USD 6.3 Billion Stolen from Binance: Attack Process and Analysis of Stolen Fund Flows

Written by: Beosin

On the evening of October 29, 2026 (around 4:00 a.m. Beijing Time on October 30), multiple hot wallets of Binance, the world's largest cryptocurrency exchange, experienced abnormally large outbound transfers. The incident involved multiple chains, including Ethereum, Bitcoin, and Tron. As of now, the estimated total outflow is approximately USD 6.3 billion, and the figure remains subject to change. Following the incident, Binance urgently suspended withdrawals across multiple networks and Binance Alpha trading, and stated that user funds were fully secure.

Beosin analyzed the attack process and the main flows of stolen funds in this major security incident. The results are as follows.

I. Full Timeline Review

Preparation phase: planning 36 hours in advance

October 28: The address used by the attacker to initiate the attack transaction was 0x7c8601d4645b93cea45f71e118a729332e6b5ca0. Its funds originated from Tornado Cash, with a small amount of ETH withdrawn in three transactions to cover gas fees.

Afternoon of October 29: A dedicated sweeper contract was deployed, and two rehearsals were completed using test wallets. The final rehearsal was only 3.5 hours before the actual attack; the attacker had prepared a transfer list covering 64 tokens.

Attack phase: obtaining EIP-7702 authorization

04:20: A transaction was submitted on-chain containing 50 EIP-7702 authorization signatures covering consecutive nonces; the authorizer was the Binance 14 hot wallet, and all signatures were generated using the wallet's own private key. The consecutive-nonce blind-targeting design ensured that, even if the wallet's nonce advanced rapidly, a valid authorization would always be matched.

https://etherscan.io/tx/0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b

04:24: Fund transfers began. In a single transaction, Binance14 transferred out 167,000 ETH (approximately USD 2.5 billion) + 1.615 billion USDT + over 60 types of tokens (including RLUSD, wBETH, UNI, ENA, PEPE, LINK, AAVE, etc.), leaving the wallet with only 1 ETH.

https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3

04:24:47: 24 seconds later, the Binance16 hot wallet signed directly with its own private key and transferred 28,000 ETH to the same receiving address.

04:41: Using Binance14's unrevoked delegation permissions, the attacker instructed the USDC contract wallet under its control to transfer out USD 823 million in USDC, followed by additional outflows of tens of millions of USD.

Within 12 minutes, more than 10 Binance hot wallets transferred funds to the same address across multiple chains, including Ethereum, Bitcoin, Tron, Arbitrum, Avalanche, Optimism, and Base.

II. Analysis of Stolen Fund Flows

Ethereum

The attacker's fund aggregation address on Ethereum was 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c, after which the attacker began dispersing the funds in batches. During the transfers, approximately 1.38 billion USDT and approximately 820 million USDC were frozen.

Stolen Ethereum ecosystem tokens such as UNI, ETHERFI, EIGEN, and PEPE were swapped by the attacker into ETH for further transfer. As of now, the funds have mainly settled at:

0x897c80d1a9729e94460e2bd93178bd5215158df3 (78,415.25 ETH)

0xc887af690e0301cd4edbbce8f8d31b4ec65b286a (137,602 ETH)

0x8532fa14acaf483729c449b8458aeddb900543d4 (197,460 ETH)

0x79e70d139fc05aa75f75611fdf2680e9952b544a (19,740 ETH)

Bitcoin

A theft of 18,270.2 BTC has occurred on the Bitcoin network. The attacker is dispersing the stolen BTC; funds are currently mainly distributed across multiple new addresses in 1,000 BTC chunks, with no further transfers:

bc1q0ts8gaf9ht0rr4u02hr56f8thndqsc4kmkmfv3

bc1qjwdw6vrzq4vf6hckutvx4ucj86awwv99mxnz7w

bc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968s

bc1qs3aej5tmcdz0vctz8y9rjcxtxg8v5385577s56

bc1qnq6jj9jmlf3945m3l8s0kxnqehrsga300k8t3s

bc1qdfhmlrdvg4tm87zjl0vyf0xflp5ql50q3g88gw

bc1q63qrfrpsg5hh0zzn3kp2xx9vljl7dq7tatsjxp

bc1qs6xnmhar38z44g2za93pv8ygdcwurrh8l87w3v

bc1qm8v88m5fy6kuq9myva2eemwycxqd3e0zcrs2l8

bc1q42flhayrzy3zh8lkyevw8qcjduurt9a35wlsyx

bc1qepc70u3u476vgvg3hfcwjgu4mecxe2uchs4lag

bc1qg3nrzpuvq2pxqx74tcrywr09dc208ze96n3t53

bc1qm2j6v3247khlwzxl7p9vqnfkghcllyhv9wjaat

Tron & Ripple

Approximately 380 million USDT on the Tron network have been successfully frozen. The 46,394,098 TRX stolen, after being dispersed to multiple addresses, is being continuously transferred by the attacker to new addresses.

The Ripple network suffered a theft of 233,461,943.1 XRP, which remain idle in the address rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx, with no further transfers.

As of publication, the incident remains under ongoing investigation; the root cause of the attack vulnerability, the identity of the hacker group, and the final total amount of assets lost have not been fully determined. Beosin will collaborate with industry stakeholders to continue tracking stolen funds dispersed across different public blockchains. Currently, all related addresses have been tagged by Beosin and are being continuously monitored. Beosin KYT and Trace will continue to monitor activity related to hacker addresses and track fund flows.

Source: TechFlow