In the 37 to 40 minutes before the freezes, 700M USDT left the receiving address and was mostly swapped to ETH. About 352,000 ETH cannot be frozen by anyone.
All amounts are verified on-chain. A freeze is not a recovery.
| From | To | Amount / detail | Time (UTC) | tx |
|---|---|---|---|---|
| Binance 14 (victim) | Attacker receiving address | 167,464 ETH + 64 tokens | 2026-10-29 20:24 UTC | 0x53bd38…e2f3 |
| Binance 16 (victim) | Attacker receiving address | 28,005.6 ETH | 2026-10-29 20:24 UTC | — |
| Attacker receiving address | Consolidation address 1 | 195,460 ETH | 2026-10-29 20:38 UTC | — |
| Attacker receiving address | Frozen by issuers | Tether 21:01 / Circle 21:04 | 2026-10-29 21:01 UTC | — |
| Attacker receiving address | Moved before freeze | USDT 700M | 2026-10-29 20:29 UTC | — |
| Moved before freeze | Sold on DEXes | Mostly swapped to ETH | 2026-10-29 20:34 UTC | — |
| Moved before freeze | Frozen by issuer | USDT 175M frozen | 2026-10-29 21:01 UTC | — |
| Sold on DEXes | Consolidation address 2 | Proceeds, about 137,600 ETH | 2026-10-29 21:47 UTC | — |
| Attacker receiving address | Consolidation address 3 | 17,260 ETH | 2026-10-30 05:15 UTC | — |
Issuer freeze events against the attacker addresses, aggregated on-chain. Elapsed time is measured in minutes from the block time of the drain transaction.
| Token | First freeze | Since drain | Frozen now | tx |
|---|---|---|---|---|
| USDT Ethereum | Oct 29, 2026, 9:01 PM UTC | 37 min | 2/7 | 0x64a3f4…b7de |
| USDC Ethereum | Oct 29, 2026, 9:04 PM UTC | 40 min | 1/7 | 0xc954c8…fc5f |
| XSGD Ethereum | Oct 30, 2026, 4:28 AM UTC | 484 min | 2/7 | 0xeae354…7843 |
A freeze is not a recovery. Frozen balances stay at the attacker address until the issuer burns and reissues them.
Counts of addresses that received funds from the attacker addresses, traced on-chain (lower bound).
At 20:24 UTC on 29 Oct 2026, roughly 167,464 ETH plus more than 60 tokens including USDT and USDC left Binance's main hot wallet 'Binance 14' (0x28c6…1d60) to an attacker address in a single call, followed by 28,005.6 ETH from 'Binance 16' (0xdfd5…963d). Three minutes earlier, Binance 14 had been delegated via an EIP-7702 SetCode transaction (bundling 50 authorizations) to a contract deployed by the attacker, and the sweep was executed through that delegated code. Because an EIP-7702 authorization must be signed by the wallet's own private key, a signing-key compromise is strongly indicated. Tether blacklisted the attacker address at 21:01 UTC and Circle at 21:04 UTC; Binance 14 itself was later blacklisted. Reported losses range from $2.5B to $5.5B; the figure here is the on-chain verified lower bound (ETH + USDT + USDC).
1 victim-side wallet is recorded for this incident but not listed as attacker addresses.
| Chain | Address | Role | Source | Action |
|---|---|---|---|---|
| Ethereum | ↗ | primary_receiver | Source ↗ | Scan this address |
| Ethereum | ↗ | consolidation | Source ↗ | Scan this address |
| Ethereum | ↗ | sweeper_operator | Source ↗ | Scan this address |
| Ethereum | ↗ | delegate_contract | Source ↗ | Scan this address |
| Ethereum | ↗ | delegate_contract_rehearsal | Source ↗ | Scan this address |
| Ethereum | ↗ | swap_proceeds_receiver | Source ↗ | Scan this address |
| Ethereum | ↗ | swap_proceeds_receiver | Source ↗ | Scan this address |
| Ethereum | ↗ | consolidation | Source ↗ | Scan this address |
| Ethereum | ↗ | consolidation | Source ↗ | Scan this address |
Figures are approximate, compiled from public reporting. Attacker addresses are included only where verified against an authoritative source. Attribution (e.g. Lazarus Group) is shown only when publicly stated by an official body.
© 2026 ChainAnalyzer. All rights reserved.