ddf4). The receiver has no outgoing transfers;
    • 16:13: 0xfd41… sends 2.541994 USDT to 0x43aedb9bad6219677a2c8d6858321c16988404bd (0x05bd1284d6b5337d5356e7a90a32562c6b72228234abeadf16ab3df8b9d9a67f);
    • 16:24: the preparation wallet 0xe4f9… sends 1.01 ETH to 0x43ae… (0xfd3f9dd90ff7b7b5a3f5b9abed20afc3ac517f74d0f5edf3e77b2ecd9d9917cd);
    • 16:30: 0x43ae… sends the same 2.541994 USDT and 0.01 ETH to the receiver 0x24a4… (0x9c2dbed15322072e35e767c0c9b4cd962abf58fe51937e62a7020c742b834f2f);
    • 16:47: 0x43ae… returns 1 ETH to 0xe4f9… (0x2b8eb62a32408e96bd7cb6740ede11a054549581534de5d5111289c47355f58f).

    The wallet 0x43ae… is still delegated via EIP-7702 to the sweeper contract 0x63e842b054bd624a465454d533c33f573e9c6fae (Exploiter 24), the same contract that was installed on Binance 14 that evening: the account code of 0x43ae… is 0xef0100 followed by that contract's address. The 1 ETH returned to 0xe4f9… ties the "rehearsal" to the wallet that paid gas to the drain executor at 18:20. The last test took place about four hours before the drain.

    Addresses:0xfd41da…58f4080x837810…aafbc30x9c29ba…0dbb6b0x24a4ae…aba4de0x43aedb…8404bd0x63e842…9c6fae0xe4f907…cc74cd0x12d66f…16b8fc

    Sources: transactions above; public Ethereum RPC (eth_getCode); drk.vc; trmlabs.com

    XTelegram

  7. Our finding: seven attacker gas wallets without Etherscan labels

    The attacker handed out gas to wallets it uses to sell tokens on DEXs. Etherscan has labelled some of them (Exploiter 9, 12-16, 26, 28), but seven wallets had no label in the Etherscan snapshot of 30 October 04:07 UTC. Each received gas ETH directly from 0x5227f603… (Exploiter 2):

    WalletGasTime UTCTransaction
    0xb3ddec0ccc5c3ba733fcdf5a15f98c95ec5a5fdb0.52 ETH, then 167.14 WBTC and 9.71 million USDe29 Oct 22:40:110xc87e26c4084ff9528178f8185eafcb6dfcd533c2fea32c9e95a98c205159feba
    0x06ea1ab3ecf570029eb1f94dbb9eac06bc79685f0.5 ETH29 Oct 23:26:230xcdd78ef83d7250f5841a9a26ed03ec0cf1e809d055377cd0c375bf0f0d78febf
    0x0084847bb9384d2fc5e8836e663689467e3e4c810.5 ETH30 Oct 00:06:590x6e1d2b9137b3260cd873e4daf75af060f799cdb4c1da929f77e48876f63574e2
    0xb58bf76d209fa71f60013ce1933ca331177a4f080.5 ETH30 Oct 00:19:590xc3959c8adb57c075b8b8fc23ca41cd66158b65bd1c3bbe234f1eb0a7808ee293
    0xf1eadb247ffc7d7d6600e84daaf9ee85737e73c40.5 ETH30 Oct 00:27:110x24472c4e45496a3665576b7eb58aa81948f020cdd9ccc6ca61094cf592492c82
    0xdd6dbbe67262ccc9b1824de1257999efc6c522960.5 ETH30 Oct 00:37:590x0882d99e6bcb39670a7e74a15dc0361ae982742ed0f8a7312a64957e4b77e097
    0x1291be4c90239d14527ba880ad2b6e5cb82116b10.5 ETH30 Oct 00:42:350x3ccc5e849cd0bf2ca2995d80a603a72727e721093c62e11c5dfe9c71efc970eb

    Sale proceeds flow back to attacker wallets. A review of 1,354 transactions from 16 gas wallets found no new holding wallets.

    Addresses:0x5227f6…cb2f8c

    Sources: transactions above; Etherscan page snapshot of 30 Oct 2026 04:07 UTC

    XTelegram

  8. Binance removed the delegation from Binance 14

    According to drk.vc, the Binance 14 account code became empty at block 26,302,414. At the time of our check (30 Oct ~05:10 UTC) the Binance 14 account code is empty, while the rehearsal wallet 0x43ae… is still delegated.

    Addresses:0x28c6c0…f21d60

    Sources: drk.vc; public Ethereum RPC (eth_getCode)

    XTelegram

  9. Leftover tokens sold on DEXs

    From 01:17 UTC the attacker has been selling leftover tokens through Uniswap, PancakeSwap, ShibaSwap and SushiSwap; by 03:06 UTC the proceeds were about 13,675 ETH. We see no outgoing transfers to mixers or privacy protocols from 35 known attacker wallets; Tornado Cash appears only in incoming transfers before the drain.

    Sources: our own transaction analysis

    XTelegram

  10. Repeat sweeps of Binance 14 to a new attacker wallet

    At 22:39:35 (block 26301444) and 23:56:47 (block 26301828), transfers left Binance 14 for 0xa97bf7836f8a08f9ed91d41453d371493fae8d10: 123 transfers in transaction 0x4a4aed833556814c16fe176fc8abc70ce124eadc73da3bcdf42a67ef44f9ad6b and one more in 0x4395d51dc3f3c51230329efc3548f74edbced353ff3f795c517cc57fa650f89b. On-chain, both transactions were signed by the attacker's executor 0x7c8601d4645b93cea45f71e118a729332e6b5ca0, calling the same sweeper function (selector 0x8a179be4) as the main drain. This matches TechFlow, which reports that at 22:39 the attacker swept 128.5 ETH and 122 small-cap tokens to a new wallet.

    The address has no history before 22:39 on 29 October. Since then it has been selling tokens itself through Uniswap, SushiSwap and PancakeSwap. As of 05:28 UTC on 30 October it holds 5,474.15 ETH and has sent 970 transactions (nonce, public RPC); trading continues.

    Addresses:0xa97bf7…ae8d100x28c6c0…f21d600x7c8601…6b5ca0

    Sources: transactions above; public Ethereum RPC (eth_getTransactionByHash, eth_getBalance, eth_getTransactionCount); techflowpost.com

    XTelegram

  11. Tether and Circle freezes

    Time UTCIssuerAddressFreeze transaction
    21:01:35Tether0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c (Exploiter 2)0x7baba482077843514d9c72bac0110ba0916b0814288a72917e2c3bb27a9d8659
    21:01:35Tether0x9749292d74fd460982d0912ea9515ea24736c762 (Exploiter 18)0x64a3f49742f4daf1d33b5440cb90bbc13de93bf53f00f5532d6e67967cb1b7de
    21:01:47Tether0x0ddf0480016e6bcb2c1f5d190d221fba1320697e (Exploiter 10)0xdb6b11fe4bad377b6945379d8fb0d0b642d3ca1ea366e1e8628e79e77ee0b0f3
    21:04:59Circle0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c0xc954c86f118e8e410e6a3eb9e3b38ff4a95fbdae9d2d58e13166afb7a1f4fc5f
    21:09:12Tether (TRON)TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi71b0ec0fe873fe820c37cc3ecbab4e83087f87e833d191012a0a4027d20594e1
    21:20:57Tether (TRON)TPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN40900814becd4a94e171ed742ab4c2fe7bfab909d612b657fe2cd3113534487b0

    At 21:15 UTC CZ posted about the Tether (~$971 million) and Circle (~$823 million) freezes. According to TRM Labs, after later sweeps the frozen 0x5227… held 1.175 billion USDT. Before its freeze, 0x0ddf… managed to forward 190 million USDT to Exploiter 3 (20:52:59, 0xc0fab33d0ec562d3feef6b23946402b1af80dade21ab4f5fbea7384cc4615183).

    Sources: x.com; trmlabs.com; freeze transactions

    XTelegram

  12. Split: funds spread across three wallets within 15 minutes

    • 0x9749292d74fd460982d0912ea9515ea24736c762 (Exploiter 18): 500 million USDT at 20:30:11 (0x68d7d69deaeb9750c38020b4f8d3728146ca8d2267eba1e38cf9b56722ad659a);
    • 0x0ddf0480016e6bcb2c1f5d190d221fba1320697e (Exploiter 10): 200 million USDT at 20:33:23 (0x1fc0ef33a767132edad434834a5555b30fcb5a171206c03b86175ef6dafac81c);
    • 0x8532fa14acaf483729c449b8458aeddb900543d4 (Exploiter 8): 195,460 ETH at 20:38:47 (0x551d7961652e6d9835b11988908adf86ebe480badb4ce2d7d52193b2b1b02c76) and another 2,000 ETH at 01:14:11 on 30 October, 197,460 ETH in total. No outgoing transfers as of 30 Oct ~05:15 UTC.

    According to publications (TRM Labs, drk.vc), about 325 million USDT was swapped into ~122 thousand ETH via UniswapX and RFQ market makers, and 60 million USDT was deposited into Aave to borrow ETH.

    Addresses:0x974929…36c7620x0ddf04…20697e0x8532fa…0543d4

    Sources: transactions above; Etherscan labels; drk.vc

    XTelegram

  13. Binance 14 drained via EIP-7702

    At 20:24:23 (block 26300770), the executor 0x7c8601d4645b93cea45f71e118a729332e6b5ca0 (Etherscan: "Binance Hot Wallet Exploiter") sent a transaction to Binance 14 itself, 0x28c6c06298d514db089934071355e5743bf21d60. The delegated code moved about 167,464 ETH, about 1.619 billion USDT and about 60 other tokens to 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c (Exploiter 2) (0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3). A follow-up sweep at 21:04:23 (block 26300968): 24 transfers, including 1,700 ETH (0x31c4c9fe287d54fb9d3b79980477a8c793a11f774b98d0a9a92de1dad888a91d). The signer of both transactions, 0x7c86…, was checked against a public RPC.

    At the same time, Binance 16 0xdfd5293d8e347dfe59e90efd55b2956a1343963d sent the attacker 9 transfers at 20:24:47, including 55.7 million USDT. The Binance smart wallet 0xee7ae85f2fe2239e27d9c1e23fffe168d63b4055 (Hot Wallet 34 per drk.vc) gave up 823 million USDC, 780 million of it in transaction 0xdc102dd89dded5a83f1008906883ffb7c81ff3b7d7965d8c7277d170b5e17481.

    Addresses:0x7c8601…6b5ca00x28c6c0…f21d600x5227f6…cb2f8c0xdfd529…43963d0xee7ae8…3b4055

    Sources: transactions above; theblock.co; drk.vc

    XTelegram

  14. Binance 14 delegated to the attacker contract

    The type-4 (EIP-7702) transaction 0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b, block 26300753, was sent from 0x7c86… to Binance 14 and carries 50 authorizations. According to drk.vc and TRM Labs, one of them took effect, and Binance 14 began executing the code of the sweeper contract 0x63e842b054bd624a465454d533c33f573e9c6fae (Etherscan: Exploiter 24), which only 0x7c86… can call. We checked the block, type and number of authorizations via a public RPC.

    Addresses:0x7c8601…6b5ca00x28c6c0…f21d600x63e842…9c6fae

    Sources: drk.vc; trmlabs.com

    XTelegram

  15. Gas for the executor

    The preparation wallet 0xe4f9070e1316de2988fc6f869fead8fb99cc74cd (Etherscan: Exploiter 23, first funds at 07:08 on 29 October, from Tornado Cash) sent 1.0822 ETH to the executor 0x7c86…. The executor itself had earlier received three withdrawals from the Tornado Cash 0.1 ETH pool: on 28 October at 07:39 and 08:53, and on 29 October at 08:23.

    Addresses:0xe4f907…cc74cd0x7c8601…6b5ca0

    Sources: Etherscan labels; our own transaction analysis

    XTelegram

  16. Preparation begins

    First Tornado Cash withdrawal to the rehearsal root 0xfd41… (details in the 30 Oct 04:20 entry).

    Addresses:0xfd41da…58f408

    Sources: transaction 0x6f713d8c5d5ffe323d761a5c30c5c1d534e16f292232277516f48f466ae9bbdb

    XTelegram

Addresses

AddressChainRoleConfirmation
0x28c6c06298d514db089934071355e5743bf21d60Etherscan ↗EthereumBinance 14, affected hot walletEtherscan label; tx 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3
0xdfd5293d8e347dfe59e90efd55b2956a1343963dEtherscan ↗EthereumBinance 16, affected hot walletEtherscan label; transfers to the attacker in block 26300772
0xee7ae85f2fe2239e27d9c1e23fffe168d63b4055Etherscan ↗EthereumBinance smart wallet (Hot Wallet 34 per drk.vc), affectedtx 0xdc102dd89dded5a83f1008906883ffb7c81ff3b7d7965d8c7277d170b5e17481
5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9Solscan ↗SolanaBinance hot wallet, affectedtx 5YvwLFWubH1ob8JCNDLbPVioC3jtEZ8Maoz5WhNAs5cc8n9V2BjTWbixt6Ny5mddAKkN2SWJUR9y5kzede3ZTqk2
0x7c8601d4645b93cea45f71e118a729332e6b5ca0Etherscan ↗Ethereumexecutor, signed the delegation and the drainEtherscan "Binance Hot Wallet Exploiter"; tx 0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b
0x63e842b054bd624a465454d533c33f573e9c6faeEtherscan ↗Ethereumsweeper contract, delegation targetEtherscan Exploiter 24; eth_getCode of 0x43ae…
0x5227f603c1ee34ce3c06efe6477003bdfccb2f8cEtherscan ↗Ethereummain drain recipient, frozen by Tether and CircleEtherscan Exploiter 2; tx 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3
0xa97bf7836f8a08f9ed91d41453d371493fae8d10Etherscan ↗Ethereumattacker wallet: repeat sweeps of Binance 14, DEX swaps; 5,474.15 ETH and 970 transactions as of 05:28 UTC 30 Octtx 0x4a4aed833556814c16fe176fc8abc70ce124eadc73da3bcdf42a67ef44f9ad6b and 0x4395d51dc3f3c51230329efc3548f74edbced353ff3f795c517cc57fa650f89b, signed by 0x7c86…
0x03b0ee5d82990cff1bda48651ac3e436d1a020eaEtherscan ↗Ethereumnew wallet, 17,260 ETH from Exploiter 2tx 0x9edf86533e73658700c5dadb2432dd7bebb628dc0f5fe37991c241f537856071
0xe4f9070e1316de2988fc6f869fead8fb99cc74cdEtherscan ↗Ethereumpreparation, gas for the executorEtherscan Exploiter 23
0xfd41da53d1175b29d40599a0e63545067f58f408Etherscan ↗Ethereumrehearsal root, funded from Tornado Cashtx 0x6f713d8c5d5ffe323d761a5c30c5c1d534e16f292232277516f48f466ae9bbdb
0x837810e3be7a3e89c570e7a01a13d3b566aafbc3Etherscan ↗Ethereumrehearsal test wallettx 0x4e4e44a38920677f26ca61678e8e783b54bca30ece2c0ff7aeb9b27aeeb0f9fb
0x9c29ba2de4b2d6c3630685650663cfe7b70dbb6bEtherscan ↗Ethereumrehearsal test wallettx 0x87add0f97fe300d9a1da69a0900ce2c0976cec8f2e32aa5f90ae17a4cadaba00
0x43aedb9bad6219677a2c8d6858321c16988404bdEtherscan ↗Ethereumtest wallet, delegated to Exploiter 24eth_getCode = 0xef0100 + 0x63e842…; tx 0x2b8eb62a32408e96bd7cb6740ede11a054549581534de5d5111289c47355f58f
0x24a4ae3674f08b70665fcb91f2aa6ad204aba4deEtherscan ↗Ethereumrehearsal test receivertx 0x9c2dbed15322072e35e767c0c9b4cd962abf58fe51937e62a7020c742b834f2f
0x8532fa14acaf483729c449b8458aeddb900543d4Etherscan ↗Ethereumholds 197,460 ETHEtherscan Exploiter 8; tx 0x551d7961652e6d9835b11988908adf86ebe480badb4ce2d7d52193b2b1b02c76
0x9749292d74fd460982d0912ea9515ea24736c762Etherscan ↗Ethereumreceived 500 million USDTEtherscan Exploiter 18; tx 0x68d7d69deaeb9750c38020b4f8d3728146ca8d2267eba1e38cf9b56722ad659a
0x0ddf0480016e6bcb2c1f5d190d221fba1320697eEtherscan ↗Ethereumreceived 200 million USDTEtherscan Exploiter 10; tx 0x1fc0ef33a767132edad434834a5555b30fcb5a171206c03b86175ef6dafac81c
0x8d53903625b8e839b9df4bd28b0efb1cd6b8639aEtherscan ↗Ethereumreceived 190 million USDT and 3,552 ETHEtherscan Exploiter 3; tx 0x121cd104644b775c8a8c990c5871f79872cf7ebc5f03b93d3a8562f2c48262b2
0x3e2bf1ac6bf0934bbba6456c341c2ecbced632d5Etherscan ↗Ethereumgas wallet, Bridgers withdrawalEtherscan Exploiter 9; tx 0xc5892899fa23a64ab99339b8a3bd9e1ef00c81319b33bbd77467f4b55df1ec2c
0x0e772ee615c7f93373c7519f2c36e780696477d3Etherscan ↗Ethereumgas wallet, Bridgers withdrawalEtherscan Exploiter 13; tx 0xa5b80a23f712bdec620197e20c92808720665298f6afaf27b3aa7264aedbd6f9
0xb3ddec0ccc5c3ba733fcdf5a15f98c95ec5a5fdbEtherscan ↗Ethereumgas wallet, no Etherscan labeltx 0xc87e26c4084ff9528178f8185eafcb6dfcd533c2fea32c9e95a98c205159feba
0x06ea1ab3ecf570029eb1f94dbb9eac06bc79685fEtherscan ↗Ethereumgas wallet, no Etherscan labeltx 0xcdd78ef83d7250f5841a9a26ed03ec0cf1e809d055377cd0c375bf0f0d78febf
0x0084847bb9384d2fc5e8836e663689467e3e4c81Etherscan ↗Ethereumgas wallet, no Etherscan labeltx 0x6e1d2b9137b3260cd873e4daf75af060f799cdb4c1da929f77e48876f63574e2
0xb58bf76d209fa71f60013ce1933ca331177a4f08Etherscan ↗Ethereumgas wallet, no Etherscan labeltx 0xc3959c8adb57c075b8b8fc23ca41cd66158b65bd1c3bbe234f1eb0a7808ee293
0xf1eadb247ffc7d7d6600e84daaf9ee85737e73c4Etherscan ↗Ethereumgas wallet, no Etherscan labeltx 0x24472c4e45496a3665576b7eb58aa81948f020cdd9ccc6ca61094cf592492c82
0xdd6dbbe67262ccc9b1824de1257999efc6c52296Etherscan ↗Ethereumgas wallet, no Etherscan labeltx 0x0882d99e6bcb39670a7e74a15dc0361ae982742ed0f8a7312a64957e4b77e097
0x1291be4c90239d14527ba880ad2b6e5cb82116b1Etherscan ↗Ethereumgas wallet, no Etherscan labeltx 0x3ccc5e849cd0bf2ca2995d80a603a72727e721093c62e11c5dfe9c71efc970eb
AffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaUSolscan ↗Solanaattacker wallet, 970,549 SOLbinance.lamps.works tracker; tx 5YvwLFWubH1ob8JCNDLbPVioC3jtEZ8Maoz5WhNAs5cc8n9V2BjTWbixt6Ny5mddAKkN2SWJUR9y5kzede3ZTqk2
TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGiTronscan ↗TRONfirst recipient on TRON, frozen by Tetherfreeze 71b0ec0fe873fe820c37cc3ecbab4e83087f87e833d191012a0a4027d20594e1
TPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN4Tronscan ↗TRONswapped USDT for TRX, frozen by Tethertx fd8061aaa787ce89d707184dbfdd436a578c7840d674505067725de727c06222
TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8ATronscan ↗TRONholds 638.2 million TRXtx 4b329d4495bcdd8df40117cd478f13c5027988147c7deb9add5e4aee3b8107c4, fb5089f5ce2ae9be6f8e5e3f78470a5a8d694879ac68f6c8cfe3d81450fa6149
TRBdWqHnDVSZCVGfgHdKFLQPirQcA2PRkiTronscan ↗TRONreceived 46.4 million TRXtx 6adfc066520a5880df18eebc61bf048d03e8d7a0fca23b04a6b36c9723892736
0x12d66f87a04a9e220743712ce6d9bb1b5616b8fcEtherscan ↗EthereumTornado Cash 0.1 ETH pool, infrastructure, not the attackerpublic Tornado.Cash label
0x0439e60f02a8900a951603950d8d4527f400c3f1Etherscan ↗EthereumMetaMask contract, infrastructure, not the attackerMetaMask label
0xc1d13492285eb664951e201bf7c80c7c6318a1b5Etherscan ↗EthereumBridgers bridge, infrastructure, not the attackerlabel "Bridgers1.1 (BRIDGERS)"
TSUUVjysXV8YqHytSNjfkNXnnB49QDvZpxTronscan ↗TRONSunSwap V3 WTRX/USDT 0.05% pool, not the attackerfactory TThJt8zaJzJMhCEScH7zWKnp5buVZqys9x, getPool(WTRX, USDT, 500)
TQqgNg13s2DjvXhW1ky4v6TsR8wZGvb7Y4Tronscan ↗TRONSunSwap UniversalRouter, not the attackertx 0c2562ae7c9a628103d20ca2ebfe77a2c00625508b51faf8e6cae09c81a18eae
0xcb02d265139640bfff926416a98a22d7db964435Etherscan ↗Ethereumnot analysed, see open questionstx 0x8660797ad6d6a405cb54a782a2b68f084ca0ea02a48ee00e48c6b0395a343859

Other chains

Total across all chains, outside estimate

~$6.36B

Estimate by TRM Labs, as of

Estimates differ. TechFlow: $6.28 billion at 20:24 UTC prices on 29 Oct (https://www.techflowpost.com/en-US/article/34982). According to the drk.vc summary, Chainalysis puts the loss at $5.9 billion and Arkham at $5.7 billion (https://drk.vc/news/binance-14-eip-7702-drain; we have not read the primary Chainalysis and Arkham publications). Most of the gap comes from which prices are used and which chains are counted.

9 chainsStatic, from sources

Chains other than Ethereum. The three Ethereum figures (stolen, frozen, still held by the attacker) are shown separately on the page and computed dynamically. Every figure below carries its source and the time of the estimate; null means the sources give no data. TechFlow gives stolen amounts at 20:24 UTC prices on 29 Oct and freeze status as of ~23:50 UTC on 29 Oct. TRM Labs figures are as of 00:30 UTC on 30 Oct, drk.vc as of 01:55 UTC on 30 Oct.

  • Bitcoin

    Stolen: 18,270.2 BTC, $1.47 billion (TechFlow)

    Frozen: null (according to drk.vc at 01:55, these funds cannot be frozen)

    Held by the attacker: 18,270 BTC (TRM Labs, 00:30)

  • TRON

    Stolen: 612.7 million USDT and 46.4 million TRX, $627.5 million (TechFlow)

    Frozen: 378.7 million USDT in two wallets (TRM Labs, 00:30; TechFlow, ~23:50). Our measurement: 312.7 million USDT on TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi, frozen at 21:09:12

    Held by the attacker: 684.6 million TRX, not frozen (TechFlow, ~23:50). Our measurement: 638.2 million TRX received by TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A (per the binance.lamps.works tracker and transactions at 20:56 and 21:42 UTC; we have not checked the current balance)

  • XRP Ledger

    Stolen: 233.5 million XRP, $296.5 million (TechFlow); 233.46 million XRP (TRM Labs, 00:30)

    Held by the attacker: 233.5 million XRP (TechFlow, ~23:50); according to TRM Labs at 00:30 the funds had not moved

  • Solana

    Stolen: 970,522 SOL, $96.1 million (TechFlow)

    Held by the attacker: Our measurement: 970,549.37 SOL on AffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaU, 30 Oct 04:45 UTC, unmoved (rechecked at 05:09)

  • Arbitrum

    Stolen: 8,426 ETH and 74.6 million ARB, $31.8 million (TechFlow)

    Frozen: 8,426 ETH and 74.6 million ARB, frozen by the Security Council (TRM Labs, 00:30)

  • Avalanche

    Stolen: 1.81 million AVAX and 8.41 million USDT, $24.3 million (TechFlow); about $28 million (TRM Labs, 00:30)

    Frozen: 8.41 million USDT, Tether (TechFlow, ~23:50)

  • Optimism

    Stolen: 44.2 million OP, $4.8 million (TechFlow)

    Held by the attacker: 44.2 million OP, untouched (TechFlow, ~23:50); "still on the hub" (drk.vc, 01:55)

  • Base

    Stolen: 4,735,627 VIRTUAL, about $2.7 million (drk.vc, 01:55)

    Held by the attacker: 4,735,627 VIRTUAL, "still on the hub" (drk.vc, 01:55)

  • Polygon

    Stolen: about $10 million (TRM Labs, 00:30)

Open questions

  • Where the funds sent through Bridgers by Exploiter 9 and Exploiter 13 ended up: the destination address and chain are not visible to us.

  • Whether the Exploiter 9 Bridgers withdrawal (21:31 UTC) is connected to the same address appearing on Arbitrum (21:36 UTC per drk.vc). For now this is a hypothesis.

  • Who is behind 0xcb02d265139640bfff926416a98a22d7db964435. The address repeatedly sends zero-value or near-zero transactions to attacker wallets. Its purpose has not been analysed, and we make no assessment.

  • Where TRBdWqHnDVSZCVGfgHdKFLQPirQcA2PRki has been sending TRX in parts since 02:19 UTC on 30 October.

  • We have not yet analysed Bitcoin (18,270 BTC, address bc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm according to the binance.lamps.works tracker) or XRP.

Sources