FUN and the Binance hack: why a delisted token was on the hot wallet, how the hacker sold it all, and what is left of the market

The short version

Why FUN was on Binance at all

Binance delisted FUN in April 2026: trading stopped on 23 April, deposits were disabled on 24 April, and withdrawals stayed open until 23 June. A delisting closes trading, it does not take tokens away from people. Client coins stay on the exchange until their owners withdraw them.

The FUN balance of Binance 14, the wallet that was later drained, shows what happened next:

Right after the delisting Binance gathered everyone's FUN on one hot wallet so people could withdraw it. In half a year only about a quarter left. The remaining 74% stayed on a hot wallet four months after the withdrawal window closed. Most likely these are tokens of clients who did not manage or did not bother to withdraw. In 2024 Binance converted such delisted leftovers into USDC, so part of it may already have belonged to Binance formally, but we found no announcement about FUN. Binance has said it will cover client losses from the hack out of its SAFU fund.

First wave: a dump into a thin pool

• 29 October, 20:24:23 UTC. In the same transaction that swept the ether, the hacker moved 714,911,344 FUN to his main wallet 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c.
• 23:28:47 UTC. The whole amount went to a fresh address 0x06ea1ab3ecf570029eb1f94dbb9eac06bc79685f.
• Overnight. That address sold FUN into the small FUN/WETH pool on Uniswap in 154 transactions: 134,145,256 FUN for only 111.48 ETH, about $250k. The pool price fell by more than 90%.
• 30 October, 06:30:11 UTC. The selling stopped and the remaining 580,766,088 FUN went back to the main wallet. The 111.85 ETH of proceeds went to the vault wallet 0x79e70d139fc05aa75f75611fdf2680e9952b544a, which holds 34,280 ETH collected from other parts of the hack.

The FUNToken team asked exchanges to suspend FUN deposits. At that point news reports said the 580.8M FUN were still sitting with the hacker. That was true for one day.

Second wave: everything else, through several venues

• 31 October, 07:17 UTC. The 580.8M FUN moved to a new wallet 0xFB34f34A0a395afb3d5094816aa235483f0c2095.
• 07:29 to 19:32 UTC. The wallet sold all 580,766,087 FUN in 103 transactions, this time spread across Uniswap V3, DODO and JAM instead of one thin pool. It received 231.04 ETH and forwarded it to the aggregation wallet 0x8d4b8ee62124b7ee140a51ddd07390a56f1c9e19, which already holds 9,788 ETH from other parts of the hack.
• After that the hacker's wallets hold less than 1 FUN in total.

So the team's statement that the exploiter sold everything is confirmed on-chain. In total the hacker turned 714.9M FUN into 342.5 ETH, about $770k. Before the hack those tokens were worth about $6.3M. He realised roughly 12% of that; the rest is simply the price collapse.

One side detail: address poisoners went after the hacker himself. They sent zero-value transfers from a look-alike address 0xFB34459390a727c95d439b45c317b1029a112095, which matches the first and last characters of the real selling wallet. The same trick is used against ordinary users every day, which is why an address must be checked in full, not by its edges.

What the market looks like after the dump

What changed for the better. The largest forced seller is gone: there will be no second wave from the hacker, because he has nothing left. On 30 October the largest FUN wallet, 0x86Fd9f0b475562dddecabb5de5b8b0f2199bed51 (about 30% of the supply, no public label), sent 500M FUN to 0x2d5f17b56ecbb5323b7685e110dbea0703644d36, which immediately started trading in Uniswap pools and bought back about 22M FUN. This looks like the team supporting liquidity, as it promised. It is our reading of wallet behaviour; we have not confirmed that these wallets belong to the team.

What did not change.

• The price kept falling after the hacker stopped. At 19:32 UTC on 31 October, when the last sale went through, FUN was about $0.0030. At the time of writing it is about $0.0018, another 40% down without him. Ordinary holders are selling now.
• Overall the price went from about $0.0088 to about $0.0018, minus 80%, and the market cap from about $97M to about $20M.
• Venues. Binance delisted FUN back in April. The largest volume is now on HTX, about $3M a day, and HTX has been under a full EU ban since 23 August. Other exchanges show tens of thousands of dollars a day. Liquidity in the Ethereum pools was around $16k, so even small sales move the price sharply.
• Concentration. The two largest wallets hold 55% of the supply: the unlabelled wallet with about 30% and Gate.io with about 25%. About 50M FUN also sits on the wallet of the 2024 WazirX hacker, who can sell it at any time.
• The reasons for the delisting. Binance dropped FUN for weak metrics before the hack. The hack did not fix that.

Our reading: the risk of the hacker selling more is gone, the problems that got FUN delisted are not. Buying now is a bet on a short rebound in a thin market, not buying something healthy at a discount. If you trade it, size the position so you can lose all of it, and keep in mind that exiting a large amount at a good price will be hard.

What this means if you hold a delisted token on an exchange

• A delisting is a deadline, not a status. After the withdrawal window your tokens may sit on a hot wallet together with everyone else's, or be converted at the exchange's discretion.
• A hot wallet can hold a large share of a small token's supply. If it is drained, that share hits the market at once, and the price falls for every holder, including those who never used the exchange.
• Before buying after a dump, check who holds the supply and where it trades. Our free address checker shows the blacklist, sanctions and scam markers of any wallet you are about to deal with.

Method and limits

We read the FUN balance history of Binance 14 at historical blocks, followed every FUN transfer out of the hacker's wallets, summed the swap outputs per transaction and checked the final balances of all wallets involved. Dollar figures use the ETH price at the time of the sales and are rounded. The link between the largest holders and the FUNToken team is an inference from behaviour, not a confirmed fact. The full picture of the hack itself is in our main investigation: the Binance hack of 29 October 2026.