Did your wallet touch the Binance hacker’s funds?

If you use Binance

Binance co-founder Yi He wrote:

“User funds are safe. Binance will cover all hacking losses.”

Binance also asked users to “rely only on official Binance channels for updates.”

If you have ever withdrawn from Binance, your wallet may have received funds from Binance 14, the hot wallet the money was taken from. Those were ordinary withdrawals. Binance 14 is the victim here, and having been paid by it says nothing about you. Our freeze checker leaves it out of its “paid by a frozen address” check for exactly that reason.

Offers of compensation

Binance says it will cover the losses itself, so there is nothing to claim through anybody else. After a large theft, websites and direct messages appear offering refunds, airdrops or compensation to affected users, and they ask you to connect a wallet and sign something. That signature is how a wallet gets emptied. A refund sent to you needs nothing signed by you.

If a site does ask you to sign, paste the request into the signature checker before you approve it. It explains in plain words what the signature would let somebody do, and it needs no wallet connection.

What happened

Read from Ethereum by us, transaction by transaction. All times are UTC on 29 October 2026 unless marked.

1. 15:59 The operator address deployed a sweep contract. Transaction
2. 20:20 The operator sent an EIP-7702 transaction that delegated Binance 14 to that contract, which let the contract act as the wallet. Transaction
3. 20:24 One transaction moved 1,615,409,498.97 USDT, 167,464.25 ETH and 668.13 WETH from Binance 14 to the attacker’s main address, the aggregator. Transaction
4. 20:30 and 20:33 The aggregator sent 500,000,000 USDT and 200,000,000 USDT to two wallets, which passed all of it on by 20:59.
5. 20:38 The aggregator sent 195,460 ETH to a second attacker address. Transaction
6. 21:01 Tether froze the aggregator and both USDT wallets, and a minute later a wallet one of them had paid 190,000,000 USDT.
7. 22:06 Tether froze Binance 14.
8. 30 Oct, 05:15 The aggregator sent 17,260 ETH to another wallet. Transaction

On the cause, Binance has said the breach began with a DevOps engineer’s compromised laptop, and that it has no evidence a private key was leaked.

How much was taken, by whose count

We do not publish our own total. The theft reached more than one chain and this page reads Ethereum only, so these are other people’s figures, each credited to whoever gave it.

• Binance put the loss at around $6.3 billion.
• TRM Labs counted about $6.36 billion across ten chains, with about $2.7 billion of it frozen.
• ZachXBT reported that more than $2.83 billion is now frozen.
• Tether chief executive Paolo Ardoino wrote: “Tether froze more than 1.567B USDT related to a potential Binance exchange hack.”
• Circle chief executive Jeremy Allaire wrote: “we have frozen more than 800M USDC associated with the incident.”

All five as reported by CryptoTicker.

Where the money is now

Our own read of Ethereum at 19:20 UTC on 30 October 2026 (block 26,307,628).

• The aggregator holds 1,175,464,712.87 USDT and 823,000,000 USDC. Tether and Circle have both frozen it, so neither can move.
• The two wallets that received 700,000,000 USDT hold none of it now. Both passed it on before Tether froze them: 175,000,000 and 190,000,000 USDT to two further wallets, one of which Tether has since frozen, and the rest to contracts and trading pools. Where it went after that is beyond what this page traces.
• The second attacker address holds 197,460 ETH and the wallet paid at 05:15 holds 17,260.1 ETH. Neither has sent a transaction. ETH has no issuer, so nobody can freeze it.

You can check the freeze state of any of these yourself on the USDT freeze checker, which reads the issuers’ own contracts.

The addresses

Attacker addresses

Each is listed in Drain Watch with the transaction shown here as its evidence, so the wallet scanner flags it.

1. 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8cThe aggregator. Received the drained USDT, ETH and WETH from Binance 14. Evidence
2. 0x7c8601d4645b93cea45f71e118a729332e6b5ca0The operator. Signed the EIP-7702 delegation of Binance 14 to the sweep contract. Evidence
3. 0x63e842b054bd624a465454d533c33f573e9c6faeThe sweep contract Binance 14 was delegated to, deployed by the operator. Evidence
4. 0x8532fa14acaf483729c449b8458aeddb900543d4The second address. Received 195,460 ETH from the aggregator. Evidence

The victim

1. 0x28c6c06298d514db089934071355e5743bf21d60Binance 14, a Binance exchange hot wallet. The funds were taken from it, and Tether and Circle have frozen it since. It is not an attacker address and is not flagged as one.

Wallets the attacker paid directly

Every wallet that received anything of value directly from the attacker addresses, not counting trading pools, read at 19:20 UTC on 30 October 2026 (block 26,307,627). All of it came from the aggregator: the other three attacker addresses have paid nobody. Being on this list is a fact about where funds came from. It does not on its own show who controls the wallet.

1. 0x9749292d74fd460982d0912ea9515ea24736c762Tether froze this address at 21:01 UTC on 29 October, after it had passed the USDT on.
   • 0.5 ETH at 29 Oct 20:29 UTC (transaction)
   • 500,000,000 USDT at 29 Oct 20:30 UTC (transaction)
2. 0x0ddf0480016e6bcb2c1f5d190d221fba1320697eTether froze this address at 21:01 UTC on 29 October, after it had passed the USDT on.
   • 0.5 ETH at 29 Oct 20:31 UTC (transaction)
   • 200,000,000 USDT at 29 Oct 20:33 UTC (transaction)
3. 0x5c23023ca6633f91ded909b4a753a3ca00fea4fc
   • 88,541,065 RLUSD at 29 Oct 21:22 UTC (transaction)
4. 0x3e2bf1ac6bf0934bbba6456c341c2ecbced632d5
   • 0.5 ETH at 29 Oct 21:29 UTC (transaction)
5. 0x42cdf00c85005630cc8605731b9364f712077810
   • 7,018,792 UNI at 29 Oct 21:46 UTC (transaction)
   • 21,851,871 ONDO at 29 Oct 22:53 UTC (transaction)
   • 2 ETH at 29 Oct 23:01 UTC (transaction)
6. 0x600d6f00eadabdb514561ceeb43730a7103e8298
   • 7,772,977,017,416 PEPE at 29 Oct 21:49 UTC (transaction)
   • 0.5 ETH at 29 Oct 21:50 UTC (transaction)
7. 0x7f9dc988b46336ad536828fad50fa8fa1e5415e3
   • 29,934.01 WBETH at 29 Oct 21:52 UTC (transaction)
   • 217,497,348 ENA at 29 Oct 22:02 UTC (transaction)
8. 0x0e772ee615c7f93373c7519f2c36e780696477d3This address carries contract code: it is an EIP-7702 smart account.
   • 1 ETH at 29 Oct 21:54 UTC (transaction)
9. 0xcf4ca2bdf21bc3a467a00b6afe72b833982723e0
   • 0.51 ETH at 29 Oct 22:32 UTC (transaction)
   • 2,568,257 LINK at 29 Oct 22:34 UTC (transaction)
10. 0xe7024ab80143b1ef843efe6a58368696cb87958d
    • 127,952.74 AAVE at 29 Oct 22:37 UTC (transaction)
11. 0xb3ddec0ccc5c3ba733fcdf5a15f98c95ec5a5fdbCircle has frozen this address.
    • 0.52 ETH at 29 Oct 22:40 UTC (transaction)
    • 167.14 WBTC at 29 Oct 22:41 UTC (transaction)
    • 9,707,547 USDe at 29 Oct 22:56 UTC (transaction)
12. 0x8c7111e9a3270457b76f0bd137209089047a6aa4
    • 17,317,869 WLD at 29 Oct 23:21 UTC (transaction)
13. 0x06ea1ab3ecf570029eb1f94dbb9eac06bc79685f
    • 0.5 ETH at 29 Oct 23:26 UTC (transaction)
    • 714,911,344 FUN at 29 Oct 23:28 UTC (transaction)
14. 0x0084847bb9384d2fc5e8836e663689467e3e4c81
    • 0.5 ETH at 30 Oct 00:06 UTC (transaction)
    • 87,853,171 ZAMA at 30 Oct 00:08 UTC (transaction)
15. 0xb58bf76d209fa71f60013ce1933ca331177a4f08
    • 0.5 ETH at 30 Oct 00:19 UTC (transaction)
    • 3,382,160,847 RSR at 30 Oct 00:32 UTC (transaction)
16. 0xf1eadb247ffc7d7d6600e84daaf9ee85737e73c4
    • 0.5 ETH at 30 Oct 00:27 UTC (transaction)
    • 3,601,631 ZRO at 30 Oct 00:30 UTC (transaction)
17. 0xdd6dbbe67262ccc9b1824de1257999efc6c52296
    • 0.5 ETH at 30 Oct 00:37 UTC (transaction)
    • 911,984.82 PROM at 30 Oct 00:40 UTC (transaction)
18. 0x1291be4c90239d14527ba880ad2b6e5cb82116b1
    • 0.5 ETH at 30 Oct 00:42 UTC (transaction)
    • 1,763,060 MORPHO at 30 Oct 00:43 UTC (transaction)
19. 0x03b0ee5d82990cff1bda48651ac3e436d1a020eaStill holds the 17,260 ETH and has sent no transaction.
    • 0.1 ETH at 30 Oct 05:14 UTC (transaction)
    • 17,260 ETH at 30 Oct 05:15 UTC (transaction)

What this page does not cover

• Ethereum only. TRM Labs counts ten chains. This page reads Ethereum, where Binance 14 sits.
• One hop. Several of these wallets passed funds on, and we do not list where it went next. The live freeze read in the checker above does reach one step further for USDT: it says whether your address received USDT directly from any address Tether has frozen, and Tether has frozen some of the next wallets too.
• Trading pools. The aggregator swapped through trading pools. A pool holds everybody’s funds together, so trading on one is not receiving the attacker’s funds, and we do not trace through them.
• ETH moved inside contract calls. The explorer we read returned an error partway through that one listing, so a transfer made that way could be missing. Every other listing was read to the end.
• Lookalike addresses. Address poisoners sent zero-value transfers and fake copies of tokens to addresses that start and end like the ones above, so those lookalikes appear in explorer histories. They received nothing of value and are not listed. Never copy an address from your transaction history: poisoning works by putting a lookalike there.

Everything on this page is a snapshot from the date at the top. The funds can move after it, so the wallet list does not change on its own. The freeze line in the checker is read live.

More free tools