Worked example · 2026-10
Binance — a DevOps engineer's laptop led to a service container that could submit withdrawals, and the hot wallets were emptied — Binance / Ethereum, Bitcoin, Tron, XRP Ledger and others — 2026-10-29
Summary
Preparation is visible on-chain. The initiator was funded by three 0.1 ETH Tornado Cash withdrawals from 07:39 UTC on 2026-10-28, rehearsed 7702 delegate-and-sweep on its own test wallets between 13:51 and 16:47, and deployed the final sweep contract at 15:59. On 2026-10-29 the drain ran from 20:04 (XRP) to 20:36 UTC (Avalanche), with further Ethereum sweeps at 21:44 (after another Binance wallet topped Binance 14 up with 200M USDT) and 22:39. Tether froze the receiver at 21:01 and Binance 14 itself at 22:06. On 2026-10-30 Binance published preliminary findings (DevOps laptop → service container → unauthorized withdrawals), froze ~$3B with issuers and chain partners, and suspended deposits and withdrawals pending "a security revamp of the withdrawal service and its related addresses". A full post-mortem is promised.
Timeline (UTC)
Read it as three stages. Get in: a laptop, then the withdrawal service. Prepare: funding and a rehearsal. Take: the service signs what the attacker asks for, on every chain at once. Times are from Ondology Labs' on-chain reconstruction unless marked.
| When | What happened | OAK |
|---|---|---|
| Before 2026-10-28 (undisclosed) | A DevOps engineer's laptop is compromised. From it the attacker reaches a service container that submits withdrawals. How the laptop was compromised is not published. Binance says there were "additional points of breach". | T15.003 entry |
| 10-28 07:39 → 10-29 08:23 | Three 0.1 ETH Tornado Cash withdrawals (10-28 07:39 and 08:53, 10-29 08:23; traced by OAK) fund the initiator 0x7c8601d4645b93cea45f71e118a729332e6b5ca0. |
T7.001 (funding) |
| 10-28 13:51–16:47 | Rehearsal: the initiator uses EIP-7702 to delegate its own test wallets to a sweep contract and drains small USDT/USDC balances. | T13.004 (rehearsal) |
| 10-28 15:59 | Final sweep contract 0x63e842b054bd624a465454d533c33f573e9c6fae deployed. Only the initiator can call it. |
— |
| 10-29 20:04:52 | Drain starts on XRP. Solana, Optimism, Bitcoin, Tron follow before 20:22, all as ordinary signed transfers that look like Binance withdrawals (CertiK). Bitcoin: 18,270 BTC in 11 transactions (CoinDesk). | T15.003 (the service signs) |
| 20:20:59 | 0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b: one transaction carries 50 EIP-7702 authorizations signed by Binance 14's key, one for each of 50 consecutive nonces. One matches, and the Binance 14 EOA now runs the attacker's sweep code. |
T13.004 |
| 20:24:23 | Sweep 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3: 167,464 ETH + 63 tokens leave Binance 14 for the receiver 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c. Binance 16 sends nine ordinary transfers 24 s later. |
T13.004 / T15.003 |
| 20:30–20:36 | Arbitrum and Avalanche hot wallets drained. | T15.003 |
| 20:41:23 and 20:59:47 | Through Binance 14 the attacker orders smart wallet Hot Wallet 34 to pay out 780M + 43M USDC (first payout 0xdc102dd89dded5a83f1008906883ffb7c81ff3b7d7965d8c7277d170b5e17481). |
T13.004 (blast radius) |
| 21:01:35 / 21:04:59 | Tether freezes the receiver; Circle freezes the 823M USDC. Tether and Circle together freeze $2.01B within the hour. | response |
| 21:44:11 | Another Binance wallet tops Binance 14 up with 200M USDT, and the attacker sweeps it too, still delegated (0x55ba4dabc41b468e580751373ad31acdee6f5ba398682df2c93e5a8340870556). |
T13.004 |
| 22:06:23 | Tether freezes Binance 14 itself. A fourth sweep follows at 22:39 (128.5 ETH). | response |
| 10-30 00:10:35 | Binance 14 signs a 7702 revocation and is back under Binance control, 3 h 50 m after the takeover. | response |
| 10-30 00:18 | Arbitrum Security Council freezes ~$30M. | response |
| 10-30 02:25 | Binance publishes its preliminary findings: laptop → service container, no private key leaked, ~$6.3B, deposits and withdrawals suspended. | — |
| 10-30 onward | Unfreezable assets are held or spread: BTC in 19 wallets, ~500K ETH in seven. Funds meet Bitget proceeds at one address, which is part of the DPRK attribution by TRM and Chainalysis. | T8.001 (cluster reuse) |
Key addresses
Ethereum, from Ondology Labs' write-up, where each one is linked to Etherscan.
- Binance 14, the EOA taken over via EIP-7702 —
0x28c6c06298d514db089934071355e5743bf21d60 - Hot Wallet 34, a smart wallet that obeys Binance 14 —
0xee7ae85f2fe2239e27d9c1e23fffe168d63b4055 - Binance 16, which sent ordinary transfers —
0xdfd5293d8e347dfe59e90efd55b2956a1343963d - Sweep contract, unverified, callable only by the initiator —
0x63e842b054bd624a465454d533c33f573e9c6fae - Receiver of the sweeps —
0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c - Largest attacker ETH holding (197,460 ETH as of 2026-10-30 06:25 UTC) —
0x8532fa14acaf483729c449b8458aeddb900543d4 - Address shared with Bitget exploit proceeds (TRM, via The Hacker News) —
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 - Initiator, full address traced by OAK —
0x7c8601d4645b93cea45f71e118a729332e6b5ca0 - Six further attacker ETH wallets, the Avalanche receiver (
0x8035…c397) and an RLUSD wallet (0xe702…958d) are published only in shortened form (full addresses not published). The 19 Bitcoin wallets are not listed in the sources.
Where the funds are (as of 2026-10-30 06:25 UTC, Ondology Labs)
| What | Status |
|---|---|
| $2.01B USDT/USDC | frozen by Tether and Circle within an hour; Binance puts total frozen near $3B with other issuers and Arbitrum |
| held across seven attacker wallets on Ethereum, not frozen | |
| 18,270 BTC | split into 19 wallets, unmoved on 2026-10-30 (CoinDesk) |
| USDT that escaped freezes | split into hop wallets, sold for ETH on UniswapX / Uniswap, and used as collateral to borrow ETH on Aave (Ondology) |
What is not known yet
- How the laptop was compromised, what the service container could reach, and what the "additional points of breach" were.
- How the container caused Binance's keys to sign. On-chain evidence shows what was signed, not how.
- Where the unfreezable ETH and BTC will move.
- Whether the DPRK attribution holds. Binance has not confirmed it, and Ondology did not verify it.
Why two techniques. T15.003 explains how the attacker got the power to sign. T13.004 explains what they made Binance 14 sign on Ethereum: a delegation, rather than a plain transfer, so that one EOA could be emptied of everything in one call and could then command Hot Wallet 34. On the other chains no 7702 step was needed; the compromised service just sent transfers.
Fund flow
Ethereum leg, traced by OAK with tools/explorer.py (Blockscout, keyless) on 2026-10-30. Edges marked traced by OAK were checked on-chain; dashed edges are relayed from the cited source. Counterfeit-token transfers were excluded: within hours, address-poisoning bots sent the attacker's wallets fake "ETH", "USDT" and "USDC" Transfer events from lookalike addresses (for example 0x8537cce92e58b935874ddf03826030d7440543d4 imitating the real holding wallet 0x8532fa14acaf483729c449b8458aeddb900543d4). The two share their first four and last six characters, which is exactly why OAK never shortens an address.
All transfers as a table (23)
What the trace adds beyond the sources:
- The initiator is
0x7c8601d4645b93cea45f71e118a729332e6b5ca0(published only shortened). It was funded by three 0.1 ETH Tornado Cash withdrawals: on 2026-10-28 at 07:39 and 08:53, and on 2026-10-29 at 08:23. It also received 1.08 ETH from an unlabelled address on 2026-10-29 at 18:20. - The ETH holding wallet
0x8532…received 195,460 ETH at 20:38:47 and 2,000 ETH at 01:14:11 on 2026-10-30, a total of 197,460 ETH. This resolves the 195,460 vs 197,460 discrepancy that Ondology flagged. - Hop wallets. The receiver gave at least 14 fresh wallets about 0.5 ETH of gas each, then one large asset each: 500M and 200M USDT, 88.5M RLUSD, 29,934 WBETH, 217M ENA, 167 WBTC, 9.7M USDe, 7.0M UNI, 21.9M ONDO.
- DEX dumping. From 2026-10-30 01:17 UTC the receiver sold 35 long-tail tokens directly into 64 Uniswap and SushiSwap pools in 529 swaps.
Root-cause evidence
- Technique: OAK-T15.003
- Source: https://x.com/binance/status/2115993361517891592; https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
- Source type: operator
- Confidence: confirmed
- Evidence: Binance states the laptop → service container → unauthorized withdrawal path as its preliminary finding and says it has found additional points of breach. The T13.004 Ethereum leg is independently corroborated: Ondology Labs recovered the signer of all 50 authorizations as Binance 14 (delegation and sweep transactions linked in the timeline), and TRM Labs (via The Hacker News) reports the same pattern. Neither source is a Binance statement.
Public references
[binanceincident2026]— Binance on X, initial investigation (2026-10-30): https://x.com/binance/status/2115993361517891592[binanceannouncement2026]— Binance, security incident update: https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7[thnbinance2026]— The Hacker News, "Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen": https://thehackernews.com/2026/10/binance-suffers-security-breach.html[ondologybinance2026]— Ondology Labs (P. Kattides), on-chain forensics of the Binance hot-wallet drain and the EIP-7702 takeover (2026-10-29, updated 2026-10-30): https://ondologylabs.com/blog/binance-hot-wallet-hack-eip-7702[etherscanbinancedelegation2026]— 50-authorization delegation transaction: https://etherscan.io/tx/0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b[etherscanbinancesweep2026]— sweep transaction: https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3[coindeskbinancebtc2026]— CoinDesk, Binance hacker splits $1.4B of bitcoin into 19 wallets (2026-10-30): https://www.coindesk.com/markets/2026/10/30/binance-hacker-splits-usd1-4-billion-of-bitcoin-into-19-wallets-that-no-one-can-freeze