Four Hours, 20 Freezes, One Attacker: Inside the Race to Freeze the Binance Hack, Second by Second

For three hours and 49 minutes on Thursday night, one of Binance's largest Ethereum wallets ran someone else's code. Thirty-seven minutes after a single transaction emptied it, Tether's contract blacklisted the receiving address and stopped US$971 million of USDT from moving. Within the next ten minutes Circle, Tether on Avalanche and Tron, and Tether's gold token had done the same. By morning, about 460,000 ETH, more than US$1 billion, sat in wallets the attacker had funded, because on Ethereum no one has a switch for it.

Binance, the largest crypto exchange by trading volume, suspended deposits and withdrawals and said it was investigating a potential theft. It has not confirmed how much was taken. Outside estimates have climbed past US$5.7 billion, which would make it the largest crypto theft on record, including about US$1.5 billion of bitcoin that analytics firm Arkham attributes to the attacker. Those bitcoin addresses have not been published and could not be independently traced. At least US$4.1 billion in tokens can be followed onchain into the attacker's addresses; that is a floor, not a total. What the record shows precisely is which parts of the loss could be stopped, by whom, and how fast.

One signed permission turned an exchange wallet into the attacker's tool

At 20:20:59 UTC on Oct. 29, the wallet Etherscan labels Binance 14 began running code from a contract deployed about four and a half hours earlier by an address now tagged “Binance Hot Wallet Exploiter.” That address was first funded on Oct. 28 from Tornado Cash, a mixing service. The switch used EIP-7702, an Ethereum feature introduced in 2025 that lets an ordinary wallet delegate to contract code. It can only be turned on with an authorization signed using the wallet's own key. How that authorization came to be signed has not been disclosed.

Three minutes and 24 seconds later, one transaction moved 167,464 ETH, 1.62 billion USDT and dozens of other tokens out of Binance 14 to a new address tagged “Binance Hot Wallet Exploiter 2.” The delegation stayed in place until 00:10:35 UTC, when Binance 14 revoked it, a timing reported from Beijing as 8:10 a.m.

Binance 14 was not the only Binance-labelled wallet that sent funds to that address. Binance 16 on Ethereum (24 seconds after the drain), Binance 73 on Base (eight minutes before it) and Binance 48 on Polygon (two hours and 41 minutes after it) each signed transfers to it themselves, inside batches of routine-looking outflows. Wallets whose owners could not be identified sent it ETH and ARB on Arbitrum and USDt and AVAX on Avalanche. Why those wallets sent funds there is not known.

Twenty freezes in four hours, one clock

The clock measures elapsed time, not diligence. When each issuer learned of the attack, what its legal process required and how its tooling works all differ, and none of that is visible onchain. What is visible is the result. Tether's frozen balances across four chains, taken at the moment each was frozen, add up to US$1.569 billion, the “over 1.567 billion” Tether said it had frozen. Circle's US$823 million on the attacker's address matches the more than US$800 million its chief executive cited. The stablecoins and gold tokens in the table include USDC, XAUt, PAXG and USD1. Binance has published its own running totals of frozen assets without a breakdown; the tally here counts each issuer's freeze at attacker-linked addresses.

Nine minutes: what left before the switch was thrown

The attacker did not wait. Between 20:30 and 20:33 UTC, 700 million USDT left the main address in two transfers, 28 minutes before Tether's freeze. Some of it went through Uniswap's USDT pools. Tether caught US$205 million of the 700 million later, in wallets one and two hops along. The rest moved through addresses that were not frozen, some of whose owners could not be identified.

The same pattern shows in the assets without an issuer. About 460,000 ETH now sits in 17 Ethereum wallets that were funded from the attacker's addresses and had no activity before Oct. 28, including 197,460 ETH in a single wallet tagged “Binance Hot Wallet Exploiter 8.” That is about US$1.07 billion at the price when the attack began and US$1.03 billion at Friday's price. The count has risen through the night as the attacker swapped other tokens into ether, which no one on Ethereum can stop.

The compromised wallet kept receiving money

For three hours and 49 minutes, Binance 14 was a wallet the attacker could empty at will. At 21:43 UTC, Binance 124 moved 200 million USDT into it, and the attacker's address pulled 200.4 million out about a minute later. Tether had blacklisted that destination at 21:01, so the funds arrived frozen. Starting at 23:53 UTC, Circle froze Binance 14 and Binance's Hot Wallet 34 on five chains, including US$60 million of USDC in Hot Wallet 34 on Base. Those freezes shut the compromised wallets. They are separate from, and not part of, the US$2.8 billion frozen at the attacker's addresses.

Two brakes: the token's, and on some chains, the chain's

The control that stopped about US$2.8 billion is the same one critics of centralized stablecoins point to: an issuer can halt any holder's tokens. Here it worked as an emergency brake, and it worked the same way on Ethereum, Tron, Avalanche and Polygon, because the switch is written into each token's contract.

The second brake belongs to the chain. At 00:18:20 UTC, the attacker's wallet on Arbitrum sent all 74.6 million ARB and all 8,426 ETH it held to a holding address, where they remain. The timing matches the action Arbitrum's Security Council announced: an elected group of signers with emergency powers moved the funds to a frozen wallet they say can be released only by the council or a vote of Arbitrum's governance. Ethereum has no such body, so the ether there stays wherever the attacker sends it. The trade-off is the same at both levels: the power that rescued these funds is the power to move anyone's.

The frozen tokens still sit at the attacker's addresses, so the next questions are about what happens to them and to everything that was not frozen. Tether's contract lets it destroy blacklisted balances, a step that can precede reissuing them to a victim; no such burn has been recorded yet. The roughly 460,000 ETH is the largest block of value tied to this attack that no one can freeze, and whether it moves toward mixers, bridges or exchanges is the next onchain signal, as is whether the reported bitcoin can be traced to the attacker at all. Binance has promised a post-mortem, which is where the open causes belong: how a permission requiring Binance 14's own key was signed, and why other Binance wallets sent funds to the attacker. And for 3 minutes and 24 seconds before it was emptied, Binance 14 visibly ran someone else's code. The open question is whether a hot wallet's code changing becomes an alarm exchanges watch for.