The Binance hack of 29 October 2026: how $6.3 billion left the hot wallets, where it is now and whether it is being cashed out

Download the full PDF report with every address

The short version

How it happened: the weak points

Binance's first statement pointed to a compromised laptop of a DevOps engineer, which gave the attacker access to a service container from which withdrawal transactions could be submitted. Binance also said it found no evidence that private keys leaked. A later update said the investigation had found "additional points of breach". The full technical report has not been published, so the list below is what the chain data and the public statements support today.

1. The signing system obeyed the attacker on ten chains at once. Bitcoin, TRON, XRP, Solana, Avalanche, Polygon, Arbitrum, Optimism and Base were drained with ordinary signed transfers from Binance wallets, within minutes of each other. When a system can be told to sign transfers on ten networks without the keys leaving it, the weak point is not a key but the layer that decides what gets signed. Both Elliptic and TRM reach the same conclusion. This is also why "no private keys leaked" is not reassuring: the keys did not need to leave.

2. The hot wallet signed an EIP-7702 delegation. EIP-7702 (live since the Pectra upgrade in May 2025) lets an ordinary address attach smart-contract code to itself with one signed authorization. The attacker submitted one transaction carrying 50 such authorizations, each signed by the Binance 14 key for a different nonce. Only one matched. That detail matters: whoever requested the signatures could get them, but did not know the wallet's live state, which fits access to a signing service rather than possession of the key. We confirmed in the chain state that from block 26,300,753 (20:20:59 UTC) Binance 14 carried the delegation marker pointing to contract 0x63e842b054bd624a465454d533c33f573e9c6fae. That contract has verified source code under the name "Target" and was deployed by 0x7c8601d4645b93cea45f71e118a729332e6b5ca0, an address on the attacker's side that was funded through Tornado Cash the day before. A hot wallet that only ever sends plain transfers has no business signing a type-4 authorization. A signing policy that allowed it is the clearest single control failure visible on chain.

3. The delegation stayed on for almost four hours. A 7702 delegation persists until it is replaced. Once set, every new deposit into Binance 14 could be swept without another signature. The attacker swept the wallet again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 (TRM). In the chain state the marker disappears only at block 26,301,896, at 00:10:35 UTC on 30 October: 3 hours 49 minutes 36 seconds of exposure. Tether eventually blacklisted Binance 14 itself at 22:06:23 UTC so that USDT arriving there could not be pulled out. An issuer freezing the exchange's own hot wallet to protect it from its own delegation is, as far as we know, a first.

4. Too much money in one hot wallet. Ethereum accounted for about $3.8B of the theft, almost all of it from Binance 14. It was also the executor of a Binance smart account, which is how 823M USDC was pulled. A hot wallet is meant to hold a working float. These same wallets are listed in Binance's proof of reserves, which is why CoinDesk estimates that ether backing fell to about 94% until the replacement funds arrive.

5. Hours of visible preparation. The operator wallet received three 0.1 ETH withdrawals from Tornado Cash on 28 October, the sweeper contract was deployed at 15:59 UTC on 29 October and, according to TRM, rehearsed on test wallets about four hours before use. None of that is invisible; it was simply not linked to Binance until the money moved.

What exchanges should take from it. Sign by policy, not by request: hot wallets should be allowed a whitelist of transaction types, and a 7702 authorization should be denied outright. Monitor your own addresses for code: eth_getCode returning anything other than empty on an exchange hot wallet is an instant alarm. Cap hot wallet balances and velocity per chain, and treat simultaneous large outflows on several chains as a single incident. Keep freeze channels with issuers warm: the money that was saved on 29 October was saved by Tether, Circle, Ripple and World Liberty Financial within 40 minutes to two hours, and only for tokens that have a freeze function.

Timeline (UTC)

Where the money went, chain by chain

Ethereum stablecoins: mostly caught. The main attacker wallet 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c now holds 1,175,464,713 USDT and 823,000,000 USDC, both frozen. The race was close: the USDT arrived around 20:24 and was frozen at 21:01, 37 minutes later. In that window the attacker sold roughly 325M to 434M USDT to market makers and through UniswapX and 1inch for ether at a discount of more than 10% (TRM, Elliptic); a buyer who pays 10% over market for ether is a buyer in a hurry. Two hop wallets with 175.0M and 30.0M USDT were frozen on the way. Those two, 0xaa246bf639586a6ba46762d378ce50ca4fc654a0 and 0xb171ca86f82070282138352ff7111b494060c8c3, are not yet in Elliptic's public blocklist; we found them through our freeze corpus, frozen within the same twenty minutes. A third address frozen in that window, 0x7aa4d3029e4c6a8e916300014ad95b6d6c03bfd1, is delegated to the same smart-account code as a listed attacker wallet.

Ether: parked. 413,477 ETH sit on three wallets: 0x8532fa14acaf483729c449b8458aeddb900543d4 (197,460 ETH), 0xc887af690e0301cd4edbbce8f8d31b4ec65b286a (137,602 ETH) and 0x897c80d1a9729e94460e2bd93178bd5215158df3 (78,415 ETH). None of them has ever sent a transaction (nonce 0). A fourth parking wallet, 0x79e70d139fc05aa75f75611fdf2680e9952b544a, holds another 34,280 ETH collected on the morning of 30 October from three listed attacker wallets; it is not in Elliptic's public list either. That makes 447,757 ETH parked on four wallets. The traffic you see on explorers is incoming dust and messages from onlookers, not outflows. About 19,760 ETH were also borrowed on Aave against 59.9M USDT of collateral before Aave froze the markets (Elliptic).

Bitcoin: split, not sold. The 18,270.2 BTC were broken up within minutes into 19 addresses: 17 hold exactly 1,000 BTC, one 832.5 and one 437.7. We walked the whole tree: the sum of unspent outputs is 18,270.2 BTC, so not a single coin has left it. Round 1,000 BTC lots are convenient for over-the-counter sales, which is the most likely next stage, but nothing has moved yet. Bitcoin has no issuer and nobody can freeze it.

TRON: a race against Tether, mostly lost. 612.7M USDT left Binance-Hot 7 at 20:22:45. The attacker managed to forward 300M before the freeze: about 234M went into SunSwap pools and came out as roughly 638M TRX, 65.99M was forwarded and frozen within five minutes, and 312.73M were frozen on the first receiving wallet. The TRX was then consolidated on one address and split into five: four wallets with 158.2M, 120M, 120M and 120M TRX have not moved. The fifth sent 120M TRX to TRBdWqHnDVSZCVGfgHdKFLQPirQcA2PRki, which also received the 46.38M TRX stolen from Binance directly. That address was created at 00:06 UTC on 30 October and has since sent about 73.7M TRX in 30k to 950k chunks to dozens of brand-new addresses. This is the only part of the theft that is actively being laundered right now. Elliptic also reports that part of the TRON flow reached an address that holds proceeds of the September Bitget exploit.

XRP, Solana, NEAR: untouched. 233,461,943 XRP sit on rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx, 970,554 SOL on AffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaU and 12.41M NEAR on one account. These are native coins with no freeze function, so the issuers cannot help here. The Arbitrum Security Council did move 8,426 ETH and 74.6M ARB out of the attacker's reach at 00:08 UTC (TRM).

Is the hacker dumping?

Not at scale, not yet. The dumping happened in the first hours and only where speed mattered: stablecoins were sold or swapped before the issuers could freeze them, and the long tail of tokens was dumped on DEXs until 06:36 UTC (Elliptic). Since then bitcoin, the parked ether, XRP, SOL and NEAR have not moved. The one active flow is TRX, fanned out through fresh addresses, which is typical preparation for swap services and OTC desks. If the pattern of earlier large thefts holds, the next stage is bridges and OTC brokers, and it can take weeks. The market impact so far came from fear rather than selling: bitcoin fell about 4% and liquidations reached about $1.6B on 30 October.

The FUN dump: what happened to a small token

The Binance 14 sweep at 20:24 UTC also took 714,911,344 FUN (FUNToken, formerly FunFair) to the main attacker wallet. At 23:28:47 UTC the whole amount was moved to a fresh address, 0x06ea1ab3ecf570029eb1f94dbb9eac06bc79685f, which sold into the thin FUN/WETH pool on Uniswap in 154 transactions. It got rid of 134,145,256 FUN and received only 111.48 ETH, about $250,000; the pool price collapsed by more than 90% (CoinDesk). At 06:30 UTC the attacker gave up and sent the remaining 580,766,088 FUN, about 5.4% of the supply, back to the main wallet, where they still sit. The 111.85 ETH of proceeds went to the parking wallet 0x79e7…544a. FUNToken asked exchanges to pause FUN deposits. The lesson for holders of small tokens: an exchange hot wallet can hold a large share of your token's supply, and if it is stolen, the overhang stays in the market for as long as the attacker keeps it. Someone has also started sending zero-value FUN transfers from a look-alike address, a classic address-poisoning trick, this time aimed at the hacker.

What it means for Binance users

Binance says client balances are not affected because the stolen funds were the exchange's own hot wallets, and that it has set aside more than $6.34B to cover the loss, about $5B of it already in the affected tokens. Withdrawals were paused at 22:15 UTC on 29 October; the exchange gives about 40 hours as a preliminary target, and has promised a full proof of reserves by Monday. Deposits keep working.

• Ignore anyone who offers "compensation" or a "refund" from Binance. After every large hack, fake support accounts appear within hours. Binance does not ask for seed phrases, payments or "verification transfers".
• Do not rush to buy USDT or TRX from strangers on P2P this week. Stolen TRX is being fanned out right now. Coins that touched these addresses can get your account frozen at the next exchange, even if you did nothing wrong.
• Check the counterparty address before a deal. Our free checker reads the USDT and USDC blacklists straight from the contracts, so the frozen attacker addresses show up there immediately. The full list of attacker addresses is in the PDF.
• Watch the proof of reserves. The question is not the total but token by token: whether the replacement ether and bitcoin are actually on the listed wallets.

Method and limits

We started from Elliptic's public blocklist of 48 addresses and the hot wallet and transaction hashes published by CoinDesk, read the current balances, contract code and USDT and USDC blacklist status of every address, walked the bitcoin and TRX trees until the coins stopped moving, and matched every freeze against our own corpus of events from the USDT contracts on Ethereum and TRON. The delegation window was found by reading the code of Binance 14 at historical blocks. Dollar totals, the first-hour swaps, the Aave position and attribution come from the sources named in the table. The root cause is not confirmed until Binance publishes its report; we will update this page when it does.

Funds frozen and you think it is a mistake? Describe your case in a free assessment: we will tell you honestly what the chances are and where to start.