What's happening
- Binance hot wallets on three blockchains were drained in under five minutes on October 29: Bitcoin at 3:20 PM CDT, Tron at 3:22, and Ethereum at 3:24.
- About $5.8 billion is gone: $3.7 billion on Ethereum, $1.44 billion in Bitcoin (18,270 BTC), and $629 million on Tron.
- $2.7 billion of it is frozen, by our count: 1.76 billion USDT by Tether, 823 million USDC by Circle, and smaller amounts by Ripple, World Liberty, and Paxos. Binance puts its verified figure at $2.54 billion.
- About $2.1 billion is out of reach. 322,932 ETH and 18,270 BTC sit in attacker addresses, and neither has an issuer that can freeze it.
- The hijacked wallet is back in Binance's hands. At 7:10 PM, Binance cleared the attacker's code from Binance 14, after five sweeps. The attacker is still moving and selling what it took.
- Binance paused withdrawals at 5:33 PM and says user funds remain safe. Co-founder Changpeng Zhao: "It does look like a hack on Binance."
Latest updates
- LatestBinance clears the attacker's code from Binance 14
Binance 14 sent its own set-code transaction, signed with its key and pointing the wallet at the zero address. That removes the attacker's contract, so
sweepno longer works on it. The wallet is an ordinary account again, 3 hours and 50 minutes after the takeover. - The Tron TRX moves on
TG5iBM…wvzsGi, whose USDT Tether froze at 4:09 PM, sent its 46.4 million TRX to a new address,TRBdWq…cA2PRki. Tether's freeze covers only USDT. - A fifth sweep of Binance 14
After five empty calls from 6:36 PM on, the attacker's sweep took 2,961.91 ETH that had reached Binance 14 and sent it to
0xA97b…8d10. - Circle freezes Binance's own wallets
Circle blacklisted Binance 14 (52,363 USDC inside) and the Binance USDC account the attacker drained earlier (2.96 million USDC), plus
0xc39e…9824, holding 1.56 million USDC. - Binance: $2.54 billion frozen
"For clarity, the current verified total frozen is $2.54 billion. This figure may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets." (X) Our own count is $2.66 billion; see the numbers.
- Binance empties Binance 14 into its own wallet
In 45 ordinary transfers signed with Binance 14's key, the wallet sent its remaining tokens to Binance 8 (
0xF977…1aceC). This looks like Binance moving what's left out of the attacker's reach. - Binance Alpha trading suspended
Binance said Alpha trading "has been temporarily suspended" and "will resume once the security issue is resolved." (X)
- More tokens scatter
0x5227…2f8csent ONDO, USDe, SNX, WLD, SAND, FUN, and ZAMA to new addresses. The wallets holding the earlier batches are selling on decentralized exchanges. - A fourth sweep, to a new address
The attacker swept Binance 14 again at 5:39 PM, this time sending to a new address,
0xA97b…8d10, instead of the frozen0x5227…2f8c. It took 122 smaller tokens worth about $48 million, plus 128.49 ETH, and left Binance 14 with 1 ETH. Around it,0x5227…2f8csent 2.57 million LINK, 128,000 AAVE, and 167 WBTC to three new addresses, which are selling them on decentralized exchanges. The total is now about $5.8 billion. - Binance pauses withdrawals
"Our team is conducting security checks. Withdrawals will resume as soon as the security issue is fully resolved. User funds remain safe." (X)
- Bitcoin and Tron were hit too, taking the total to $5.7 billion
Reports of up to $5.5 billion check out on-chain. In the same minutes as the Ethereum drain, Binance's Bitcoin hot wallet sent 18,270.2 BTC to a new address, and a Binance Tron wallet sent 612.7 million USDT and 46.4 million TRX to another. Tether has frozen 378.7 million of the Tron USDT. The Bitcoin can't be frozen.
- Tether freezes Binance 14 itself
Tether blacklisted Binance 14, Binance's own Ethereum hot wallet, freezing the 1,351,530 USDT in it. The wallet still runs the attacker's code, so this stops any more USDT from being swept out of it.
- Ripple, World Liberty, and Paxos freeze too
Ripple paused RLUSD in
0xE702…958d, which holds 40.5 million RLUSD, and in Binance 14. World Liberty froze the 27.8 million USD1 in0x5227…2f8c, and Paxos froze the 1,906.67 PAXG there. - The attacker starts cashing out tokens nobody froze
0x5227…2f8csent out 29,934 wBETH (Binance's own wrapped staked ETH), 7.77 trillion PEPE, 7.02 million UNI, and 217.5 million ENA. The PEPE and UNI are being sold for ETH on Uniswap. - 122,310 ETH moves to a new address
The swap wallet
0x9749…C762gathered the ETH it bought with stolen USDT and sent 122,310 ETH to0xc887…286A. - Third sweep of Binance 14
The attacker took 200.4 million USDT and 369.83 ETH that had arrived since the last sweep. The USDT landed in an address Tether had already frozen.
- Binance: "User funds are completely safe"
"Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe." (X)
- BEAM's admin burns the attacker's BEAM
A multisig with admin rights on the BEAM token burned the 984,249,380 BEAM in the attacker's wallet.
- Zhao: "It does look like a hack on Binance"
"User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (
$971m) and Circle ($823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." (X) - Tether freezes 378.7 million USDT on Tron
Tether blacklisted the first Tron address, still holding 312.7 million USDT, then two more it had fed. About 234 million had already moved on.
- Circle freezes 823 million USDC, and a second sweep
Circle blacklisted
0x5227…2f8c, freezing all 823 million USDC. Seconds earlier, the attacker swept Binance 14 again: 1,699.92 ETH and 3.9 million USDT. - Tether starts freezing
Tether blacklisted the attacker's first Ethereum address while it held 971.15 million USDT. By 4:18 PM it had blacklisted eight attacker addresses on Ethereum.
- 823 million USDC pulled from Binance
The attacker's code had Binance 14 move USDC out of a smart-contract account it controls: 780 million, then 43 million at 3:59 PM.
- First public alarm
On-chain researcher Spreek on X: "Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash."
- Binance 14 is drained
One transaction sends 167,464 ETH and 63 tokens, including 1.6 billion USDT, to a brand-new address. Twenty-four seconds later, Binance 16 sends 28,005.6 ETH and eight tokens to the same place.
- Tron: 612.7 million USDT leaves a Binance wallet
A Binance Tron wallet sends 612,729,468 USDT to a new address. The same wallet had opened that address with 10,000 TRX at 3:20 PM and sent it 46.4 million TRX at 3:21.
- The attacker takes over Binance 14
A set-code transaction signed with Binance 14's own key points the wallet at the attacker's contract. See how it happened.
- Bitcoin: 18,270 BTC leaves Binance's hot wallet
Binance's Bitcoin hot wallet sends 18,270.2 BTC to a new address, which peels it off to fresh addresses, 1,000 BTC at a time, in the same block. It's the first large transfer of the attack, 53 seconds before the Ethereum takeover.
We add an entry each time something changes on-chain or someone involved says something new.
The numbers
As of 7:20 PM CDT. These come from our own reads of the Ethereum, Bitcoin, and Tron chains, with CoinGecko prices: what was taken is valued near the time it left, and what's out of reach at 7:20 PM prices. Blockaid also reports outflows on Arbitrum and Avalanche, which we haven't verified.
- Ethereum$3.7B64%
- Bitcoin$1.44B25%
- Tron$629M11%
1.76 billion USDT by Tether, 823 million USDC by Circle, and RLUSD, USD1, and PAXG. Binance's verified figure: $2.54 billion.
322,932 ETH and 18,270 BTC, which no issuer can freeze
Binance removed the attacker's code at 7:10 PM, after moving what was left to its own wallet.
What was stolen
- On Ethereum, about $3.7 billion, from Binance 14, Binance 16, and a USDC account Binance 14 controls:
- 200,630 ETH: 172,624 from Binance 14 over five sweeps, and 28,005.6 from Binance 16
- 1,875,464,711 USDT
- 823,000,000 USDC
- 88.5 million RLUSD, 27.8 million USD1, 9.7 million USDe, and 3.5 million FDUSD
- 29,934 wBETH and 167 WBTC
- More than 150 other tokens, including 984 million BEAM, 217.5 million ENA, 7.02 million UNI, and 7.77 trillion PEPE, plus 122 smaller ones worth about $48 million in the 5:39 PM sweep
- On Bitcoin, about $1.44 billion: 18,270.2 BTC from Binance's hot wallet
bc1qm34l…j77s3h - On Tron, about $629 million: 612,729,468 USDT and 46,394,098 TRX from the wallet
TDqSqu…dkhSCf
What's frozen
- 1,759,184,051 USDT, by Tether:
- On Ethereum, 1,380,464,583 in three of the eight addresses Tether blacklisted between 4:01 and 4:18 PM: 1,175,464,711 in
0x5227…2f8c, 174,999,872 in0xAa24…54a0, and 30,000,000 in0xb171…c8c3 - On Tron, 378,719,468 in two of the three addresses Tether blacklisted between 4:09 and 4:21 PM: 312,729,468 in
TG5iBM…wvzsGiand 65,990,000 inTCzBTk…Ad7Y62
- On Ethereum, 1,380,464,583 in three of the eight addresses Tether blacklisted between 4:01 and 4:18 PM: 1,175,464,711 in
- 823,000,000 USDC, by Circle, all in
0x5227…2f8c, blacklisted at 4:04 PM - 40,541,065 RLUSD, by Ripple, paused in
0xE702…958dat 5:00 PM. Binance co-founder Yi He said Ripple froze about $200 million, per CoinDesk. On Ethereum, this is the RLUSD we can see. - 27,824,040 USD1, by World Liberty Financial, frozen in
0x5227…2f8cat 5:10 PM - 1,906.67 PAXG, by Paxos, about $7.7 million, frozen in
0x5227…2f8cat 5:30 PM - 984,249,380 BEAM, burned by the BEAM token's admin
- Binance's own wallets. Tether, Ripple, World Liberty, and Circle have each blocked Binance 14, and Circle also blocked the Binance USDC account the attacker drained. The 1.35 million USDT and 3 million USDC inside are Binance's money, so they aren't part of the $2.7 billion.
- 1,563,813 USDC in
0xc39e…9824, which Circle blacklisted at 6:31 PM. We haven't traced its link to the attack, so it isn't counted either.
By our count, $2.66 billion of what the attacker took is frozen. Binance's own figure, posted at 6:22 PM, is $2.54 billion "verified," and it says that number may grow.
Zhao's figures, about $971 million for Tether and $823 million for Circle, match what the attacker's first Ethereum address held when each issuer froze it. Tether CEO Paolo Ardoino later said Tether had frozen "more than 1.567 billion USDT," and the count has kept rising with the Tron freezes and later sweeps. Some early reports put Circle's freeze at $873 million; the chain shows exactly 823,000,000 USDC.
A freeze stops the tokens from moving, but it doesn't return them. Getting them back to Binance is a separate step, and each issuer decides it.
What isn't frozen
- 18,270.2 BTC, about $1.41 billion, peeled off to new addresses 1,000 BTC at a time. Bitcoin has no issuer that can freeze it.
- 322,932 ETH, about $719 million:
- 195,460 in
0x8532…43D4, untouched since 3:38 PM - 122,310 in
0xc887…286A - 3,090 in
0xA97b…8d10, from the 5:39 PM and 6:56 PM sweeps - 2,072 in
0x5227…2f8c
- 195,460 in
- About 495 million USDT on Ethereum, swapped through Uniswap and other routes before Tether's freezes landed, much of it for ETH
- About 234 million USDT on Tron, which left
TPBkSj…76bKN4in 2–30 million pieces before Tether froze it - 46.4 million TRX, about $16.5 million, which left
TG5iBM…wvzsGiforTRBdWq…cA2PRkiat 7:06 PM. Tether's freeze covers only USDT. - About 48 million RLUSD, sold or moved before Ripple paused the wallet holding the rest
- 122 smaller tokens worth about $48 million, sitting in
0xA97b…8d10since the 5:39 PM sweep - wBETH, ENA, PEPE, UNI, LINK, AAVE, WBTC, USDe, ONDO, SNX, WLD, SAND, FUN, and ZAMA, sent on between 4:46 and 7:08 PM and being sold on decentralized exchanges
- 3.5 million FDUSD, still sitting in
0x5227…2f8c
How it happened
In plain English
- Since Ethereum's Pectra upgrade in May 2025, an ordinary key-controlled account can borrow a smart contract's code. The feature is EIP-7702: the account's key signs a short "authorization" naming a contract, and from then on the account runs that contract's code.
- The attacker had an authorization signed with Binance 14's own key, naming a contract the attacker had written. How they got it isn't known.
- That contract has a
sweepfunction. Calling it makes Binance 14 send everything it holds to an address the attacker picks, and the attacker could call it as often as they liked without another signature, until Binance cleared it at 7:10 PM.
Binance 16 was never delegated. Its key simply signed ordinary transfers to the attacker. Bitcoin and Tron have nothing like EIP-7702, and there, too, Binance's own wallets signed ordinary transfers to brand-new addresses, within the same five minutes.
Our reading: the attacker could get Binance's keys on three blockchains to sign data of their choosing, on demand. That points at Binance's keys or the system that signs with them, not at a smart-contract bug. Binance hasn't said how the attacker got in.
What the chain shows
- The takeover, 3:20 PM. The attacker's address
0x7C86…5CA0sent a type-4 (set-code) transaction carrying 50 authorizations, all signed by Binance 14's key, for nonces 18,914,775 through 18,914,824. An authorization only counts if its nonce matches the account's at that moment. Binance 14 transacts constantly, so the spread made sure one landed: nonce 18,914,809. - The new code. Binance 14's code went from empty to
0xef0100followed by63e842…9c6fae, EIP-7702's marker for "delegated to0x63e8…6fAe." The attacker deployed that contract at 10:59 AM, and its source isn't verified on Blockscout. - The sweep, 3:24 PM. The attacker called
sweepon Binance 14 with the destination0x5227…2f8cand a list of 64 token contracts plus the zero address. Out went 167,464.25 ETH and 63 tokens, including 1,615,409,499 USDT. - The USDC account. Binance 14 controls a USDC smart-contract account (
SingleOwnerMSCA). A second function on the attacker's contract had Binance 14, as its controller, move 823 million USDC out of it. - Binance 16. At 3:24:47 PM, in a single block, it sent 28,005.6 ETH and eight tokens to the attacker, each in an ordinary transaction signed with its own key.
- Bitcoin, 3:20 PM. Binance's hot wallet
bc1qm34l…j77s3h, which Whale Alert labels as Binance, sent 18,270.2 BTC in 11 outputs tobc1q0mtc…hl2mnm, a brand-new address. That address spent all of it in the same block. - Tron, 3:20–3:22 PM. The wallet
TDqSqu…dkhSCffunded a new address,TG5iBM…wvzsGi, with 10,000 TRX, then sent it 46,384,098 TRX and 612,729,468 USDT. We couldn't pull an explorer label for this wallet. Its traffic looks like an exchange hot wallet's, and its outflow matches the $630 million that Decrypt's tally attributes to Binance on Tron. - Repeat sweeps. The delegation stayed in place for almost four hours, so the attacker came back at 4:04 PM (1,699.92 ETH and 3.9 million USDT), at 4:44 PM (369.83 ETH and 200.4 million USDT), and at 5:39 PM (122 smaller tokens and 128.49 ETH, sent to a new address), and at 6:56 PM (2,961.91 ETH).
- The fix, 7:10 PM. Binance 14 signed a new authorization naming the zero address, at nonce 18,914,904. That reset its code to empty and ended the sweeps.
Before the attack
- Oct 28, 2:39 AM – Oct 29, 3:23 AM: three Tornado Cash withdrawals of about 0.098 ETH each fund
0x7C86…5CA0 - Oct 28, 9:28 PM: it deploys a first contract,
0x19be…f2bf - Oct 29, 8:51–9:24 AM: it tries delegation and
sweepon two fresh wallets - 10:59 AM: it deploys the contract used on Binance 14
- 11:20–11:47 AM: it tries that contract on a third fresh wallet
Where the money went
Every address below links to its block explorer, and the copy button copies the full address.
On Ethereum
- 3:24 PM: Binance 14 (0x28C6…1d60(view on Etherscan)) and Binance 16 (0xDFd5…963d(view on Etherscan)) send everything to 0x5227…2f8c(view on Etherscan), a new address.
- 3:29–3:33 PM: 0x5227…2f8c(view on Etherscan) gives two new addresses, 0x9749…C762(view on Etherscan) and 0x0Ddf…697e(view on Etherscan), 0.5 ETH each for gas, then sends them 500 million and 200 million USDT.
- 3:34–3:59 PM: those two swap USDT through Uniswap and other routes, and pass 175 million and 190 million USDT on to 0x811f…e84C(view on Etherscan) and 0x8d53…639A(view on Etherscan).
- 3:38 PM: 0x5227…2f8c(view on Etherscan) sends 195,460 ETH to 0x8532…43D4(view on Etherscan), which hasn't moved it since.
- 3:41 and 3:59 PM: 823 million USDC arrives at 0x5227…2f8c(view on Etherscan) from Binance 14's USDC account.
- 4:22–4:25 PM: 88.5 million RLUSD leaves through 0x5C23…a4FC(view on Etherscan) and keeps moving. Ripple has since paused the 40.5 million still in 0xE702…958d(view on Etherscan).
- 4:46–5:02 PM: wBETH and ENA go to 0x7f9D…15E3(view on Etherscan), PEPE to 0x600d…8298(view on Etherscan), and UNI to 0x42CD…7810(view on Etherscan).
- 4:47 PM: the swap wallet 0x9749…C762(view on Etherscan) sends 122,310 ETH to 0xc887…286A(view on Etherscan).
- 5:34–5:41 PM: LINK goes to 0xCF4c…23E0(view on Etherscan), AAVE to 0xE702…958d(view on Etherscan), and WBTC to 0xB3dd…5FdB(view on Etherscan), and all three are being sold on decentralized exchanges.
- 5:39 PM: the fourth sweep sends 122 tokens and 128.49 ETH from Binance 14 to 0xA97b…8d10(view on Etherscan).
- 5:53–7:08 PM: ONDO, USDe, SNX, WLD, SAND, FUN, and ZAMA leave 0x5227…2f8c(view on Etherscan) for more new addresses.
- 6:07–7:07 PM: Binance 14 sends its remaining tokens to Binance 8 (0xF977…aceC(view on Etherscan)) in 45 transfers signed with its own key, which looks like Binance moving them to safety.
- 6:56 PM: a fifth sweep sends 2,961.91 ETH from Binance 14 to 0xA97b…8d10(view on Etherscan).
Address-poisoning spam started within minutes: lookalike addresses sharing the swap wallet's first and last characters sent dust and fake "USDT" to the attacker's wallets.
On Bitcoin
- 3:20 PM: 18,270.2 BTC leaves Binance's hot wallet bc1qm34l…j77s3h(view on mempool.space) for bc1q0mtc…hl2mnm(view on mempool.space).
- Same block: that address sends it on to fresh addresses, 1,000 BTC at a time.
- 3:48 PM: the last 437.7 BTC moves to bc1qxg0l…y7s9ra(view on mempool.space).
On Tron
- 3:20–3:22 PM: TDqSqu…dkhSCf(view on Tronscan) sends 46.4 million TRX and 612.7 million USDT to TG5iBM…wvzsGi(view on Tronscan).
- 3:45 and 3:56 PM: TG5iBM…wvzsGi(view on Tronscan) passes 100 million and then 200 million USDT to TPBkSj…76bKN4(view on Tronscan).
- 3:47–4:16 PM: TPBkSj…76bKN4(view on Tronscan) sends about 234 million on in 2–30 million pieces, mostly to TSUUVj…QDvZpx(view on Tronscan), and 65.99 million to TCzBTk…Ad7Y62(view on Tronscan).
- 4:09–4:21 PM: Tether freezes TG5iBM…wvzsGi(view on Tronscan), TPBkSj…76bKN4(view on Tronscan), and TCzBTk…Ad7Y62(view on Tronscan).
- 7:06 PM: TG5iBM…wvzsGi(view on Tronscan) sends its 46.4 million TRX to TRBdWq…A2PRki(view on Tronscan).
Addresses to watch
Who's said what
- Binance, on X:
- 4:29 PM: "Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe."
- 5:33 PM: "Our team is conducting security checks. Withdrawals will resume as soon as the security issue is fully resolved. User funds remain safe."
- 6:06 PM: Binance Alpha trading "has been temporarily suspended" and "will resume once the security issue is resolved."
- 6:22 PM: "the current verified total frozen is $2.54 billion. This figure may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets."
- Earlier, a spokesperson told Cointelegraph it hadn't confirmed any impact on user funds.
- Changpeng Zhao, co-founder, at 4:15 PM: "It does look like a hack on Binance," and "as a shareholder, I expect all user funds will be fully covered." He notes he doesn't manage Binance anymore.
- Tether: CEO Paolo Ardoino said Tether had frozen "more than 1.567 billion USDT," per The Block: "Protecting the industry and our partners is our main priority."
- Circle: CEO Jeremy Allaire said Circle, "in coordination with law enforcement," froze "more than 800M USDC associated with the incident," per Decrypt.
- Ripple and World Liberty: Binance co-founder Yi He said Ripple froze about $200 million, and World Liberty co-founder Zach Witkoff confirmed about $27 million in USD1 frozen, per CoinDesk.
- Spreek, the researcher who flagged it first, at 3:32 PM: "possibly massive binance hack."
- Other estimates: Decrypt's on-chain tally puts the total at $5.57 billion; Coinbase's Conor Grogan says up to $5.8 billion, and Blockaid is investigating about $3.3 billion, per The Block. Our $5.8 billion uses live prices for the same three chains and includes every sweep through 6:56 PM.
- Attribution: nobody has publicly named who did it.
Markets
- BNB fell as much as 9% on Thursday, per Crypto Briefing. CoinGecko had it down 9.0% over 24 hours, at $690.72, as of 7:20 PM CDT.
- Coinglass data cited by Blockchain Reporter showed $627.7 million in liquidations in one hour.
- By value moved, this is nearly four times the roughly $1.5 billion stolen from Bybit in February 2025, which the FBI attributed to North Korea.
What to do
If you have funds on Binance
- Withdrawals are paused. Binance said at 5:33 PM that they "will resume as soon as the security issue is fully resolved." Binance Alpha trading has been suspended since 6:06 PM.
- Binance says user funds remain safe, and Zhao expects them to "be fully covered." Binance hasn't said how it will cover the loss.
- Ignore unofficial links, messages, and requests for account information. Incidents like this bring a wave of fake "compensation," "verification," and "withdrawal unlock" scams.
- Watch Binance's official channels for when withdrawals resume.
If you run hot wallets
1. Check whether an account has been delegated. An account with no code returns 0x. A delegated one returns 0xef0100 followed by the 20-byte address of the contract it now runs:
1curl -s https://ethereum-rpc.publicnode.com \2 -H 'content-type: application/json' \3 -d '{"jsonrpc":"2.0","id":1,"method":"eth_getCode",4 "params":["0xYOUR_HOT_WALLET","latest"]}'Until 7:10 PM, Binance 14 returned 0xef0100 followed by the address of the attacker's contract, 0x63e8…6fAe. It now returns 0x. Run it against every hot wallet, and alert on anything but 0x unless you delegated the account yourself.
2. Alert on authorizations that name your accounts. Flag any type-4 transaction whose authorization list names one of your addresses as the signer, even when the authorization fails. In this attack, 49 of the 50 failed and one succeeded, all in the same transaction.
3. Don't let hot-wallet signers sign blind hashes. An EIP-7702 authorization is a signature over keccak256(0x05 || rlp([chain_id, address, nonce])), not over a transaction. A signer that only accepts complete, parsed transactions can't be talked into producing one.
- If your HSM, MPC, or custody policy engine supports it, add a rule that rejects EIP-7702 authorizations for hot-wallet keys.
- If the raw key itself is exposed, no policy helps. Move the funds and retire the address.
4. Clear a delegation once the key is safe. Sign a new authorization from the affected key that names the zero address, and submit it in a type-4 transaction. That resets the account's code to empty. Binance's own fix at 7:10 PM is a worked example. Do it only after the key or signer is secured, or the attacker can delegate the account again.
Get help
If you run hot wallets or a signing service and want a second look at how your keys, signers, and approval policies fit together, our advisors can help.
Signing services and wallet back ends usually sit behind something on the public internet. Our free external audit checks the domains and public IPs you verify for exposed services, publicly visible software versions with known CVEs, TLS, email security, DNS, and HTTP headers.
Sources
- Attack transactions (Etherscan): delegation · first sweep · Binance 16's ETH transfer · USDC pulls of 780 million and 43 million · second sweep · third sweep · fourth sweep · Binance clearing the delegation · 195,460 ETH transfer · 122,310 ETH transfer
- Binance on X: 4:29 PM · 5:33 PM · 6:06 PM · 6:22 PM
- Freezes (Etherscan): Tether's first blacklisting · Tether's blacklisting of Binance 14 · Circle's blacklisting · BEAM burn
- Bitcoin (mempool.space): Binance's hot wallet · the receiving address
- Tron (Tronscan): 612.7 million USDT drain · 46.4 million TRX transfer · Tether's blacklistings of
TG5iBM…wvzsGi,TPBkSj…76bKN4, andTCzBTk…Ad7Y62 - Specification: EIP-7702: Set Code for EOAs
- Statements: Changpeng Zhao · Spreek · Binance, via Cointelegraph
- Reporting: CoinDesk live coverage · Decrypt · The Block · Crypto Briefing on Tether's freeze · Crypto Briefing on BNB · Blockchain Reporter · FXStreet
- Context: FBI on the Bybit theft
The Atlas security byline: write-ups of vulnerabilities in widely deployed software — what changed, who is exposed, and what to check — verified against primary sources.