How it happened
A rehearsal
That afternoon the attacker runs the same takeover on three throwaway wallets of their own, sweeping a few dollars each time.
7702 delegations of 0x8378…bc3 and 0x9c29…b6b to a first delegate 0x19be…f2bf at 13:51; 0x43ae…04bd to the final delegate at 16:20. Sweeps to 0x24a4…a4de. The attacker EOA was funded by three 0.1 ETH Tornado Cash withdrawals and 1.08 ETH from a second Tornado-funded wallet.
The wallet changes hands
A transaction carrying Binance wallet 14's own signature lets the attacker's program run the wallet. Whoever made it could sign with that wallet's key, or get Binance's systems to sign. Binance's own transactions kept going out of the same wallet all evening.
Type-4 tx 0xad99…298b sets 0x28c6…1d60's EIP-7702 delegation to 0x63e8…6fae. All 50 authorizations recover to B14 and cover nonces 18,914,775–18,914,824; B14 had used 18,914,775 at 20:17:47, and 18,914,809 applied.
One transfer takes $2.8 billion
167,464 Ether and 63 other tokens leave in a single transaction. The network fee was under a dollar.
0x53bd…e2f3: 0x7c86…5ca0 calls 0x8a179be4 on B14, now running the delegate's code, which sweeps to Exploiter 2. The delegate accepts calls only from 0x7c86, funded through Tornado Cash on 28 Oct.
The money is split up
A second Binance wallet sends 28,005 Ether, and 823 million USDC is pulled from a third that wallet 14 controls. 195,460 Ether, about $440 million, goes to a fresh wallet and stays put. The rest is spread over dozens of new wallets, swapped on exchanges, and used as collateral for an Aave loan. No bridge to another chain and no exchange deposit has shown up.
B16 → E2 (0x51f2…); E2 → E8 (0x551d…); Hot Wallet 34, a Circle MSCA owned by B14, → E2, 780M + 43M USDC (0xdc10…). Several hop wallets are themselves 7702-delegated.
The issuers step in
Tether, Circle and Ripple can block their dollar tokens at any address, and they blocked the attacker's main wallets within the hour, then Binance's drained wallet itself. Synthetix and The Sandbox pulled their own tokens back. Ether has no company behind it, so the Ether is still the attacker's to move.
Tether AddedBlackList, Circle Blacklisted and Ripple AccountPaused events are read from the token contracts; each wallet's state is checked with isBlackListed / isBlacklisted / accountPaused. Binance revoked the delegation at 00:10:35 on 30 Oct (0xafbf…).
- Hot wallet
- An exchange's online wallet, topped up so it can pay withdrawals quickly. Most customer money is kept offline.
- Dollar tokens
- Digital tokens worth $1 each, issued by a company: USDT by Tether, USDC by Circle, RLUSD by Ripple. The issuer can freeze them.
- Ether
- Ethereum's own currency. No company issues it, so no one can freeze it.
- Why it can be followed
- Every Ethereum transfer is public. Wallets carry no names, but the path of the money is visible to anyone.
Being watched right now
Technical detail wallets · freezes · every transfer · method
Wallets on the map
| Role | Address | ETH | Held | Top holdings | Frozen by issuer | Note |
|---|
Freezes on-chain Tether AddedBlackList · Circle Blacklisted · Ripple AccountPaused, since block 26,300,672
| UTC | Issuer | Address | On the map as | Tx |
|---|
Every movement of $10K or more
| UTC | From | To | Amount | USD now | Tx |
|---|
Method
The starting points are the five attack transactions above, decoded with eth_getTransactionByHash. From there every transfer of ETH or a priced ERC-20 worth $10K or more is recorded. A plain wallet (no code) or Safe multisig that receives $1M or more from the attacker's side is followed in turn, up to four hops.
Contracts are not followed. Named ones are grouped by what they do. Unnamed ones are grouped together: they may be trading routers or the attacker's own contracts, and this page can't tell which. Neither group's balances count as the attacker's. A wallet with an EIP-7702 delegation has code but is still a wallet, and is followed. A few roles were set by hand after checking on-chain: two Safes that took back Synthetix and Sandbox tokens, and two hop wallets the first pass took for outside senders.
The dots: each one stands for $25,000 ($60,000 on phones) and takes the exact path its money took, transfer by transfer. Dollar tokens turn blue once their issuer has blocked the wallet they sit in. Amounts use current prices, so they show what the coins are worth now.
Not covered: the 612.7M USDT on Tron and 16,687 BTC that Whale Alert reported, which no source has tied to the attacker; the Arbitrum and Avalanche flows in Blockaid's total; USD1 and PAXG freezes reported by World Liberty and Paxos. Ripple reported freezing about $200M of RLUSD; 40.5M is frozen on Ethereum, and that is what this page counts.
Data comes from the Blockscout API and the PublicNode Ethereum RPC by a job that runs about every 10 minutes and publishes the result with this page; your browser reads only this site.