An Estimated US$6.3 Billion Stolen, US$2.8 Billion Frozen: Why the Binance Hacker Still Holds US$1.2 Billion in Ether
A little over a day after the Binance theft, issuers have frozen about US$2.8 billion, none of it returned. The attacker holds 519,104 ETH, about US$1.2 billion, in a form no stablecoin issuer can freeze, and almost none of it has moved.
- Of an estimated US$6.3 billion stolen from Binance on Oct. 29, 2026, token issuers froze about US$2.8 billion, none of it yet returned, and the attacker holds 519,104 ETH, about US$1.2 billion, which no stablecoin issuer can freeze. TRM Labs attributes about US$1.9 billion more to bitcoin, XRP and Solana, not independently traced here; about US$0.5 billion is not reconciled.
- Almost none of the attacker's ether has moved: 1.4 ETH, about US$3,100, has left its 42 Ethereum wallets in the 27 hours from the drain to the data cut, in four small transfers to three addresses.
- More than half of that ether was not stolen as ether. About 291,500 ETH came from selling other stolen tokens, mainly USDT sold before Tether's freezes reached it, plus RLUSD and dozens of smaller tokens; about 200,600 ETH was taken directly from two Binance wallets.
- On Oct. 30, 16.3 million USDC crossed from Avalanche to Ethereum through Circle's CCTP bridge into seven new wallets, was swapped for ether and consolidated as 7,243 ETH in a wallet whose gas money traces to the attacker. Circle blacklisted that wallet about 45 minutes later, when it held no USDC. see data →
A little over a day after one of the largest crypto thefts on record, about US$2.8 billion of what was taken from Binance is frozen and about US$1.2 billion sits with the attacker in ether, an asset no stablecoin issuer can switch off. The attacker holds 519,104 ETH in 42 Ethereum wallets, and almost none of it has moved: 1.4 ETH, about US$3,100, has left them since the drain.
The theft is estimated at about US$6.3 billion, the largest crypto theft on record, and Binance has said it will cover all losses. Blockchain analytics firm Chainalysis attributes the attack to TraderTraitor, a North Korean hacking group. Within hours of the drain, the companies behind many of the stolen tokens, from Tether and Circle to Paxos froze about US$2.8 billion of them. Frozen is not recovered: those tokens cannot move, but none has been returned to Binance.
| Amount | What it means | |
|---|---|---|
| Estimated stolen | ≈US$6.3B | Incident-wide estimate across many tokens and chains, as reported; not an onchain total |
| Frozen by token issuers | ≈US$2.8B | Cannot be transferred; none burned or returned to Binance so far |
| Held by the attacker in ETH | ≈US$1.2B | 519,104 ETH in 42 wallets; no issuer can freeze it; 1.4 ETH has left |
| Bitcoin, XRP and Solana, as reported by TRM Labs | ≈US$1.9B | 18,270 BTC, 233.46M XRP and 970,500 SOL; addresses unpublished, not independently traced |
| Remainder | ≈US$0.5B | Approximate difference between the reported theft estimate and the categories above; not independently reconciled or fully traced |
The ether is not an additional theft. More than half of it was bought, mostly with stablecoins sold before their issuers' freezes reached them. The figures here cover what can be measured directly onchain, not a full accounting of the US$6.3 billion. TRM Labs, which puts the theft at US$6.36 billion across its chains, reports that the attacker's 18,270 bitcoin is being split into smaller pieces, so “almost none has moved” describes the ether on Ethereum, not the whole haul.
How much of the ether was bought, not taken
Fig. 2
ETH held in the Binance attacker's wallets
Holdings rose for 20 hours as the attacker sold stolen tokens for ether, then stopped rising; almost none has left
About 200,600 ETH came out of Binance as ether: 172,624 ETH from the wallet Etherscan labels Binance 14 and 28,006 ETH from Binance 16. The larger share, about 291,500 ETH, arrived in the same transactions in which the attacker sold other stolen tokens, through Uniswap, its order-filling system UniswapX and other trading routers. By value, most of what was sold was USDT, sold before Tether's freezes reached it. The rest was RLUSD, the Ripple stablecoin, which had moved before Ripple paused it, and dozens of smaller tokens, from PEPE and SHIB to DENT and SPELL, none of which has an issuer that froze them. Sales continued into the morning of Oct. 30, adding 4,337 ETH between 03:46 and 08:00 UTC. The attacker's holdings were about 507,500 ETH by 03:46 UTC on Oct. 30; the roughly 460,000 reported then counted only transfers of 100 ETH or more.
Fig. 3
Where the attacker's 519,104 ETH came from
More of the ether was bought with stolen tokens than was taken as ether
A further 19,762 ETH was drawn from Aave, the lending market; TRM Labs reports it was borrowed against 60 million stolen USDT.
Day two: dollars crossed Circle's bridge and became ether before Circle froze them
The attacker-linked transactions of Oct. 30 show how quickly stolen digital dollars can move beyond an issuer's freezing powers: about US$16.3 million was converted into ether before Circle blacklisted the receiving wallet. The attacker's address had received 2.3 million AVAX on Avalanche on the first night. On Oct. 30, attacker-funded wallets sold AVAX through a trading router, and the USDC from those sales went to seven wallets created that day. Within one to four minutes each burned it through CCTP, Circle's own system for moving USDC between chains. Circle's contracts then minted 16.3 million USDC to the same seven wallets on Ethereum, less about US$1.4 in fees per transfer. They swapped it for ether: about 6,190 ETH from six wallets holding 13.9 million USDC, and about 1,053 ETH from a seventh holding 2.4 million, routed through one of the six. Between 12:41 and 12:44 UTC the six sent 7,243 ETH to a single wallet, whose gas money traces in four steps to the address Etherscan tags “Binance Hot Wallet Exploiter 2.”
| Time (UTC) | Chain | What happened |
|---|---|---|
| 11:41–12:37 | Avalanche | Seven new wallets receive a combined 16.3M USDC from sales of the attacker's AVAX and burn it through Circle's CCTP bridge |
| 11:44–12:37 | Ethereum | Circle's bridge mints 16.3M USDC to the same seven wallets |
| Minutes later | Ethereum | The wallets swap their USDC for ETH; the seventh passes its ETH to one of the six |
| 12:41–12:44 | Ethereum | The six wallets send 7,243 ETH to one wallet funded from the attacker's address |
| 13:26:59 | Ethereum | Circle blacklists one of the six wallets; it holds no USDC |
| 13:27:59 | Ethereum | Circle blacklists the receiving wallet; it holds 7,243 ETH and no USDC |
Circle blacklisted the receiving wallet and one of the six about 45 minutes after the ether arrived. The blacklist stops USDC; the wallet held 7,243 ETH and no USDC. The episode shows how short the window for a freeze has become: for each wallet, the time between the USDC appearing on Ethereum and leaving it as ether was measured in minutes.
Neither the ether nor the frozen billions have moved
Every attacker-linked balance frozen on the first night is identical to the unit, including 1.2 billion USDT and 823 million USDC at the attacker's main Ethereum address and 12,574 ounces of Tether Gold. Tether has recorded no burn of frozen funds on Ethereum or Tron, the step that can precede reissuing them to a victim, and neither Tether nor Circle has released a freeze. Ari Redbord of TRM Labs told CNBC that “a freeze stops the money from moving, and recovery follows through legal process”; Chainalysis's Eric Jardine said returning funds “can take months or years.”
Why it matters: a freeze protects only the dollars that stay dollars
The first night's US$2.8 billion of freezes has been read as proof that stablecoins contain a hack. The second day shows the limit of that protection. An issuer can halt its token wherever the token sits, but it cannot halt what the token is exchanged for. Each stablecoin the attacker sold before a freeze, and each one carried across a bridge and swapped before a blacklist, became ether. It resembles a robbery in which stolen banknotes can be cancelled remotely but the thieves exchanged many of them for gold first: the gold can still be followed, since every ether transfer is public, but it cannot be switched off. The ether in the attacker's wallets is now worth about US$1.2 billion, more than a third of everything frozen. It is a measure of what the freeze switches did not reach.
The cost lands first on Binance, which has promised to cover customer losses from its own funds, and every ether the attacker keeps is a dollar of that bill that no freeze will offset. It also reframes the case for issuer controls: their value in an attack depends less on how fast the freeze arrives than on how long the stolen tokens stay unconverted. The CCTP episode raises a narrower question for Circle and for every bridge operator: whether a stablecoin issuer's own transfer system should screen the wallets it mints to while an attack is still under way.
What happens next
The 519,104 ETH represents a substantial pool of attacker-linked assets that stablecoin issuers cannot freeze directly, although exchanges, custodians and law enforcement may still have opportunities to intervene. The closest precedent is the Feb. 21, 2025 Bybit theft, attributed to North Korea's Lazarus Group. By March 5, analytics firm Arkham reported that about 500,000 ETH had been bridged to bitcoin, 72% of the proceeds through THORChain, a cross-chain trading network. If this attacker follows that pattern, and nothing onchain yet shows it will, the next move is out of Ethereum through cross-chain swap venues. That would test whether those venues will refuse the flow this time.
Three signals will show where this goes. The first is the first ether leaving these 42 wallets, and where it goes. The second is a burn of the frozen USDT or USDC, the first step toward returning any of it to Binance. The third is any full account from Binance of how the attacker gained control of its wallets. The freezes settled who controls the stablecoins. The open question is whether the market's cross-chain venues will treat a known attacker's US$1.2 billion of ether as something they can decline to trade.
The 42 wallets are every Ethereum wallet first active on or after Oct 28, 2026 that received ETH or WETH, of any size, from the exploiter-tagged addresses (0x5227…2f8c and related) or from another wallet in the set. Lookalike addresses created by spoof-token transfers are excluded; they held no ETH. Balances at block 26308974 (23:50:47 UTC Oct 30) total 519,103.71 ETH. Every ETH transfer out of the set since the drain totals 1.3863 ETH, in four transfers to three addresses. Starting balance plus inflows minus outflows matches the end balance within 16.3 ETH, matching gas on about 3,000 transactions. The largest wallet, 0x8532…43d4 (Etherscan: Binance Hot Wallet Exploiter 8), holds 197,460 ETH.
Verified Oct 30, 2026 · e.g. 0x8532fa14…43d4Seven wallets (0x1372…c7c1, 0xb77d…2c61, 0x6abe…8cc3, 0x4bd7…b29f, 0x56c3…2714, 0x1192…7a16, 0x62b1…c82e) each burned USDC on Avalanche through CCTP (TokenMessengerV2 DepositForBurn, via a forwarding contract) between 11:43 and 12:37 UTC Oct 30 and received USDC minted on Ethereum, totalling 16.3M; each mint carries the CCTP MessageReceived event with source domain 1 (Avalanche). 0x1372…c7c1 sent 1,052.86 ETH to 0x56c3…2714 at 12:16:59 UTC. The other six sent 7,242.76 ETH to 0x2948…a0ed between 12:41 and 12:44 UTC. That wallet's first ETH came from 0x5227…2f8c via 0x0e77…77d3, 0x8035…c397 and 0xad45…e8b5. Circle's Blacklisted events for 0x62b1…c82e and 0x2948…a0ed are at 13:26:59 and 13:27:59 UTC.
Verified Oct 30, 2026 · 0x29482870…a0edThe US$6.3 billion incident-wide estimate is externally reported, not independently established by this analysis. Ether outflows were measured on Ethereum. Known attacker addresses were also checked on Base, Polygon, Arbitrum, BNB Chain, Avalanche, Unichain, Linea, Scroll and World Chain. Bitcoin, the XRP Ledger and Solana were not traced because no attacker addresses are published; those figures are TRM Labs'. Optimism and zkSync were not read, and Tron was not followed past addresses whose owners are unidentified. Since the first report's 04:10 UTC read on Oct 30, Tether added 54 more Tron USDT addresses to its blacklist; none is traced to this attacker here, so none is counted. 'Bought' ETH is ETH received in the same transaction as a token sent by the attacker; it does not assign ETH to individual tokens. Dollar values use US$2,242.60 per ETH (CoinGecko, 23:58 UTC Oct 30).
Method · onchainbenchmark.com/methodology- Has the Binance hacker moved the stolen ETH?
- Not on Ethereum, as of 23:50 UTC on Oct. 30, 2026. The 42 wallets holding the attacker's ether contain 519,104 ETH, about US$1.2 billion, and only 1.4 ETH in total has left them since the Oct. 29 drain, in four small transfers to three addresses.
- Where did the Binance attacker's ether come from?
- About 200,600 ETH was taken as ether from two Binance wallets. About 291,500 ETH was bought by selling other stolen tokens, mainly USDT sold before Tether's freezes reached it, plus RLUSD and dozens of smaller tokens. About 19,800 ETH was drawn from Aave, and 7,243 ETH came from 16.3 million USDC moved from Avalanche to Ethereum through Circle's CCTP bridge on Oct. 30.
- Has any of the frozen Binance money been returned?
- No. Every attacker-linked frozen balance, including 1.2 billion USDT and 823 million USDC at the attacker's main Ethereum address, is unchanged, and Tether has recorded no burn of frozen funds on Ethereum or Tron. Analysts at TRM Labs and Chainalysis have said recovery follows legal process and can take months or years.
- Why can't the stolen ether be frozen?
- Ether has no issuer, and Ethereum has no body with power to freeze it. Stablecoins can be frozen because their issuers built a freeze into the token contract, but that control does not extend to what a stablecoin is swapped for. Converting stablecoins and other tokens into ether put them beyond any issuer's freeze.