Funds
are Gone.
On the night of October 29, 2026, someone took control of Binance hot wallets and walked out with an estimated $6.28 billion across Ethereum, Bitcoin, Tron, XRP, Solana, Arbitrum, Avalanche and Optimism. $6.07B moved in the first 55 minutes. The gas money came from Tornado Cash. The Ethereum sweep cost under a dollar in fees.
If confirmed, it's the biggest crypto theft ever recorded. More than 4x Bybit. Funds are gone. This is the coin for it.
One signature.
Fifty authorizations.
Billions gone.
Someone could sign as Binance
The attacker had a valid signature from the key behind "Binance 14", one of Binance's biggest Ethereum hot wallets. How they got it is still unknown: stolen key, compromised signing system, or insider.
EIP-7702 turned the wallet into a vacuum
Ethereum's EIP-7702 lets a normal wallet delegate to smart-contract code. The attacker pointed Binance 14 at their own sweeper contract and then just called sweep().
Hacker vs. the freeze button
Tether, Circle, Ripple, World Liberty and Paxos started blacklisting addresses within ~35 minutes. Stablecoins got frozen. ETH, BTC, SOL and XRP can't be frozen, and that's where the loot is now.
Bigger than every hack before it
Biggest crypto thefts by USD value at the time of the attack. Binance figure is the on-chain tally across 8 chains, not yet confirmed by Binance.
Anatomy of a $6B sweep
Reconstructed from public Etherscan records and the transaction-by-transaction breakdown by CertiK engineer and SEAL member Dickson. The attacker prepared for more than a day and tested the method on their own wallets first.
Clean gas money
Wallet 0x7c86…5ca0 pulls 0.1 ETH from Tornado Cash, then two more times. A second wallet adds 1 ETH on Oct 29. No exchange pays fees this way. That became the first red flag.
Build the vacuum
A sweeper contract is deployed at 02:28 UTC. From 13:51 to 16:47 the attacker test-sweeps USDT and USDC on their own wallets using EIP-7702. A v2 with a universal call function ships at 15:59.
Hijack Binance 14
One transaction carries 50 EIP-7702 authorizations signed with Binance 14's key, one for each upcoming nonce, which makes it hard to revoke quickly. From here Binance 14 runs the attacker's code.
Pull the lever
A single sweep() call moves 167,464 ETH, 1.615B USDT and 60+ tokens in one transaction. Reported fee: about $0.93. The contract only accepts calls from the Tornado-funded wallet.
Shipped with Ethereum's Pectra upgrade (May 7, 2025). It lets a regular wallet (an EOA) temporarily run smart-contract code. It's built for batching and gas sponsorship. But the delegation only works if it's signed with the wallet's private key. Whoever signs for the wallet controls what it does.
Unknown. Three theories are circulating: a stolen hot-wallet key, a manipulated signing system (the Bybit 2025 playbook), or insider involvement. Security firm Defimon classified it as abuse of a delegation with a compromised key. Nothing is confirmed.
The night it happened
Markets bled
< $78,000
Bitcoin slid from about $80.3K and broke below $78K the next day.
< $2,250
Ether dropped about 4% as traders eyed the hacker's unfrozen ETH stack.
−7%
Binance's own token fell to around $702.
$629M
Liquidated in one hour, $607M of it longs (CoinGlass).
Binance said it was investigating and that user funds are "completely safe." It then temporarily suspended withdrawals on multiple networks as a precaution. Binance has not published a confirmed loss figure.
Binance's emergency fund, SAFU, holds about $1B in bitcoin, far below the reported theft. Binance held roughly $144B in assets before the hack, per DefiLlama, so the loss is about 4% of that.
Where is the $6.28B right now?
Breakdown across all 8 chains, then what was frozen and what's still moving. Snapshot from on-chain tracing as of ~23:50 UTC Oct 29. Live Ethereum balances are further down.
8 chains, one night
What the hacker still holds
| Asset | Amount | Where | Can it be frozen? |
|---|---|---|---|
| BTC | 18,270 BTC | Spread across 19 wallets | No |
| ETH | ~458,770 ETH | Across 9 wallets (incl. swapped proceeds) | No |
| XRP | 233.5M XRP | XRP Ledger | No |
| TRX | 684.6M TRX | Tron (incl. USDT swapped on SunSwap) | No |
| SOL | ~970,500 SOL | Solana | No |
| ARB / AVAX / OP | ~$48M | Arbitrum, Avalanche, Optimism | No |
| Other ERC-20s | ~$136M | Ethereum | Some |
Who hit the freeze button
| Issuer | Time (UTC) | What got frozen |
|---|---|---|
| World Liberty | 20:57:47 | 48.5M WLFI blacklisted (first to act). Later 27.8M USD1 at 22:10 |
| Tether | 21:01:35 → | ~1.38B USDT on Ethereum, 378.7M on Tron, 8.41M on Avalanche, 12,574 XAUt. Blacklisted Binance 14 itself at 22:06 |
| Circle | 21:04:59 | 823M USDC in one shot (824.6M total) |
| Ripple | 22:00:59 | RLUSD frozen, 40.5M intercepted. Yi He credited Ripple with stopping ~$200M |
| Paxos | 22:30:47 | 1,907 PAXG |
| Binance | 22:48:35 | 29,934 wBETH (~$75M) |
| First Digital | - | 3.45M FDUSD still freely transferable |
How they tried to get out
About 435M USDT was sold before freezes landed, including a 325M batch swapped to ETH through an RFQ market maker and ~234M USDT swapped to TRX on SunSwap.
Wallet 0x8d53 deposited 60M USDT into Aave and borrowed ETH against it, roughly 20,000 WETH. Tether froze it 48 seconds after a 130M move. The 60M is stuck as collateral, and Aave froze markets.
The attacker forwarded 195,460 ETH to a fresh wallet within 15 minutes, sold about 48M RLUSD for ETH, and converted 7 tokens into 70,480 ETH. Arkham has tagged 70 linked addresses.
Live balances
Pulled straight from Ethereum when this page loads and refreshed every 60 seconds. USDT/USDC still showing here is frozen. It sits in the wallet but can't move.
The hacker's wallets
Every address and transaction tied to the heist that's been published in full. Click through to verify on Etherscan yourself. Arkham tracks the attacker as entity binance-hacker-1029.
Address-poisoning warning. Scammers spammed fake "ETH" and "USDT" tokens to look-alike addresses during this incident. Always check the full address, not just the first and last characters. Never send anything to these wallets. They're listed here for tracking only.
Key transactions
| What | Time (UTC) | Tx hash |
|---|
Other wallets in the web
These have only been published in shortened form so far. Search them on Arkham or Etherscan, and match the full address exactly.
| Address | Role |
|---|---|
| 0x8532…43D4 | Received the 195,460 ETH forwarded at 20:39 UTC |
| 0x63e8…6fAe | Attacker's sweeper contract (EIP-7702 delegation target) |
| 0x8d53…639a | Moved 130M USDT, deposited 60M into Aave, frozen 48s later |
| 0x9749…c762 | USDT split wallet, drained before Tether's first batch |
| 0xaa24…54a0 | 175M USDT frozen by Tether at 21:14:59 |
| 0xb171…c8c3 | 30M USDT intercepted at 21:18:59 |
| 0x7aa4…bfd1 · 0xccbe…a263 | Additional USDT wallets frozen by Tether |
| 0x0ddf…697e · 0x77ed…c3eb · 0xe702…958d · 0x7f9d…15e3 · 0x3e2b…32d5 · 0x8035…c397 · 0xc39e…9824 | Other attacker-linked addresses in the trace |
Funds are gone.
The meme isn't.
Mt. Gox. FTX. Bybit. Every cycle gets a night everyone remembers, and October 29, 2026 is this one's. fundsaregone.fun is the community coin for it. It has no Binance affiliation and holds no hacker funds.
Get in before the next sweep
Get a wallet
Download Phantom or Solflare. Write your seed phrase down offline and never share it.
Load SOL
Buy SOL on any exchange and send it to your wallet. Double-check the full address before you hit send.
Copy the CA
Copy the contract address from this site or our X only. Fake tickers will show up, and the CA is the only thing that counts.
Swap
Hit Buy now, or paste the CA into Jupiter or Phantom's swap. Pick an amount and confirm.