DEV Community

Cover image for Was Binance Hacked? What the Onchain Data Shows (October 29, 2026)
ILIA KARPENKO
ILIA KARPENKO

Posted on Originally published at Medium

Was Binance Hacked? What the Onchain Data Shows (October 29, 2026)

#web3 #security #ethereum #blockchain

Updated: Oct 29, 2026, 23:20 UTC

An EIP-7702 delegation came first. 167,464 ETH left Binance 14 3 minutes and 24 seconds later.

Was Binance hacked? Binance has not confirmed a cause, but Etherscan labels the sender of the 167,464 ETH transfer "Binance Hot Wallet Exploiter," CZ wrote "It does look like a hack on Binance," and Binance wrote of a "potential security issue" with no amount. The steps below give each transaction with its time, source and screenshot, what is not known, and how you can check it yourself.

How Was Binance Hacked? What the EIP-7702 Delegation Shows

Binance has not confirmed a cause. Here is what the chain shows. All times are UTC.

Step 1. Funding, Oct 28 and Oct 29. The initiator, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0, received 0.1 ETH from the Tornado.Cash pool on Oct 28 at 07:39 and 08:53 UTC, and on Oct 29 at 08:23 UTC. Etherscan labels the address "Binance Hot Wallet Exploiter."

Etherscan address page of the initiator with the label and the Tornado.Cash funding

Source: Etherscan, initiator address, read 21:34-21:38 UTC, Oct 29, 2026.

Step 2. Contract created, 15:59:11 UTC. The initiator creates contract 0x63e842B054Bd624a465454D533C33F573e9c6fAe. Its source code is not verified on Etherscan. Transaction

Step 3. EIP-7702 delegation, 20:20:59 UTC. The initiator sends a transaction that Etherscan describes as "EIP-7702: Binance 14 Delegate to 0x63e842B0...73e9c6fAe." A delegation needs an authorization signed by the key of Binance 14. How that signature was obtained is not known. Transaction

Etherscan transaction page with the EIP-7702 action "Binance 14 Delegate to 0x63e842B0...73e9c6fAe" at 20:20:59 UTC

Source: Etherscan transaction 0xad9926…298b, read 21:34-21:38 UTC, Oct 29, 2026. Transaction time: 20:20:59 UTC.

Step 4. 167,464.25 ETH out, 20:24:23 UTC. Three minutes and 24 seconds after step 3, Binance 14 sends 167,464.25 ETH and dozens of tokens to 0x5227…2f8c. Etherscan labels that address "Binance Hot Wallet Exploiter 2." Transaction

Etherscan transaction page for the transfer of 167,464.25 ETH from Binance 14 at 20:24:23 UTC

Source: Etherscan transaction 0x53bd38…e2f3, read 21:34-21:38 UTC, Oct 29, 2026.

Step 5. USDC out of Hot Wallet 34, 20:41:23 and 20:59:47 UTC. The initiator calls Binance 14 a second time. 780M USDC and 43M USDC leave "Binance: Hot Wallet 34" for 0x5227. The total is 823M USDC. Transaction

Etherscan transaction page for the transfer of 780M USDC from Binance Hot Wallet 34 at 20:41:23 UTC

Source: Etherscan transaction 0xdc102d…7481, read Oct 29, 2026 (transfer time 20:41:23 UTC).

Step 6. Delegation on, 21:36 and 21:53 UTC. At 21:36 UTC the Etherscan page for Binance 14 shows "Delegated to 0x63e842B0...73e9c6fAe," and a 41.49 ETH deposit is pending. At 21:53 UTC the delegation was on when we checked.

Etherscan page for Binance 14 with the line "Delegated to 0x63e842B0...73e9c6fAe"

Source: Etherscan address page for Binance 14, read at 21:36 UTC, Oct 29, 2026.

What the chain shows and what it does not. The chain shows the sequence and the times. It does not show how the key signature was obtained, who controls the initiator, or whether Binance has verified any of this. Etherscan labels name addresses. They do not name owners.

Full timeline (UTC)

All times are UTC on October 29, 2026, unless the row gives another date. Each row names its source.

Time (UTC) What the chain or a source shows Source
Oct 28, 07:39 and 08:53 Initiator 0x7C86…5CA0 is funded from the Tornado.Cash 0.1 ETH pool Etherscan
Oct 29, 08:23 Same initiator, same pool, 0.1 ETH Same page
15:59:11 Initiator creates contract 0x63e8…6fAe. Its source code is not verified on Etherscan Transaction
20:20:59 EIP-7702 transaction from the initiator. Etherscan action: "Binance 14 Delegate to 0x63e842B0...73e9c6fAe" Transaction
20:24:23 Binance 14 sends 167,464.25 ETH to 0x5227…2f8c, with dozens of tokens Transaction
20:24:47 Binance 16 sends 55.7M USDT, 25.9M RLUSD and other tokens to 0x5227 Etherscan token transfers of 0x5227
20:30:11 500M USDT to 0x9749…C762. Within 30 minutes it splits into eight transfers Etherscan token transfers
20:30:34 Arbitrum: Binance 54 sends 74,559,805.2 ARB to 0x5227 Arbiscan
20:33:23 200M USDT to 0x0Ddf…697e Etherscan token transfers
20:38:47 195,460 ETH to an address labeled "Binance Hot Wallet Exploiter 8" Transaction
20:41:23 780M USDC from "Binance: Hot Wallet 34" to 0x5227 Transaction
20:52:59 190M USDT from 0x0Ddf…697e to an address labeled "Binance Hot Wallet Exploiter 3" Etherscan token transfers
20:59:47 43M USDC from Hot Wallet 34 to 0x5227. Total from Hot Wallet 34: 823M USDC Etherscan token transfers
21:04:23 Second sweep from Binance 14: small amounts and 3.9M USDT Etherscan token transfers
21:13:44 Whale Alert: an address with 823,000,000 USDC frozen Whale Alert
21:15:23 CZ: "It does look like a hack on Binance." CZ
21:22:59 88,541,065 RLUSD to 0x5C23…A00Fea4FC, forwarded at 21:25:59 Etherscan token transfers
21:29:09 Binance: "potential security issue" Binance
21:31:37 Whale Alert: 174,999,872 USDT frozen at an address Whale Alert
21:33 DeBank shows $2.34B for 0x5227 (it showed $2.42B at about 21:05) DeBank
21:36 Binance 14 page shows "Delegated to 0x63e842B0...73e9c6fAe." A 41.49 ETH deposit is pending Etherscan
21:36:30 Arbitrum: 0x5227 sends all 74,559,805.2 ARB to 0x3E2b…32d5 Arbiscan
21:38 Binance's post is edited. The new text adds an update promise and a scam warning Binance
21:42:33 Watcher.Guru posts "Binance hacked with over $5.6 billion stolen," with a breakdown by asset Watcher.Guru
21:53 Delegation active for Binance 14 Etherscan check, see step 6
22:15:56 A post on X says USD1 has frozen $27M associated with the Binance incident Post on X
22:23:14 CZ: "Loss might be a bit higher than that, but will cover." CZ
22:33:11 Binance: security checks; withdrawals paused until the security issue is fully resolved Binance
From about 22:58 Binance 14 sends its tokens one per block to "Binance: Cold Wallet 20" Etherscan, COVER transfer
23:03:47 8,405,741.58 SNX moved from 0x5227 to "Synthetix: protocolDAO" Transaction
23:04 Binance 14 shows "Delegated to 0x63e842B0...73e9c6fAe"; ETH 0.94, tokens over $919K Etherscan

How an EIP-7702 delegation works, in plain words

An Ethereum wallet is controlled by one private key. EIP-7702 lets that key sign an authorization that tells the wallet to run the code of a chosen contract. The wallet keeps its own balances. The contract's code is not copied into the wallet. It runs on the wallet's assets while the delegation is set.

The EIP-7702 specification says the account being delegated signs each authorization, and the sender of the transaction pays for it. A new authorization that points to the zero address clears the delegation. So the key has to sign a new authorization to remove it.

In this case, the Etherscan action at 20:20:59 UTC reads "EIP-7702: Binance 14 Delegate to 0x63e842B0...73e9c6fAe." The transaction sender is labeled "Binance Hot Wallet Exploiter." By the spec, the authorization needs a signature from the key of the delegated account. So the signature must come from Binance 14's key. How that signature was produced is not known.

Where the funds went

  • ETH, 20:24:23 UTC. See step 4 above. 167,464.25 ETH went from Binance 14 to 0x5227…2f8c. Etherscan labels that address "Binance Hot Wallet Exploiter 2." We give amounts in ETH and tokens. Sources give different USD values for the same ETH, so we leave USD out.
  • USDC, 20:41:23 and 20:59:47 UTC. See step 5 above. 780M USDC and 43M USDC went from "Binance: Hot Wallet 34" to 0x5227. The total is 823M USDC.
  • ETH, 20:38:47 UTC. 195,460 ETH went to the address labeled "Binance Hot Wallet Exploiter 8" (0x8532…43D4). Etherscan showed a balance of 195,460 ETH there at 21:31 UTC.

Etherscan transaction page for the transfer of 195,460 ETH at 20:38:47 UTC

Source: Etherscan transaction 0x551d79…2c76, Oct 29, 2026 (transfer time 20:38:47 UTC).

  • USDT, 20:30:11 and 20:33:23 UTC. 500M USDT went to 0x9749…C762 and split into eight transfers within 30 minutes. 200M USDT went to 0x0Ddf…697e. At 20:47:47 about 10M USDT was swapped on Uniswap pools. At 20:52:59, 190M USDT went to the address labeled "Binance Hot Wallet Exploiter 3."
  • ARB on Arbitrum, 20:30:34 UTC. Binance 54 sent 74,559,805.2 ARB to 0x5227 in a plain transfer, with no delegation. At 21:36:30 UTC, 0x5227 sent all of it to 0x3E2b…32d5.

Arbiscan page for the 74,559,805.2 ARB transfer from Binance 54 at 20:30:34 UTC

Source: Arbiscan, read 21:39 UTC, Oct 29, 2026.

  • Balances. At 21:33 UTC, DeBank showed $2.34B for 0x5227, including 975.07M USDT and 823M USDC. At 21:30 UTC, Etherscan listed $2.27B in tokens and 1,708.24 ETH for the same address.

Movements from 0x5227 are not all made by 0x5227. Check the sender of each transaction before you read it as the exploiter's action.

Freezes

  • USDC, 21:13:44 UTC. Whale Alert reported an address with 823,000,000 USDC frozen. The text names no address. The total matches the 823M USDC that Hot Wallet 34 sent to 0x5227. That match is ours.
  • Tether and Circle, 21:15:23 UTC. CZ thanked Tether (~$971m) and Circle (~$823m) for the freezes.
  • USDT, 21:31:37 UTC. Whale Alert reported 174,999,872 USDT frozen. The amount equals the 175M part of the 500M split from 0x9749…C762. That second match is ours.

Whale Alert post from 21:13:44 UTC reporting 823,000,000 USDC frozen

Source: Whale Alert on X, post at 21:13:44 UTC, Oct 29, 2026.

Are Binance User Funds Safe? What Binance and CZ Said

At 21:15:23 UTC, CZ wrote:

User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.

CZ post on X from 21:15:23 UTC

Source: CZ on X, post at 21:15:23 UTC, Oct 29, 2026.

At 21:29:09 UTC, Binance wrote:

Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe.

At 21:38 UTC the post was edited. The new text adds: "we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams."

Binance post on X from 21:29:09 UTC

Source: Binance on X, post at 21:29:09 UTC, Oct 29, 2026 (screenshot taken after the 21:38 UTC edit).

Binance did not name a cause and gave no amount. CZ's post above uses the word "hack."

Did Binance Pause Withdrawals? What Binance Did Next

  • Withdrawals paused, 22:33 UTC. Binance wrote: "Our team is conducting security checks. Withdrawals will resume as soon as the security issue is fully resolved. User funds remain safe."

Binance post at 22:33:11 UTC announcing security checks and paused withdrawals

  • Cold-wallet transfers, from about 22:58 UTC. Binance 14 sends its tokens one per block to "Binance: Cold Wallet 20" (0xF977814e90dA44bFA03b6295A0616a897441aceC). USDT and WLFI transfers in that run revert. The destination is a Binance-labeled cold wallet. Who signs these transfers is not shown. Example: COVER transfer at 23:04:23 UTC.

Etherscan page for Binance 14 at 23:04 UTC, showing the delegation and remaining token holdings

Source: Etherscan, Binance 14 address page, read 23:04 UTC, Oct 29, 2026.

Etherscan transaction: COVER transfer from Binance 14 to Binance: Cold Wallet 20 at 23:04:23 UTC

Source: Etherscan transaction 0x33b534…f1654, timestamp 23:04:23 UTC, Oct 29, 2026.

  • Delegation on, 23:04 UTC. Binance 14 shows "Delegated to 0x63e842B0...73e9c6fAe." Its ETH balance was 0.94 at 23:04 UTC, against 305.2 at 21:36 UTC. Its token holdings were over $919K.

  • USD1 froze $27M, 22:15:56 UTC. A post on X said USD1 "has taken proactive steps to freeze the $27 million in USD1 associated with the @binance hack." CZ replied "Thank you!" at 22:25:59 UTC.

Post on X at 22:15:56 UTC about the USD1 freeze

  • Synthetix, 23:03:47 UTC. 8,405,741.58 SNX moved from 0x5227…2f8c to "Synthetix: protocolDAO" in a transaction sent by snax-governance.eth. The sender is on the issuer side. Transaction

What is not known

  • The signature. The delegation needs a signature from Binance 14's key. How that signature was produced, and by whom, is not known.
  • The contract. 0x63e842B0...73e9c6fAe is not verified on Etherscan. We do not know what its code does.
  • The 167,464.25 ETH transfer. The top of the Etherscan page shows "Error Occurred [execution reverted]" next to the To field, while the transaction status reads Success. On 2026-10-30 the Internal Txns tab listed the transfer without an error mark. We do not know why the page shows that note.
  • The total. No official figure exists. Media figures disagree: $2.5B (PANews), $2.77B (CryptoBriefing) and $2.8B (Coindoo). We did not check them.
  • Labels. An Etherscan label names an address. It does not say who controls the address.
  • Other chains. We did not check Avalanche, where DeBank shows $24M for the same address. We did not read Arkham, which sits behind Cloudflare.
  • Tron. Whale Alert reported 65,990,000 USDT frozen on Tron at 21:22:15 UTC. We did not check whether it links to this case.
  • Customer funds. Binance says user funds are safe. Onchain data does not show Binance's customer balances, so we cannot check that claim.

How Much Was Stolen From Binance? The $5.6B Claim

Watcher.Guru posted at 21:42:33 UTC: "Binance hacked with over $5.6 billion stolen." Its breakdown: $1.45B BTC, $875M ETH, $234M TRX, $50M XAUT, $1.57B USDT, $823M USDC, $75M WBETH, $88.5M RLUSD and $447.5M of other assets. The breakdown includes chains we did not check, such as BTC and Tron. Binance has not confirmed it.

Watcher.Guru post at 21:42:33 UTC with the $5.6 billion breakdown by asset

Source: Watcher.Guru on X, post at 21:42:33 UTC, Oct 29, 2026.

Our figures are balances of one address on the chains Etherscan tracks, not a total. Etherscan showed $2.29B for 0x5227…2f8c at 22:26 UTC on October 29. Etherscan showed $2.21B (multichain portfolio) for the same address at 23:05 UTC. Neither figure is a total of stolen funds.

A post by 0xngmi, quoted in a CZ post at 22:23:14 UTC, estimated the loss at about $1B after the USDT and USDC freezes. The same post said Binance holds $144B in custody. CZ replied: "Loss might be a bit higher than that, but will cover."

CZ post at 22:23:14 UTC: "Loss might be a bit higher than that, but will cover."

Source: CZ on X, post at 22:23:14 UTC, Oct 29, 2026.

Binance has not published a total. Media figures disagree (see "What is not known"). Neither Binance nor CZ named a cause or a group in the posts we read (21:15 to 22:33 UTC). The sources we read name no country or group. Treat any attribution as unverified until an official source or a named investigator publishes evidence.

How to verify it yourself

These checks are free. You need a browser. On Etherscan, open the timestamp menu and select "+UTC." Write down the time you read each page. Balances and labels change.

  1. The delegation. Open the EIP-7702 transaction. Read the "Transaction Action" line. Open the Authorizations tab to see the signed authorization.
  2. The delegated wallet. Open Binance 14. Look for the "Delegated to" line. Check whether it shows the same address.
  3. The sweep. Open the 167,464.25 ETH transaction. Compare the From and To labels. Open the Internal Txns tab and read the transfer line. Read the error note next to the To field.
  4. The token flows. Open the token transfers of 0x5227. Sort by time and compare the token, the amount and the sender label of each row.
  5. The initiator. Open the initiator address. Look for the Tornado.Cash deposits in its transaction list.
  6. The contract. Open 0x63e842B0...73e9c6fAe. Check whether the Contract tab shows verified source code.
  7. Arbitrum. Open the Arbiscan transaction. Check the 74,559,805.2 ARB transfers in and out of 0x5227.
  8. The balance. Open the DeBank profile of 0x5227. Write down the value and the time you read it.
  9. The rules. Read the EIP-7702 specification for the authorization format and the zero-address rule.

Compare every address letter by letter. The address 0x9749…C762 has look-alike variants. Fake tokens use look-alike letters from other alphabets. A label on a page is a label. It is not proof of who controls the address.

I post every update on this case in my Telegram channel: https://t.me/IliaAIToolsBot?start=devto-binance

Thread with live updates on X: https://x.com/GhostWaynee/status/2115923817721954336

Top comments (0)