The Binance Hack: A deep dive into what happened and where the funds moved to

An attacker used one EIP-7702 authorisation to empty a Binance hot wallet, then drained wallets across six chains within minutes, and about half the value was frozen within hours because issuers and protocols could see where it was. This is our trace of where the rest is now, how it is being laundered, and what banks and payment firms need to do so none of it touches their rails. On the evening of 29 October 2026, an attacker got one of Binance's busiest Ethereum hot wallets to accept a single authorisation, then emptied it in one transaction. Within twelve minutes, ten more Binance hot wallets had sent funds to the same address, and Binance wallets on Bitcoin and Tron were sending to attacker addresses too. Binance puts the total impact at about $6.3 billion. A blockchain analytics firm puts it at about $6.4 billion. It is the largest crypto theft on record.

About half of it is already out of the attacker's reach. Stablecoin issuers, a lending protocol's guardians and a network's security council froze or restricted about $3 billion within hours, by Binance's count. That only works when someone can see where the money is while it is still moving. We traced it through the night with Strix, our AI investigation agent, and SR³, our intelligence platform.

The other half is everyone else's problem. About 505,600 ETH and $1.485 billion in Bitcoin have no issuer that can freeze them, and a steady stream of altcoins is being sold for ETH through single-use wallets. That money will look for a way out. A blockchain analytics firm attributes the theft to TraderTraitor, a North Korean cluster. For a bank or payment firm, the risk is not being hacked like Binance. The risk is touching this money without knowing it. That makes it a sanctions problem, not just a reputational one.

All figures are as of 30 October 2026, 15:30 UTC. Balances are still moving.

How one signature handed over a hot wallet

An ordinary Ethereum account is a key and a balance. It does whatever its key signs. EIP-7702, which arrived with Ethereum's Pectra upgrade in May 2025, lets that account point at a smart contract and run the contract's code. The account signs an authorisation naming the contract. From then on, any call to the account runs that code with full access to its balances. The link stays until the account signs a new authorisation that clears it.

How Binance 14 was opened: one type-4 transaction carried 50 authorisations, one matched the live nonce, the wallet delegated to the attacker's sweeper, and the first sweep of about $2.5 billion came 3 minutes 24 seconds later.

That is what happened to the wallet labelled Binance 14. Once it pointed at the attacker's "sweeper" contract, the attacker's operator could move its balances with an ordinary call. No further signature from Binance was needed.

The detail, all times UTC:

• Preparation. From 28 October, the operator was funded through Tornado Cash. On 29 October it deployed a delegate contract at 02:28 and the sweeper at 15:59, and rehearsed the delegate-and-sweep sequence on three of its own wallets between 14:19 and 16:47, moving $2 to $6 each time.
• The authorisation, 20:20:59. Binance 14 was still paying out withdrawals, so its nonce (the counter each authorisation must match) kept moving. The attacker sent one type-4 transaction carrying 50 signed authorisations covering nonces 18,914,775 to 18,914,824. Forty-nine failed. One matched.
• The sweep, 20:24:23. About 167,464 ETH, 1.615 billion USDT and about 60 other tokens, worth about $2.5 billion, went to the collection wallet 0x5227…2f8c. Binance 14 kept 1 ETH for gas.
• The standing drain. The delegation persisted. At 20:41:23 the attacker used it to pull 780 million and then 43 million USDC out of a smart account that Binance 14 controlled. At 21:44 it swept Binance 14 again for 200 million USDT and 13 tokens deposited since the first sweep. The operator was still calling the wallet at 23:56. Binance later revoked the delegation.

What is still open

How Binance's signing path came to sign attacker-supplied authorisations has not been explained. Binance's preliminary finding pointed to a compromised DevOps engineer's laptop that reached the service container submitting withdrawals, and Binance says it found no evidence that a private key leaked. On 30 October Binance said investigators had found additional points of breach and promised a full post-mortem. Any explanation will also have to cover the other Binance wallets that sent ordinary signed transfers to the attacker in the same minutes.

The freeze: about half stopped within hours

The attacker raced to turn the stablecoins, the part that could be frozen, into something that could not. In the first half hour it moved $500 million of USDT to a swap wallet, converted $325 million into $285 million of ETH over about 20 minutes, and sent the remaining $175 million to stopover wallets. Between 20:58 and 21:01 it supplied 60 million USDT to Aave V3 and borrowed 19,762 WETH. It was not fast enough. When Tether and Circle acted, about $1.97 billion of stablecoins was still sitting in the collection wallet.

The night of 29 October, times UTC: the attacker's moves on the left, the freezes by issuers, protocol guardians and a network's security council on the right.

Circle's freeze landed about 40 minutes after the first sweep. The Arbitrum seizure came less than four hours after the Arbitrum wallets were drained, and the Council says those funds can only move again through further Council action or an Arbitrum DAO vote. Aave's action was different in kind. Its risk service provider explains that markets were frozen across all networks because the attacker "could swap the stolen funds into any listed asset". That closed a route rather than seizing funds.

Totals differ by source. Binance says about $3 billion is frozen. A blockchain analytics firm reported about $2.8 billion. Both are their figures, not ours.

Every freeze in that table came from a party with a control point: an issuer's blacklist, a protocol's guardian, a network's emergency powers. Every one also needed someone to know, in real time, which address held what.

Tracing it live: what Strix saw overnight

Our published Workbench session, Binance Hack 2026oct (live), shows the trace as it happened. Open it to follow every question, tool call and answer in order. An analyst asked the questions. Strix did the tracing. Every answer was marked as a draft for compliance review.

• 23:38 UTC, 29 October. First pass: two minutes, ten tool calls. About $2 billion in stablecoins already frozen. Around 195,460 ETH sitting unfrozen in a second wallet. News reports said the operator was Tornado-funded. Strix flagged that it had not confirmed this yet.
• 23:52. After 11 minutes of analysis and 37 tool calls: a flow graph, an address tracker and one urgent finding. 174,999,872 USDT sat in a wallet that Tether had not frozen.
• 02:21, 30 October. On refresh, Tether had frozen it. Every traced USDT and USDC balance was now frozen. The money had not moved in the meantime, so the delay cost nothing.
• 05:36. The collection wallet sent 17,260 ETH to a new wallet at 05:15:47. Between 04:35 and 05:10, twelve large "USDT" transfers appeared to leave attacker wallets, copying the real amounts exactly. They came from a fake token and went to lookalike addresses. That is address poisoning. Strix kept them out of the tracker, and they should not be tagged.
• 05:54. The analyst asked Strix to check Arbitrum. It found the Arbitrum branch: Binance's Arbitrum wallets drained at about 20:30 to 20:34, funds moved on at 21:36 to 21:38, then removed from the attacker's wallet by two unsigned emergency transactions at 00:18:20. Only network-level authority can send those.
• 15:57. A bridge check. A $50 million transfer through a bridge-and-swap aggregator turned out to be a swap, not a bridge: 20,940 ETH came back in the same transaction. A cross-chain bridge transfer to Tron, flagged by the automated flow walk, belonged to an unrelated user who had traded through the same contract about 14 hours before the hack.
• 16:01. Strix confirmed the attacker's own seed money: about 1.29 ETH in total from Tornado Cash's 0.1 ETH and 1 ETH pools, all before the drain.

By then the tracker had grown from 28 to 38 addresses. That growth is the point. The attribution set for a live incident is never finished.

The flow graph below comes from a second published session, Binance drain: Ethereum + Arbitrum (updated). Open it to hover over any address for details or isolate its paths.

CipherOwl Workbench flow graph of the Binance drain on Ethereum and Arbitrum, 30 October 2026: solid lines are traced stablecoin transfers, dashed lines are ETH and token-sale moves, ending in the frozen balances and the unfrozen ETH holding wallets

Where the money is now

Positions from SR³ exposures at transfer-time USD, as of 30 October, 15:30 UTC. SR³ shows about $5.1 billion still in attacker-controlled wallets, including frozen stablecoins.

Attacker-controlled positions by chain from SR³ exposures, 30 October 2026, 15:30 UTC: the stablecoins are frozen, while the ETH, Bitcoin and TRX holdings are not. Bars are proportional to approximate USD value.

These USD figures mix transfer-time and current prices and overlap with issuer-reported freezes. Read them as orders of magnitude.

Strix's count puts 505,617.72 ETH, unfrozen, across six of these Ethereum wallets. The largest three hold about 197,460, 137,602 and 78,415 ETH. No issuer can freeze ETH or Bitcoin.

So far we have identified no deposits to a centralised exchange. The only exits are small ones on Tron. If the money reaches an exchange or any other service that holds customer funds, that service becomes the next place it can be stopped.

How the rest is being laundered

• Single-use liquidation wallets. From 00:06 UTC on 30 October, the collection wallet seeds a fresh wallet with 0.5 ETH for gas and one Binance-held token: ZRO, ZAMA, RSR, PROM, MORPHO and others. The wallet dumps the token on a decentralised exchange and forwards the ETH to a hub. One received 3,382,160,847.12 RSR. Another received 1,763,059.91 MORPHO. More than $400 million of altcoins has been sold this way.
• Bitcoin parked. The $1.485 billion was split into near-equal outputs of about $81 million each and has not moved since.
• A Tron peel network. 300 million USDT was swapped to TRX and split into four holding wallets of about $41 million to $54 million each, plus a distributor. The distributor feeds an automated network of about 140 peel wallets, each activated with exactly 1 TRX before forwarding funds. This is where the only off-ramps have appeared.

How the unfrozen funds are moving, as of 30 October 2026, 15:30 UTC: altcoins sold through single-use wallets on Ethereum, Bitcoin parked in 19 wallets, and a Tron peel network that has produced the only exits so far.

Who is behind it

A blockchain analytics firm attributes the theft to TraderTraitor, a North Korean cluster. Its strongest evidence is Binance proceeds mixing on-chain with funds from the September 2026 Bitget exploit, which we traced at the time. The tradecraft fits: Tornado-funded preparation, a dry run on owned wallets, an attack on the signing path rather than contract logic, and immediate multi-chain dispersal. The FBI used the same name when it attributed the $1.5 billion Bybit theft to North Korea in February 2025.

We have seen about 30 EVM addresses consolidate into a wallet we tag as Bitget Exploit 2026-09-24, active from 05:39 to 06:09 UTC on 30 October, inside the Binance laundering window. SR³ shows no direct hop to Binance-attributed wallets. We hold this as a related-actor cluster, not confirmed Binance proceeds, until a transaction-level link is shown.

Established, reported, open

• Established: the EIP-7702 delegation of Binance 14 to an operator-controlled sweeper; the Tornado-funded operator; the rehearsal; the flows above; the issuer freezes and the Arbitrum seizure.
• Reported: the laptop compromise as initial access (Binance, preliminary); the TraderTraitor attribution; totals of $5.5 billion to $6.4 billion, which differ by source and time of count.
• Open: how the signing path was made to sign 7702 authorisations; whether key material left Binance; where the bridge exit on Tron ended up; whether the Bitget cluster carries Binance funds.

Why this is a bank's problem

Banks moving into custody, stablecoins and tokenised deposits are unlikely to hold hot wallets the size of Binance 14. They will hold something more exposed: counterparties. Clients who off-ramp through them. OTC desks and market makers they settle with. Stablecoin flows they mint, redeem or clear.

This money has a known origin and a state attribution. North Korea is under comprehensive US sanctions, and the Treasury's sanctions office answers the question of whether digital currency changes anything in one line: "Yes, the obligations are the same." When the FBI attributed the Bybit theft, it asked exchanges, bridges, analytics firms and other services to "block transactions with or derived from addresses TraderTraitor actors are using". Derived from. Not just the addresses themselves.

That is the hard part. A single-use liquidation wallet has one inbound transfer and one outbound swap. Screened on its own, it looks clean. The two market-making contracts that bought the stolen tokens paid out 32,710 ETH and 4,770 ETH for them. They look like ordinary trade counterparties, and the stolen RSR, MORPHO and other tokens now sit in circulation. The exposure travels with the funds.

Five things to do now

1. Trace and alert from minute one

The first freezes landed within 40 minutes of the sweep. The attribution set grew all night. Your watchlist has to grow with it: subscribe to incident attributions, not a one-off export, and alert on any inbound exposure the moment a new address is confirmed.

2. Make freezing possible

If you issue a stablecoin or run a protocol with emergency powers, the question is not whether you can freeze. It is whether you know where your token is in time. Freeze requests need evidence: which address, how the funds got there, at what time. If you receive funds, you may be the next point where stolen money can be stopped. Be ready to act on that evidence.

3. Screen every counterparty, including the clean-looking ones

Screen exposure, not just matches. Cover every address on the attribution, including single-use liquidation wallets, and count hops. Precision matters as much as reach. Our own trace flagged a bridge transfer that belonged to an unrelated user. A crude taint model would have frozen that customer. Ask your provider two questions: how fast does a newly confirmed exploit address reach the screening decision, and does every result carry the evidence behind it? In our first pass at 23:38, the attacker addresses already carried Hack and Theft labels, but the quick risk score had not caught up. Label latency is a control gap. Measure it.

4. Monitor your own wallets

Binance 14's code changed from empty to a delegation pointer at 20:20:59. The first sweep came at 20:24:23. That is three minutes and 24 seconds in which the compromise was visible on-chain. Alert on any code change on your hot wallets, on large transfers to addresses with no history and on outflows that break your normal pattern. You should know you are compromised before the press does.

5. Hold custody partners to the controls this exploit argues for

Whether you run signing yourself or choose a custody partner, ask for:

1. EIP-7702 authorisations treated as privileged operations, with every entry in an authorisation list screened, including a batch spanning a nonce range.
2. A pre-signed revocation (delegation to the zero address) ready to broadcast. Rotating keys does not clear a delegation.
3. Destination allow-lists and per-window value caps enforced at the signer, not only in the withdrawal service that feeds it.
4. No live inventory in addresses whose delegation status is not monitored.

How CipherOwl helps

SR³ screens counterparties in under 10 milliseconds against exploit-linked attribution as well as sanctions lists, and every result carries its evidence trail. Continuous monitoring watches address pools and alerts when their risk changes. Strix traces across chains, bridges and swaps, as it did through this incident, and prepares freeze-ready evidence. SR³ produces filing-ready reports in under a minute. Your analysts sign off every decision. Every decision holds up under scrutiny.

If your institution offers or plans digital asset, stablecoin or custody services, start with one question: would you know today if any of this money touched your rails? Talk to our team and we will screen your counterparties against this incident.