October 30, 2026

The Binance hack of Oct 29: how up to $6.3B was drained, on-chain timeline

Binance puts the damage at about $6.3B, with about $3B frozen. According to the exchange, no keys leaked: the attacker got in through a compromised DevOps engineer's laptop and submitted withdrawals through an internal service. TRM Labs attributes the attack with high confidence to North Korea's TraderTraitor, the group the FBI blamed for the $1.5B Bybit hack in 2025. Times are UTC.

Preparation

• Oct 28–29: the attacker's wallet 0x7c86…5ca0 is funded with gas from Tornado Cash (three 0.1 ETH withdrawals).
• Oct 29, 02:28 and 15:59: it deploys two of its own contracts and, between 13:51 and 16:47, rehearses the scheme on its own wallets.

The attack: about 10 chains

• 20:05: first out are 233.5M XRP from five Binance wallets, then 970K SOL and 44M OP.
• 20:20: 18,270 BTC (~$1.47B), immediately split into 1,000 BTC chunks; on Tron, 612.7M USDT and 46.4M TRX.
• 20:20:59: Ethereum: a single EIP-7702 transaction with 50 signed authorizations makes the Binance 14 hot wallet run the attacker's code. EIP-7702 lets a regular address temporarily act as a smart contract. It only takes the owner's signature, not the key itself.
• 20:24: about 167K ETH and 63 tokens, including 1.6B USDT, leave Binance 14 for 0x5227…2f8c. 24 seconds later a second wallet, Binance 16, sends 28,005 ETH and 55.7M USDT to the same address in a regular signed transaction.
• 20:30–20:38: splitting: 500M and 200M USDT to two wallets, 197K ETH to a third.

The freeze race

• 21:01:35: Tether freezes the main address and the USDT wallets; Circle freezes 823M USDC at 21:04:59. That is 37 minutes after the first Ethereum withdrawal.
• 21:19: Binance: "actively investigating a potential security issue".
• 22:01–23:53: Ripple (RLUSD), World Liberty (USD1) and Paxos (PAXG) freeze their tokens; Tether and Circle blacklist Binance 14 itself. From 22:55 Binance moves what's left to its own wallet.
• 22:44: Aave: its contracts are unaffected, but as a precaution all V3 and V4 markets are frozen. New deposits and borrows are blocked, while withdrawals and repayments still work.
• Oct 30, 00:18: the Arbitrum Security Council takes 74.6M ARB and 8,426 ETH (~$30.5M) from the attacker's wallet 0x3E2b…32d5 without the owner's signature.
• 02:24: Binance names the cause: a DevOps engineer's laptop and access to a service container.

In total, per TRM, Tether froze about 1.77B USDT and Circle about 825M USDC.

How it's being laundered The attacker is racing to offload anything freezable. He sold 325M USDT to market makers via UniswapX for about 122K ETH, paying roughly 13% over market. He posted 60M USDT on Aave to borrow 19,760 ETH and supplied 300M USDT to JustLend on Tron. TRM estimates he holds over 420K ETH and 18,270 BTC (~$2.4B) that no issuer can freeze.

What it means for you

• Binance says it will cover losses from the SAFU fund and company funds. Take updates only from official channels: phishing "compensation" offers will follow the news.
• The attacker's money is still moving. Anyone who receives it down the chain, via P2P, OTC or an exchanger, risks a freeze: Tether reacted within 37 minutes.
• Address poisoners are already active around the attacker's wallets, sending lookalike addresses with the same first and last characters. Check the full address.

👉 Check an address: https://t.me/amlconsensus_bot?start=en