Statements

Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep. Later sweeps landed in the frozen wallet, which now holds 1.175 billion USDT.

21:01 | Tether freezes 971.1M USDT, 37 minutes after the Ethereum transaction.

CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began.

At 20:41:23 the operator called Binance 14 with a different function. The delegated code called execute on Hot Wallet 34 with an ERC-20 transfer, moving 780 million USDC to the hub (transaction 0xdc10…7481, block 26,300,855). * Another 43 million followed at 20:59:47. Together that is the 823 million USDC Circle froze.

At 20:41:23 the operator used the still-delegated Binance 14, which owns the Circle smart account Binance Hot Wallet 34 , to move 780M USDC from that account to the collection address, followed by another 43M USDC.

Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash

Between 20:30 and 20:33, before Tether acted, 700 million USDT left the hub in two transfers; Tether later caught 205 million of it one and two hops downstream.

Total: roughly $2.5 to $2.8 billion in one transaction, depending on whose prices you use.

At 20:24:23 (3 minutes 24 seconds after the delegation), in block 26,300,770, the operator called Binance 14.

At 20:24:23, three minutes and 24 seconds later, the operator called sweep on Binance 14 (transaction ), sending 167,464 ETH, 1.615B USDT, and about 60 other tokens to a collection address with no prior history, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c . Binance 14 was left with 1 ETH. At prices at the time, the basket was worth about $2.5B.

The attacker first drained Binance 14 starting 20:24 UTC in a single transaction worth about $2.5B, minutes after Binance’s own signing infrastructure, under the attacker’s control, signed an EIP-7702 authorization delegating it to an attacker-deployed sweeper.

The stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC. Tether froze that wallet 37 minutes later, locking 1.18 billion USDT in place, and then followed the funds, freezing four more attacker addresses within 17 minutes. Circle froze the 823 million USDC in the same wallet three minutes after that.

Ethereum sits in the middle of this sequence: at 20:24, one transaction moved about $2.53B out of a single wallet.

| Tron | 612.7 million USDT and 46.4 million TRX, about 628 million dollars | Plain signed transfers from a hot wallet | 20:22 |

At 20:20:59 the operator sent a type-4 transaction to Binance 14, 0x28C6c06298d514Db089934071355E5743bf21d60 , carrying 50 EIP-7702 authorizations signed with the Binance 14 key, one per nonce from 18,914,775 to 18,914,824, each delegating the wallet to the sweeper.

| Ethereum | About 3.79 billion dollars: 200,630 ETH and 185 tokens, including 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD | EIP-7702 delegation on Binance 14; nine plain signed transfers from Binance 16 | 20:20 to 23:56 |

Around 4:20 p.m. ET on October 29, 2026, funds began leaving Binance hot wallets across multiple blockchains. Unauthorized transfers totaled approximately $6.4 billion, the largest theft in crypto history.

At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweeper contract that accepts instructions only from the operator.

At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address, which began splitting the funds into round 1,000 BTC and 100 BTC pieces inside the same block.

At 20:20 a Bitcoin hot wallet sent out 18,270 BTC, and a Tron wallet sent more than 600 million USDT right after that.

| Solana | 970,500 SOL, about 96 million dollars | Plain signed transfers | From 20:10 |

| XRP Ledger | 233.46 million XRP, about 296 million dollars | Five wallets each emptied to the reserve minimum, to one address | 20:05 to 20:09 |

At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.

Between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP to a single attacker address, leaving each wallet with only its minimum balance.

The first transfers came at 20:05 UTC on the XRP Ledger, where five Binance wallets sent 233 million XRP to a single address.