$6.3 Billion Stolen from Binance: Attack Flow and Analysis of Stolen Fund Flows

Author: Beosin

On the evening of October 29, 2026 (around 4 AM Beijing time on the 30th), multiple hot wallets of Binance, the world's largest cryptocurrency exchange, experienced abnormal large-scale outflows. The incident involves multiple chains including Ethereum, Bitcoin, and Tron. As of now, the estimated total outflow is approximately $6.3 billion, and the figure continues to change. Following the incident, Binance urgently suspended withdrawals across multiple networks and Binance Alpha trading, stating that user funds are completely safe.

Beosin has analyzed the attack flow and the main destination of the stolen funds from this major security incident, with the results as follows.

I. Complete Timeline Review

Preparation Phase: Setup 36 Hours in Advance

October 28: The attacker initiated the attack transaction from address 0x7c8601d4645b93cea45f71e118a729332e6b5ca0. Its funds originated from Tornado Cash, with small amounts of ETH withdrawn in three batches to serve as gas fees.

Afternoon of October 29: A dedicated sweeper contract was deployed, and two rehearsals were completed using test wallets. The last rehearsal occurred just 3.5 hours before the actual attack; the attacker had pre-prepared a transfer list covering 64 different tokens.

Attack Phase: Obtaining EIP-7702 Authorization

04:20: A transaction carrying 50 signed EIP-7702 authorizations covering consecutive nonces went on-chain. The authorizer was precisely Binance's Hot Wallet 14, and all signatures were completed using its own private key. The design of blindly firing consecutive nonces ensures that even if the wallet's nonce drifts rapidly, it will always hit one valid authorization.

https://etherscan.io/tx/0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b

04:24: Fund transfers began. Binance14 single-handedly transferred out 167,000 ETH (approximately $2.5 billion) + 1.615 billion USDT + over 60 types of tokens (including RLUSD, wBETH, UNI, ENA, PEPE, LINK, AAVE, etc.), leaving the wallet with only 1 ETH remaining.

https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3

04:24:47: Just 24 seconds later, the Binance16 hot wallet directly used its own private key to sign and transfer 28,000 ETH to the same receiving address.

04:41: Leveraging the pending revocation delegated permissions of Binance14, the attacker instructed its controlled USDC contract wallet to transfer out $823 million in USDC, followed by tens of millions more flowing out subsequently.

Within 12 minutes, over 10 Binance hot wallets across multiple chains including Ethereum, Bitcoin, Tron, Arbitrum, Avalanche, Optimism, and Base transferred funds to the same address.

II. Analysis of Stolen Fund Flows

Ethereum

The attacker's fund aggregation address on Ethereum is 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c. Subsequently, the attacker began transferring the funds in batches to dispersed addresses. During the transfer process, approximately 1.38 billion USDT was frozen, and approximately 820 million USDC was frozen.

Stolen Ethereum ecosystem tokens such as UNI, ETHERFI, EIGEN, and PEPE were exchanged for ETH by the attacker for further transfer. Currently, the funds are primarily concentrated at:

0x897c80d1a9729e94460e2bd93178bd5215158df3 （78,415.25 ETH）

0xc887af690e0301cd4edbbce8f8d31b4ec65b286a（137,602 ETH）

0x8532fa14acaf483729c449b8458aeddb900543d4（197,460 ETH）

0x79e70d139fc05aa75f75611fdf2680e9952b544a（19,740 ETH）

Bitcoin

18,270.2 BTC were stolen from the Bitcoin network. The attacker is dispersing the stolen BTC, which currently remains distributed across multiple new addresses in batches of roughly 1,000 BTC each, with no further movement:

bc1q0ts8gaf9ht0rr4u02hr56f8thndqsc4kmkmfv3

bc1qjwdw6vrzq4vf6hckutvx4ucj86awwv99mxnz7w

bc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968s

bc1qs3aej5tmcdz0vctz8y9rjcxtxg8v5385577s56

bc1qnq6jj9jmlf3945m3l8s0kxnqehrsga300k8t3s

bc1qdfhmlrdvg4tm87zjl0vyf0xflp5ql50q3g88gw

bc1q63qrfrpsg5hh0zzn3kp2xx9vljl7dq7tatsjxp

bc1qs6xnmhar38z44g2za93pv8ygdcwurrh8l87w3v

bc1qm8v88m5fy6kuq9myva2eemwycxqd3e0zcrs2l8

bc1q42flhayrzy3zh8lkyevw8qcjduurt9a35wlsyx

bc1qepc70u3u476vgvg3hfcwjgu4mecxe2uchs4lag

bc1qg3nrzpuvq2pxqx74tcrywr09dc208ze96n3t53

bc1qm2j6v3247khlwzxl7p9vqnfkghcllyhv9wjaat

Tron & Ripple

Approximately 380 million USDT was successfully frozen on the Tron network. The stolen 46,394,098 TRX, after being dispersed to multiple addresses, is being continuously transferred by the attacker to new addresses.

233,461,943.1 XRP was stolen from the Ripple network and remains stagnant at address rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx, with no further transfers.

As of publication, the incident remains under continuous investigation, and the root cause of the attack vulnerability, the identity of the hacker group, and the total amount of lost assets have not been fully concluded. Beosin will collaborate with industry stakeholders to continuously track the stolen funds dispersed across various public chains. Currently, all related addresses have been flagged by Beosin and are under continuous monitoring. Beosin KYT and Trace will continue to monitor the activities of the relevant hacker addresses and track fund flows.