The Trojan Logic7702The $6.4 billion Binance hot-wallet theftPart 1 · The Ethereum on-chain map
The published reports put the theft at about $6.4 billion across 11 chains (Elliptic), roughly $3.80 billion of it on Ethereum. The total is Chainalysis's and Elliptic's; the Ethereum split is Elliptic's. These are the reports' figures, not chain records: who published them is listed under the introduction.
This is Part 1: the Ethereum money, read on chain.
On the evening of 29 October 2026 an attacker drained funds from Binance hot wallets on Ethereum. The door was opened with Binance 14's own signature, and it stayed open for 3 h 49 min 36 s. This report follows the money wallet by wallet, from the hot wallets to where it sits now, and shows exactly what the chain records and what it does not.
The reports point to North Korea. Chainalysis assesses TraderTraitor, the North Korean group the FBI also calls Lazarus Group; Elliptic says "likely". There was no government attribution as of these reports.
On the evening of 29 October 2026 someone took funds from three of Binance's hot wallets on Ethereum. No lock was forced: the permission was signed with Binance's own key. Whether that key was stolen or misused, the chain cannot say.
This report follows the stolen money on the Ethereum chain: where it went, what got frozen, and where it still sits.
The published reports point to a North Korean group, TraderTraitor, which the FBI also calls Lazarus Group. That is their assessment, not a proven fact.
How was Binance hacked, and where did the money go?
On 29 October 2026, on Ethereum, the Binance hot wallet Etherscan labels "Binance 14" was handed to an attacker's code by one of 50 authorisations delivered together, every one signed with Binance 14's own key. How those signatures were obtained is not established. The attacker's code stayed on it for 3 h 49 min 36 s. Tether and Circle froze 1,175,464,712.875462 USDT and 823,000,000 USDC at the wallet collecting the money, within 40 min 36 s of the first sweep.
Most of the ETH this report follows went to wallets that had sent no transaction as at the reads of 30 October. As read on 30 October, the four biggest balances among the 54 wallets Etherscan labels "Binance Hot Wallet Exploiter" were 197,460 ETH (Exploiter 8), 137,602 ETH (Exploiter 19), 78,415.25 ETH (Exploiter 11) and 40,600.67 ETH (Exploiter 17).
Chainalysis and Elliptic point to North Korea's TraderTraitor, the group the FBI also calls Lazarus Group. That is a lead: their assessment, not a finding of this report, which shows where the money went and is not an assertion of criminal conduct against any named individual or company.
This report is not legal or financial advice, and it is not an assertion of criminal conduct against any named individual or company.
LEAD Who published the figures and the attribution above
Chainalysis, blog post on the Binance exploit, published 30 Oct 2026: the theft total, and the assessment that the attacker is TraderTraitor. chainalysis.com
Elliptic, analysis of the Binance hack, updated 30 Oct 2026: the theft total across 11 chains, the Ethereum share, and "likely" TraderTraitor, with caveats. elliptic.co
FBI, statement of August 2023: it calls TraderTraitor-affiliated actors "also known as Lazarus Group and APT38". fbi.gov
CISA, FBI and US Treasury, joint advisory AA22-108A, April 2022, on TraderTraitor as a North Korean state-sponsored group. cisa.gov
These are the publishers' figures and assessments. This report has not re-derived them from the chain, which is why they carry a LEAD. Readings 1200 (30 Oct) and 0024 (31 Oct) in the source list record what each says and when it was read.
NetworkEthereum
Evidence as at30 October 2026
RegisterForensic audit report
Choose your read
EASY keeps the story, the map and the snips, and folds away the Facts and Stats, the wallet list and the source list. TECH shows every record.
A
The bottom line
Eight findings, each with the section that carries it
What happened, in five short paragraphs
An exchange keeps some coins in "hot wallets" so it can pay out quickly. On 29 October one of Binance's hot wallets on Ethereum handed control of itself to the attacker's code. The permission was signed with that wallet's own key.
From there the attacker swept funds out of it, used it to unlock a second Binance wallet, and drew money from a third.
The attacker sold the stablecoins for ETH as fast as it could, because the companies behind stablecoins can freeze them and nobody can freeze ETH. Tether and Circle still froze close to 2 billion dollars of it within the hour, and RLUSD's issuer froze more soon after.
As at our reads of 30 October, most of the stolen ETH had not moved. It sat in a handful of wallets that had never sent a single transaction.
This report does not say who did it. It shows where the money went, and how sure each step is.
In plain English
An exchange keeps a float of coins in "hot wallets" so it can pay withdrawals quickly. On 29 October someone got one of Binance's hot wallets on Ethereum to hand control of itself to the attacker's code. That handover was signed with the hot wallet's own key.
From there the attacker swept funds out of it and used it to instruct a second Binance wallet, which accepted the instruction. In the same minute a third Binance wallet sent 95.07% of its ETH to the attacker, in transactions signed with its own key.
Two stablecoin issuers froze the biggest pile within 40 min 36 s of the first sweep. Most of the ETH sits in wallets that had sent nothing as at the reads of 30 Oct. Of the USDT that got out first, Tether caught another 205 million minutes later, at Exploiter 21 and Exploiter 7.
The issuer of a third stablecoin, RLUSD, froze 40.5 million of it, at the wallet selling it, in the block of its last sale.
This report does not say who did it. It shows where every coin it follows went, and how sure each step is.
At 20:20:59Z Binance 14 was handed to the attacker's code by one of 50 authorisations, every one signed with Binance 14's own key. The attacker's code stayed on it until 00:10:35Z, when another transaction signed with the same key removed it.
Section C · VERIFIED on our node · how the signatures were obtained is not established
Three Binance hot wallets lost funds: Binance 14 (167,464.25 ETH and 1.615 billion USDT in the first sweep alone), Binance 16 (95.07% of its ETH in one block) and Hot Wallet 34 (823 million USDC, released on Binance 14's instruction).
Section D · VERIFIED transfers · the Hot Wallet 34 mechanism is from Etherscan's trace, a FINDING
Ten minutes after the drain began, the attacker started selling USDT. 325 million USDT became 122,316 ETH in 15 min 12 s.
Section E · FINDING from Etherscan exports, paired sale by sale
Tether froze the collecting wallet at 21:01:35Z with 1,175,464,712.875462 USDT in it. Circle's USDC contract froze the same wallet 3 min 24 s later with 823,000,000 USDC in it.
Section F · VERIFIED
375 million USDT left before the first freeze could catch it. Tether froze 174,999,872.33 of it at Exploiter 21 at 21:14:59Z, and 30 million at Exploiter 7 at 21:18:59Z. Tether blacklisted eight wallets on its path in 17 min 24 s, then Binance 14 itself. Two wallets the USDT passed through, Exploiters 4 and 20, were not blacklisted. Of the rest, 60 million was posted on Aave as collateral for ETH loans and 110 million was sold, 100 million of it on Uniswap for 34,582.84 ETH.
Section F · freezes VERIFIED on our node · flows FINDING from Etherscan pages
From 22:55:35Z Binance 14 and Binance 16 sent their remaining tokens to a wallet Etherscan labels "Binance: Cold Wallet 20". The attacker's code was still on Binance 14 for another 1 h 15 min, and in that time a Binance-labelled wallet sent it 2,961.99 ETH. One minute later the attacker swept 2,961.91 ETH out. Whether that was the same ETH is not established.
Section G · cold sweep and the 2,961.99 ETH: FINDING · sweep 5 and the clearing: VERIFIED · the labels are a LEAD
Two collecting wallets hold 40,600.67 ETH and 137,602 ETH. Apart from dust, the ETH in both traces back to Binance 14 or Binance 16. No other Binance wallet appears behind them. A third, Exploiter 11, holds 78,415.25 ETH, had never sent a transaction as at our read of 31 October, and apart from dust its ETH also traces to the drain.
Section H · FINDING · Exploiter 11's balance VERIFIED on our node
The one address the public reports printed is not where this trail of Binance money went. The one inflow to it that was traced, 71.45 ETH through THORChain, came from Bitcoin held before the theft. The other 14 are not read. None of the 56 exploiter-side wallets checked sent anything into THORChain's router on Ethereum in the first 16 hours.
Section I · FINDING
B
Read this first
How each claim is marked, and what the lines on the map mean
How sure is each claim?
Every claim carries a label. VERIFIED means read straight from the blockchain. FINDING means worked out from a block explorer's records. LEAD means someone else's label or report, not yet checked. NOT ESTABLISHED means the evidence cannot show it.
On the map, a crosshair marks a wallet still holding stolen money, and a padlock marks frozen money. Switch to TECH for every record behind every line.
Every claim carries one banner. It is printed as a word, so colour never carries it alone.
VERIFIED read on our own Ethereum node: the transaction, its events, or an account's code and balance at a block.
FINDING from explorer exports (Etherscan), reconciled: totals checked against balances, sales paired with their proceeds by transaction hash.
LEAD a label an explorer or analytics platform applied, or a figure from a published report. A label says what a platform calls an address, not who controls it.
NOT ESTABLISHED said out loud, so nobody fills the gap with a guess.
Names like "Exploiter 17" are Etherscan's public labels, used here because they are what you will see when you check. Every wallet is also given with its full address in section J.
Under each finding is a Facts and Stats drop-down. It carries the addresses, transaction hashes, windows and the source file behind every number. Times are UTC.
Scope
Ethereum only. Elliptic names 11 chains; the others are not read here. This is an evidence record, not financial or legal advice.
◉
The map
Press Play, or drag the clock. Click any wallet or line.
The clock runs from just before the first transfer to the last ETH arriving at Exploiter 17. Solid lines were read on our node; dashed lines come from Etherscan exports; dotted lines are calls that carry no value of their own. Red marks a freeze.
Attacker code on Binance 14–
Binance hot wallets hit–
USDT moved out before the freeze–
USDT frozen at Exploiter 2–
USDC frozen at Exploiter 2–
–
FLOWS
click the map, then scroll to zoom · drag to pan · ⛶ for full screen · zoom ×1.0
read on our nodeEtherscan exportcall, no value of its ownPlatform logos: Binance where Etherscan labels the wallet Binance (a lead); Tether, Circle, Ripple, Aave and Uniswap on their contractsattacker-sideholdingissuer actioncrosshair: still holding what it tookpadlock: stolen stablecoins frozen inside
C
The door: Binance 14's own signature
How the attacker got inside the first hot wallet
Since the Pectra upgrade of 7 May 2025, Ethereum lets an ordinary wallet borrow a smart contract's code for a while, if its owner signs a permission. The attacker sent Binance 14 a batch of these permissions, all pointing at the attacker's own code. One took effect, and from then on Binance 14 did whatever that code told it to.
Every permission in the batch was signed with Binance 14's own key. The chain cannot tell whether the key was stolen or Binance's own signing system was tricked into signing.
In plain English
Since the Pectra upgrade of 7 May 2025, Ethereum lets an ordinary wallet borrow the code of a smart contract for a while. The owner signs a short note, an "authorisation", that says: run this code for me. That feature is EIP-7702, one of the changes Pectra brought in.
At 20:20:59Z a transaction arrived carrying 50 of those notes for Binance 14, all pointing at the same attacker contract. One took effect, and Binance 14 started running the attacker's code. Three minutes and 24 seconds later the sweeping began.
Every one of the 50 notes was signed with Binance 14's own key. The attacker's wallet only paid the postage.
This is the Trojan Logic. Nothing was broken down. The attacker's code was let in through the gate, signed in with Binance 14's own key, and it ran from inside. Whether the key was handed over, stolen, or tricked into signing, the chain cannot say.
Note · The Trojan Horse, and EIP-7702
In the story, Troy's defenders pulled a gift horse in through their own gates. The soldiers hidden inside opened the city from within. Nobody had to break the walls.
EIP-7702, one of the changes in Ethereum's Pectra upgrade of May 2025, lets an ordinary wallet run a smart contract's code, its "logic", once the wallet's owner signs a permission. Here the horse was the attacker's logic, and the permission that let it in was signed with Binance 14's own key.
Fifty signatures over fifty consecutive nonces is not what a payout process would normally sign. It would let one signature land on a wallet whose nonce moves every few seconds. Some of them were already stale when they arrived. That is an observation about the pattern, not a finding.
NOT ESTABLISHED whether the key itself was taken or Binance's signing system was made to sign. The chain cannot tell those apart. Elliptic carries Binance's account of a compromised DevOps laptop; that is Binance's claim, not a chain record.
Each tuple's signer was recovered from its own signature (keccak256 of 0x05 and the RLP of chainId, address and nonce; low-s required). 50 of 50 recover to Binance 14. The recovery tool's 25 offline tests include a tampered nonce and a high-s signature that must not recover.
Binance 14's code was 23 bytes, an EIP-7702 designation to Exploiter 24, from block 26300753 through block 26301895. 24 sampled blocks in between showed no change: sampled, not exhaustive.
Sources: Reading 1346 · 30 Oct · 86f7c2eb6444Reading 1355 · 30 Oct · 7f9a550eefbcReading 1555 · 30 Oct · 10980b91fe7e
D
Three hot wallets, one collecting wallet
What left Binance before the first freeze
Within minutes Binance 14 paid out its ETH and its stablecoins to one attacker wallet, Exploiter 2.
In the same minute a second Binance wallet, Binance 16, sent most of its ETH to the same place. It was not running the attacker's code. It signed those payments itself.
A third wallet, Hot Wallet 34, takes its orders from Binance 14. The attacker had Binance 14 give the order, and Hot Wallet 34 paid out hundreds of millions in USDC.
At 20:24:23Z the attacker sent its first sweep to Binance 14. Running the attacker's code, Binance 14 paid out 167,464.25 ETH and 63 token transfers, the largest 1.615 billion USDT, to one collecting wallet, Exploiter 2.
24 seconds later, Binance 16 sent Exploiter 2 28,005.6 ETH and eight tokens in one block. That was 95.07% of its ETH. Binance 16 had no delegated code at the drain block, or when read again on 30 Oct. It signed all nine transfers itself.
Hot Wallet 34 is a Binance smart-contract wallet that takes orders from Binance 14. At 20:41:23Z the attacker had Binance 14 give the order, and Hot Wallet 34 sent 780 million USDC to Exploiter 2. At 20:59:47Z it sent 43 million more.
One hijacked hot wallet opened a second one, because the second accepted its instructions.
In chess a captured piece never fights for the other side. In shogi it does: the captor drops it back on the board as their own. Binance 14 was that piece. Still wearing Binance's colours, it moved for the attacker, and its move opened the line to Hot Wallet 34: a discovered attack.
Chess note · The shogi drop
Shogi is Japanese chess. Unlike in Western chess, a captured piece is not removed from the game: it changes sides, and its captor can later "drop" it back onto the board to fight for them. In chess a piece can never be turned against its own side. In shogi it is a normal move.
Chess note · Discovered attack
One piece moves out of the way and, by moving, opens a line for another attack behind it. The defender has to deal with two threats at once.
Binance 14 was swept five times in all. Sweeps 2 and 3 went to Exploiter 2 at 21:04:23Z and 21:44:11Z. Sweep 4, at 22:39:35Z, sent 122 more tokens to a second collecting wallet, Exploiter 22. Sweep 5 comes in section G.
Binance 16 (Binance 16BINHACK-1029:CPTY:DFd529-43963d:CG0xDFd5293D8e347dFe59E90eFd55b2956a1343963d) in block 26300772: 28,005.6 ETH (tx 0x51f263fa…), 55,739,800.5 USDT, 25,943,825.8 RLUSD, 84.5 WBTC, 819,997.1 UNI, 1,199.3 XAUt, 18,819,171.4 ENA, 304,598.2 LINK and PEPE, each in its own transaction signed by Binance 16.
Hot Wallet 34 (Hot Wallet 34BINHACK-1029:CPTY:Ee7aE8-3b4055:CG0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055) is an ERC1967 proxy. Etherscan's trace of 0xdc102dd8…: Exploiter 1 calls Binance 14; Binance 14 calls execute(USDC, 0, transfer(Exploiter 2, 780,000,000)) on Hot Wallet 34; Hot Wallet 34 calls USDC's transfer. It is not an allowance. Our node confirms one USDC Transfer in each of the two transactions; the call frames are Etherscan's trace, not ours.
NOT ESTABLISHED what rule lets Binance 14 instruct Hot Wallet 34 (owner, role or allow-list). The implementation's source and storage were not opened.
Sources: Reading 1303 · 30 Oct · f9fe9d050bb2Reading 1330 · 30 Oct · eff71aee56c2Reading 1337 · 30 Oct · c0bdbc2be6e4Reading 1346 · 30 Oct · 86f7c2eb6444Reading 1432 · 30 Oct · 0debfef95907Reading 1500 · 30 Oct · ad35f8e91794Reading 1601 · 30 Oct · deb58cbf745c
E
The race to sell
Stablecoins can be frozen. ETH cannot. So the stablecoins went first.
A stablecoin like USDT can be frozen by the company that issues it. ETH cannot be frozen by anyone. So the attacker's first job was to turn stablecoins into ETH.
The selling began within minutes of the theft. In about a quarter of an hour, 325 million USDT had become ETH. The stolen UNI, ONDO, ENA, RLUSD and AAVE went the same way, sold on exchanges built into the blockchain.
At 20:30:11Z, under six minutes after the first sweep, 500 million USDT left Exploiter 2 for a selling wallet, Exploiter 18. Another 200 million went to Exploiter 10 at 20:33:23Z.
Exploiter 18 never sold anything itself. It approved trading contracts to take its USDT, and the ETH came back inside their settlement transactions. Between 20:34:23Z and 20:49:35Z, 325 million USDT became 122,316 ETH. 122,310 ETH of it went to one wallet, Exploiter 19, at 21:47:47Z.
The ENA went the same way. Exploiter 14 sold 217.5 million ENA for 15,288 ETH and passed 15,292 ETH to Exploiter 19. It did not sell the 29,934 wBETH it was given.
The RLUSD took a detour through two relay wallets before Exploiter 16 sold 48 million of it, then 127,952.74 AAVE, for 26,827.67 ETH. Smaller wallets sold Binance 14's WLD, RSR and MORPHO.
Ten minutes from the first sweep to the first USDT sale.
Facts and Stats · the USDT sale, paired by transaction
Exploiter 14BINHACK-1029:CPTY:7f9DC9-5415E3:CG0x7f9DC988B46336aD536828fAD50fa8fA1E5415E3 received 217,497,348.0108 ENA and 29,934.0131631 wBETH from Exploiter 2. The ENA left in 20 Multicall transactions and 15,287.983819876215148918 ETH came back, every ENA transaction paired. 15,292 ETH went to Exploiter 19BINHACK-1029:CPTY:c887aF-5B286A:CG0xc887aF690E0301CD4edBbCe8F8d31b4EC65B286A at 00:59:23Z. By its rows the wBETH is unsold; its live balance was not read.
Sources: Reading 1503 · 30 Oct · 1a00a0b99a8aReading 1520 · 30 Oct · f739392f9758Reading 1528 · 30 Oct · e3a54dbe7a2cReading 1532 · 30 Oct · 7a21fb9b3be1Reading 1540 · 30 Oct · 76b9826a4ce0Reading 1612 · 30 Oct · 1bd805078f79
F
The freezes
Two issuers, 3 min 24 s apart
Who froze what, and what got away
Tether froze the main attacker wallet with more than a billion USDT still inside. Circle froze the USDC in the same wallet minutes later. The attacker never moved a cent of it.
Some USDT had already left. Tether chased it from wallet to wallet, freezing most of them, and in the end froze Binance's own hijacked hot wallet too. RLUSD's issuer froze the stolen RLUSD while the attacker was still selling it.
Tether and Circle froze close to 2 billion dollars of stolen stablecoins in the main collecting wallet alone, and Tether froze more after that. What they missed had already been swapped for ETH, or posted as collateral on Aave, where it still is.
For the first half hour it looked like smothered mate: Binance boxed in by its own pieces. It was not mate.
A stablecoin issuer can blacklist an address. After that, the coins at that address cannot move. Tether did it to Exploiter 2 at 21:01:35Z, 37 min 12 s after the drain began. It caught 1,175,464,712.875462 USDT.
Circle's USDC contract blacklisted the same wallet at 21:04:59Z. It caught 823,000,000 USDC, all the USDC Hot Wallet 34 had sent it. The attacker never moved a cent of it.
The catch is what had already gone. 700 million USDT had left Exploiter 2 before the freeze. 325 million was sold. That leaves 375 million.
Exploiter 10 got 200 million. It sold 10 million, receiving at least 2,485.89 ETH, and sent 190 million on to Exploiter 3 at 20:52:59Z. Tether froze Exploiter 10 at 21:01:47Z, 8 min 48 s too late: it froze 0.0001 USDT.
Exploiter 20 got 175 million at 20:59:11Z. It had not been frozen as at 16:19Z on 30 Oct. At 21:08:23Z, 6 min 48 s after Exploiter 2 was frozen, it sent the 175 million to Exploiter 21.
Exploiter 21 sent 127.67 USDT to a wallet Etherscan labels "MetaMask: Gas Station Swap" and moved nothing else. At 21:14:59Z, 6 min 36 s after the 175 million arrived, Tether froze it with 174,999,872.32762 USDT inside.
Exploiter 3 did not sit still. Between 20:57:59Z and 21:00:59Z it posted 60 million USDT on Aave as collateral and borrowed against it, taking ETH debt tokens of 3,271.42 and 16,490.98. At 21:01:59Z, 24 s after Tether froze the collecting wallet, it sent the other 130 million on. Tether blacklisted it at 21:02:47Z. Two more wallets sold 50 million each on Uniswap between 21:04:47Z and 21:09:11Z, for 34,582.84 ETH in all, passing the ETH forward as they went. The last 30 million reached Exploiter 7 at 21:16:11Z. Tether froze it there 2 min 48 s later.
What Arkham shows · the Uniswap sale
Arkham's visualiser, captured by CrYptOG on 30 Oct. Left, the entity Arkham labels "Binance Hacker"; right, Uniswap; each line a transfer. Its table lists 41.398K ETH and 80M USDT passed between the exploiter wallets, 9.3M and 1.92M USDT into Uniswap, and 2.834K ETH back. LEAD These are Arkham's labels and rounded figures. They agree with the Etherscan rows this section rests on.
Image as filed: Screenshot 2215 · 30 Oct, sha256 06adf0e0e70d30d4290eaa976fbf14767890bb3e62505ea8c04a09f3f70de6ff
Tether was not the only issuer acting. Ripple's RLUSD can pause a single account. At 22:00:59Z, in the block of Exploiter 16's last RLUSD sale, it paused Exploiter 16 with 40,541,065 RLUSD inside: 48 million had been sold, the rest was stopped. About twenty minutes later, at 22:20:47Z, it paused Binance 14 itself on RLUSD, though Binance 14 held none.
The first freeze landed on the wallet that 700 million USDT had just left. Tether kept chasing: eight wallets on the USDT's path blacklisted in 17 min 24 s, then Binance 14 itself at 22:06:23Z.
For the first half hour this looked like smothered mate: Binance's own key and its own trusted wallet doing the attacker's work. It was not mate. The issuers' freezes caught close to 2 billion dollars of stablecoins within 40 min 36 s of the first sweep.
Chess note · Smothered mate
A checkmate where the king cannot escape because its own pieces block every square around it. A single knight, jumping over the wall, finishes it. The king is beaten by its own defenders as much as by the attacker.
Freezes, first read on a public Ethereum node and re-read on our own node (all matched): Exploiter 21 blacklisted in block 26301021 (0x0c07a5e4…) and Exploiter 7 in block 26301041 (0x3445389c…), both sent by Tether multisig signer to Tether: Multisig, both still blacklisted at block 26308547. The same method reproduced the known freezes of Exploiters 2 and 10 to the block, transaction and log index, and returned "not blacklisted" for Exploiters 20 and 4.
Sale proceeds, from Etherscan's internal transactions: Exploiter 4 received 18,085.21 ETH for 50,000,000 USDT and Exploiter 5 received 16,497.63 ETH for 50,000,000 USDT, each balance-checked to within the rounding of the page.
Flows from Etherscan pages read on 30 Oct (filters at default: spam and zero-value rows hidden), not node reads. That the Aave debt is ETH rests on Etherscan's method name "Borrow ETH"; the borrowed ETH itself was not read. LEAD Elliptic reports 59.9M USDT posted on Aave and 19,762 ETH borrowed. The debt tokens here total 19,762.40; the 60,000,000 USDT here against 59.9M in the report is not reconciled.
Forged rows were excluded by contract: fake "USDT" and "ERC-20 TOKEN*" contracts copy the real 175M and 190M amounts and point them at lookalike addresses.
LEAD Elliptic reports Tether froze a 1.18B USDT wallet 37 minutes after receipt, and Circle froze 823M USDC about three minutes later. Both now match chain records.
RLUSD proxy 0x8292bb45bf1ee4d140127049757c2e0ff06317ed, implementation read from the proxy's EIP-1967 slot. accountPaused(Exploiter 16) returned 1 at block 26308614, balance 40541065000000000000000000 (18 dp). AccountPaused events: block 26301251, log 1392, tx 0xafd52fb2… (Exploiter 16); block 26301350, log 705, tx 0x6387e1bb… (Binance 14). Both sent by RLUSD pause senderBINHACK-1029:CPTY:a00e5a-fAE4af:CG0xa00e5aee3Fb82158AB4D6A1d2d8494813efAE4af to RLUSD pause callerBINHACK-1029:CPTY:83f7f1-541fA9:CG0x83f7f1c6A1547aFE2841943f428Cf6ff28541fA9, whose Etherscan page names the creator "Ripple: Deployer" (LEAD). 0 AccountUnpaused events from block 26300700. Controls: Exploiters 2, 31 and 32 read 0. Re-read on our own node: both pauses, 0 unpauses, all matched.
Every Tether blacklist event from block 26300700 to block 26309248, read on our own node, each with the wallet not blacklisted one block before and blacklisted at the block: 11 AddedBlackList, 0 RemovedBlackList, 0 DestroyedBlackFunds. On the theft path: Exploiter 2 and Exploiter 18 at 21:01:35Z, Exploiter 10 at 21:01:47Z, Exploiter 3 at 21:02:47Z (0xe48d47c6…), Exploiter 5 at 21:12:35Z (0x28836ef9…), Exploiter 21 at 21:14:59Z, Exploiter 6 at 21:16:47Z (0x3c08d840…), Exploiter 7 at 21:18:59Z, and Binance 14 at 22:06:23Z (0x312e166c…). Exploiters 3 and 5 were confirmed by a second signer, Second Tether signerBINHACK-1029:CPTY:61D5a4-199fED:CG0x61D5a4d5Bd270e59E9320243e574288e2a199fED; the rest by Tether multisig signer. Two blacklists on 30 Oct are not linked to the theft by these reads. Earlier drafts counted four; the event log shows eight on the exploiter side.
Sources: Reading 1606 · 30 Oct · 78fd287219f1Reading 1619 · 30 Oct · c5b2350823d6Reading 1622 · 30 Oct · 4e0a9739abdfReading 2225 · 30 Oct · 63df702895a2Reading 2245 · 30 Oct · 70dba87d0395Reading 2255 · 30 Oct · 6c7ee692c6a6Reading 2310 · 30 Oct · 44414ee2110aReading 2352 · 30 Oct · a47d4232b0eeReading 1200 · 30 Oct · 51eb4b75a2e6
G
The hot wallets after the drain
What the same wallets did next, and what the chain cannot say
The attacker's code stayed on Binance 14 for almost four hours. While it was there, Binance 14 and Binance 16, signed with their own keys, sent their remaining tokens to a wallet Etherscan labels a Binance cold wallet. A wallet Etherscan labels "Binance" topped Binance 14 up, and a minute later the attacker swept a similar amount out.
Then a transaction signed with Binance 14's own key removed the attacker's code. The same key that let the attacker in shut the door. The chain shows the key, not the hand that used it.
Binance 16 kept paying ordinary withdrawals for 20 minutes after it was drained. At 20:44:59Z it stopped. Nothing left it for 130 minutes.
At 22:55:35Z, in the same second, Binance 14 and Binance 16 both began sending their remaining tokens to the wallet Etherscan labels "Binance: Cold Wallet 20", signed with their own keys. That is 2 h 31 min after the drain began.
The attacker's code was still sitting on Binance 14. At 23:55:47Z a wallet Etherscan labels "Binance", type "Deposit Address", sent Binance 14 2,961.99 ETH. At 23:56:47Z the attacker's fifth sweep took 2,961.91 ETH out of it. Whether that was the same ETH is not established.
At 00:10:35Z a transaction that Binance 14 sent to itself, signed with its own key, pointed the delegation at address zero. The attacker's code was gone. It had been there for 3 h 49 min 36 s.
The door stayed open for 1 h 15 min after the cold sweep began. It was shut with the same key that had opened it.
NOT ESTABLISHED who operated the keys at each moment. The reports say Binance acted; the chain shows only which key signed.
Facts and Stats · the response timeline
Time (UTC)
Event
After the drain
20:24:23
Drain begins (Binance 14 sweep 1)
21:04:59
USDC freeze on Exploiter 2
+40 min
22:06:23
Tether blacklists Binance 14 itself
22:55:35
Cold sweep begins, to Cold Wallet 20
+2 h 31 min
23:55:47
Refill of 2,961.99088155497861206 ETH from the Binance-labelled deposit wallet
23:56:47
Sweep 5 takes 2,961.9108209382853 ETH to Exploiter 22
00:07:11
Binance 14 moves a token to Cold Wallet 20
00:10:35
Delegation cleared
+3 h 46 min
Refill wallet Binance deposit walletBINHACK-1029:CPTY:Eae738-58A4F4:CG0xEae7380dD4CeF6fbD1144F49E4D1e6964258A4F4: refill tx 0xc1f0fdb9…, block 26301823. The same wallet sent Binance 14 7,067.699374951196379817 ETH at 20:19:35Z, 84 s before the delegation; that ETH was part of what sweep 1 took. Reading it as a routine top-up is an inference, not a finding.
Clearing tx 0xafbf94c9…, block 26301896: type 0x4, Binance 14 to itself, one authorisation to address 0x0000000000000000000000000000000000000000, nonce 18,914,904, signer recovered as Binance 14. Cold Wallet 20: Cold Wallet 20BINHACK-1029:CPTY:F97781-41aceC:CG0xF977814e90dA44bFA03b6295A0616a897441aceC.
NOT ESTABLISHED that sweep 5 took "the refill" as such: Binance 14's balance between the two blocks was not read, and other ETH arrived in the window. LEAD that the refill wallet is Binance's rests on Etherscan's label. A label says which door, not whose hand.
The same keys signed the theft-side authorisations and transfers and the later sweeps to the cold wallet, so the chain alone cannot say who operated them at each moment.
Sources: Reading 1355 · 30 Oct · 7f9a550eefbcReading 1408 · 30 Oct · e907e6a34323Note 1414 · 30 Oct · cc90b31da75aReading 1425 · 30 Oct · 1d5558f01601Reading 1545 · 30 Oct · fef95a50669fReading 1548 · 30 Oct · c60b2e5eac76Note 1554 · 30 Oct · 77428c64124eReading 1555 · 30 Oct · 10980b91fe7e
H
Where it sits
The parked ETH, and what is still frozen
As at our reads of 30 October, most of the stolen ETH had not moved. It sat in a few wallets that had never sent a transaction, the biggest of them holding almost two hundred thousand ETH. On the map each one wears a crosshair.
The frozen stablecoins sit where they were caught, each wallet marked with a padlock.
One position is still live: the attacker's 60 million USDT, posted on Aave as security for a loan in ETH. If ETH rises, or the loan's interest keeps building, the attacker's loan can be liquidated. That is a risk to the attacker's position, not to Aave.
Most of the ETH went to holding wallets that had sent no transaction as at the reads of 30 Oct. Nonce 0 means a wallet has signed nothing yet.
Wallet
Holds
From
Banner
Exploiter 8
197,460 ETH
Exploiter 2, swept from Binance 14 and 16
VERIFIED
Exploiter 19
137,602 ETH
325M USDT and 217.5M ENA sold
FINDING
Exploiter 11
78,415.25 ETH
Exploiters 7 and 15; no transaction sent as at 31 Oct; traces to Binance 14 and 16
balance VERIFIED · source FINDING
Exploiter 27
34,279.69 ETH
Exploiters 12, 47, 26 and 46; nonce 0
balance VERIFIED · link to the theft NOT ESTABLISHED
Exploiter 17
40,600.67 ETH
RLUSD, AAVE, WLD, RSR, MORPHO sold; sweeps 4 and 5
FINDING
Unlabelled holder
17,260 ETH
Exploiter 2
VERIFIED
Exploiter 51
3,236.72 ETH
Exploiters 49 and 45, one unlabelled; nonce 0
balance VERIFIED · link to the theft NOT ESTABLISHED
Exploiter 50
3,000 ETH
Exploiter 22, sweeps 4 and 5
VERIFIED
Exploiter 2
1,175,464,712.875462 USDT, frozen
Binance 14 and 16
VERIFIED
Exploiter 2
823,000,000 USDC, frozen
Hot Wallet 34
VERIFIED
Exploiter 21
174,999,872.32762 USDT, frozen
Exploiter 2 via Exploiters 18 and 20
VERIFIED
Exploiter 3's loan on Aave
60,013,705.32 aUSDT as collateral; ETH loan open, health factor 1.0541
Exploiter 2 via Exploiter 10
VERIFIED
Exploiter 7
30,000,000 USDT, frozen
Exploiter 3 via Exploiters 4, 5 and 6
VERIFIED
Exploiter 16
40,541,065 RLUSD, frozen
Binance 14 and 16
VERIFIED
Binance 14
1,352,017.937959 USDT, frozen
Tether blacklisted Binance 14 itself
VERIFIED
Exploiter 14
29,934.01 wBETH, unmoved; freeze not read
Binance 14
VERIFIED
The ETH that travelled with the USDT chain did not go far. Exploiter 6 passed 57,891.8 ETH to Exploiter 7 at 21:16:47Z. Exploiter 7, its USDT already frozen, sent 57,891.77 ETH to Exploiter 11 at 21:35:59Z. Exploiter 15 added 17,584 ETH and 2,939.48 ETH later that night, the proceeds of UNI and ONDO taken from Binance 14 and Binance 16 and sold on Uniswap. Exploiter 11 had never sent a transaction as at our read of 31 October. ETH cannot be frozen by an issuer, so this is the balance most worth watching.
What Arkham shows · Exploiter 11
Arkham's visualiser, captured by CrYptOG on 30 Oct. Four transfers of a dollar or more, all inbound: 57.892K, 17.584K and 2.939K ETH from exploiter wallets, and 0.001 ETH of dust. Nothing out. LEAD Arkham shows its entity "Binance Hacker", not the address; the amounts match Exploiter 11's rows exactly, which is how the view is tied to it.
Image as filed: Screenshot 2250 · 30 Oct, sha256 fb561ba455e3f0ac99348a2bddce1922936271d3637cbddef1dab2c4cd38ab4d
The 60 million USDT that Exploiter 3 posted on Aave is still there, and the ETH borrowed against it is still owed. The loan's health factor was 1.0541 at the last read, and falling as the interest accrues: a rise of about five per cent in ETH would make it liquidatable. The health factor measures Exploiter 3's loan, not Aave itself.
Apart from dust, every ETH in Exploiter 17 and Exploiter 19 traces to Binance 14 or Binance 16. No other Binance wallet appears behind them.
Exploiter 19 had sent no transaction as at the read of 30 Oct. External ETH in totals 137,602.001711786765227511; everything except 122,310 ETH from Exploiter 18 and 15,292 ETH from Exploiter 14 is dust.
Exploiter 17: 26,825 from Exploiter 16, 7,647.1 from Exploiter 22 and 6,128.571798086559 from Exploiters 28, 48 and 52, total 40,600.671798086559. Its balance at 12:53Z was 40,600.67179908 ETH. Exploiter 50BINHACK-1029:CPTY:C2096a-2d850a:CG0xC2096a12eBE0944f4d39E59979F485AfD92d850a holds the 3,000 ETH from Exploiter 22.
Platform labels: every "Exploiter" name is Etherscan's (LEAD). Amounts from Etherscan exports are marked NOT re-derived per transaction on our node in the readings.
Exploiter 11BINHACK-1029:CPTY:897C80-158DF3:CG0x897C80d1a9729E94460e2Bd93178bD5215158DF3: 96 transactions listed by Etherscan, none outbound. Inbound of size: 57,891.77 ETH from Exploiter 7 (0x2552fea8…), 17,584 and 2,939.48 ETH from Exploiter 15. Balance 78,415.252703698617682159 ETH, nonce 0, at block 26309248 on our own node. Exploiter 6 to Exploiter 7: 0x3ccb1b3b…, block 26,301,030.
Exploiter 15BINHACK-1029:CPTY:42CDF0-077810:CG0x42CDF00c85005630CC8605731B9364F712077810 received 7,018,792.33 UNI and 21,851,870.65 ONDO from Exploiter 2. Exploiter 2 got exactly that UNI from Binance 14 and Binance 16, and that ONDO from Binance 14 (Etherscan exports). Exploiter 27BINHACK-1029:CPTY:79e70d-2B544A:CG0x79e70d139fC05AA75F75611fDF2680E9952B544A: 34,279.694892120000005257 ETH, nonce 0. Exploiter 51BINHACK-1029:CPTY:8d4b8E-1c9E19:CG0x8d4b8EE62124B7ee140A51dDd07390A56F1c9E19: 3,236.717477498895848193 ETH, nonce 0. Exploiter 3's position on Aave: aEthUSDT 60,013,168.353562, variableDebtEthWETH 19,763.650905473497848241, health factor 1.0559 at 23:51Z on 30 Oct. Exploiter 14: 29,934.013163146020067927 wBETH. First read on a public node; re-read on our own node at 00:46Z on 31 Oct, all matched, and the Aave health factor had fallen to 1.0541.
Sources: Reading 1330 · 30 Oct · eff71aee56c2Reading 1500 · 30 Oct · ad35f8e91794Reading 1540 · 30 Oct · 76b9826a4ce0Reading 1545 · 30 Oct · fef95a50669fReading 1612 · 30 Oct · 1bd805078f79Reading 2247 · 30 Oct · 5f82a2d235fcReading 2352 · 30 Oct · a47d4232b0ee
I
The address everyone published
Why the obvious lead went the wrong way
The public reports printed one Ethereum address for this theft. Following it leads down a side road: the one payment traced through it came from Bitcoin held before the theft. The trail that worked ran the other way, from the biggest holding wallets back to Binance 14. On the record checked, THORChain, the cross-chain swap service, was not an exit for the Ethereum money in the first 16 hours.
Watch out for copies. Fake tokens copy real amounts and point them at lookalike addresses. Always check the whole address.
Elliptic published one Ethereum address, as a meeting point for proceeds of this theft and of an earlier exploit at Bitget. It reported only about $39k of Binance funds there.
Hopping back from it led to the THORChain router, and from there to a Bitcoin address. The one swap traced, 71.45 ETH, came from Bitcoin received at 03:29Z on 29 Oct, more than 16 hours before the first sweep, so that swap is not Binance money. The other 14 THORChain inflows are not read. The route that worked ran the other way: from Etherscan's own label list, to the biggest holder, back to the collecting wallet, back to its oldest inflow, Binance 14.
Watch the copies, too. A lookalike of the wallet that received 259 ETH from that address shares its last six characters and showed fake "259 ETH" receives. Fake token contracts calling themselves ETH copy real amounts and point them at lookalikes. Always check the whole address.
We checked THORChain the other way round too. In the router's complete record from 29 Oct 19:00:23Z to 30 Oct 12:47:35Z, none of 56 exploiter-side wallets sent it anything. Its only contact with them is 15 payments out to the published address, 387.03923888 ETH, the Bitcoin branch above. On this record THORChain was not an exit for the Ethereum money in the first 16 hours.
The 259 ETH time from the chain is 02:03:23Z, block 26302458. Arkham's relative age had suggested about 03:00Z; that platform time is withdrawn.
Sources: Reading 1200 · 30 Oct · 51eb4b75a2e6Reading 1215 · 30 Oct · 8b267635a58bReading 1240 · 30 Oct · 803b75e90912Reading 1303 · 30 Oct · f9fe9d050bb2Reading 2320 · 30 Oct · 3e50125e343f
J
Check it yourself
Every wallet in this report, with its tag and full address
Each tag is built from the checksummed address: the scheme, the role, the first and last six characters, and CG. Role CPTY means counterparty: a wallet in the flow, with no claim about who runs it. Copy the full address, never the tag.
This report cannot show who used Binance 14's key, or whether the key was stolen or Binance's own systems were tricked into signing. It covers Ethereum only; the other chains are for later parts. It does not say who the attacker is. Switch to TECH for the full list of open points.
So here is the question the chain leaves open. The same key signed the attacker in and signed the attacker out. It cannot show whose hand was on it.
Troy opened its own gates. Who opened these is the question Part 1 hands on.
The open points, each tied to the reading that leaves it open.
Not established · the open points
Who signed the 50 authorisations, in the sense of who held or used Binance 14's key. The chain shows the key, not the hand.
Where the rest of Exploiter 10's ETH in its sale block came from: its balance rose 3,551.88 ETH there, of which 2,485.89 ETH came from the router.
Why Binance 14 holds 1,352,017.94 USDT, frozen.
Whether wBETH can be frozen, and whether Binance did. Elliptic reports that it did; Exploiter 14's wBETH had not moved as at our reads of 30 Oct.
What a liquidation or a withdrawal of Exploiter 3's collateral on Aave would do, given Tether's blacklist on Exploiter 3.
The rule that lets Binance 14 instruct Hot Wallet 34.
Where the wallets feeding Exploiters 27 and 51 got their ETH: Exploiters 12, 26, 45, 46, 47 and 49.
Whether THORChain carried any of the money after 30 Oct 12:47:35Z.
Every chain other than Ethereum: Bitcoin, TRON, XRP Ledger and the rest.
Attribution. Chainalysis assesses TraderTraitor; Elliptic says "likely". There was no government attribution as of these reports.
If you hold stablecoins on an exchange, this is the bit to remember. Two issuers froze close to 2 billion dollars of the stolen stablecoins within 40 min 36 s of the first sweep. The attacker's code sat on the exchange's own hot wallet for 3 h 49 min 36 s.
So here is the question the chain leaves open. The same key signed the attacker in and signed the attacker out. The chain shows the key. It cannot show whose hand was on it.
Troy opened its own gates. Who opened these is the question Part 1 hands on.
L
Sources
Every reading this page cites, with its SHA-256
Each reading is a dated file that names its own sources and says what they can and cannot establish. The full hash of each is below.
