Binance CEX hack fund tracker
2026-10-29 · about $5.78B taken · Hot Wallet Key Compromised
Added soon after the hack from DefiLlama’s record. Etherscan hasn’t tagged an attacker wallet yet, so we follow the wallet that first received the funds taken from the hot wallet, found from public on-chain transfers. Figures may change as more is known.
What the hacker is doing
Updated 7m ago. Sales are counted once per transaction; proceeds are the ETH and stablecoins that came back, valued at $2,226 per ETH.
| Coin sold | Amount | Proceeds |
|---|---|---|
| USDT | 335,045,123 | $280.2M |
| RLUSD | 48,000,000 | $45.6M |
| UNI | 7,018,792 | $39.1M |
| ENA | 217,497,348 | $34.0M |
| PEPE | 7,772,977,017,416 | $31.3M |
| LINK | 2,574,848 | $25.8M |
| AAVE | 128,034 | $14.1M |
| WBTC | 167 | $12.4M |
| USDe | 9,707,547 | $6.8M |
| ONDO | 21,851,871 | $6.5M |
| WLD | 17,317,869 | $6.1M |
| ZRO | 3,601,631 | $4.8M |
Latest moves
| When | What | Amount | Tx |
|---|---|---|---|
| 11m ago | Sold RAD on a DEX | 700,568 | view |
| 12m ago | Sold RAD on a DEX | 58,561 | view |
| 13m ago | Sold RAD on a DEX | 18,326 | view |
| 13m ago | Sold FUN on a DEX | 585,837 | view |
| 14m ago | Sold RAD on a DEX | 34,811 | view |
| 15m ago | Sold RAD on a DEX | 2,444 | view |
| 15m ago | Sold FUN on a DEX | 586,423 | view |
| 16m ago | Sold RAD on a DEX | 32,685 | view |
| 17m ago | Sold RAD on a DEX | 54,089 | view |
| 18m ago | Sold RAD on a DEX | 93,845 | view |
| 18m ago | Sold FUN on a DEX | 588,188 | view |
| 19m ago | Sold RAD on a DEX | 70,008 | view |
The network is the first wallet to receive the funds plus new wallets it funded after the hack (each first active after 20:24 UTC on Oct 29 and funded by the hacker). Swapping to ETH or stablecoins on a DEX is not the same as cashing out; we flag mixers and exchanges separately.
When the funds moved
All $185.0M of transfers out happened in 2026-10. Nothing of $10K or more has left these wallets since.
Funds trail, step by step
| Step | Went to | Value |
|---|---|---|
| 1st hop | Contracts | $185.0M |
Amounts are net and valued on the day of each transfer: anything that came back from the same address (swap round trips, flash loans, refunds) is subtracted. “Contracts” are smart contracts such as swap services, bridges and other apps without a public label in our lists; “plain wallets” are ordinary addresses. Stolen funds often move through many of both, and through other chains we don’t follow.
Wallets that received the most
Receiving funds doesn’t mean the owner was involved. Receivers include exchanges, swap services, bridges and, in some cases, the victim protocol itself.
| Wallet | Received from tagged wallets | ETH there now |
|---|---|---|
| 0x77edef…2ac3eb contract | $185.0M | 0.01 |
Latest transfers out of the attacker wallets
| When | Coin | Amount | Value then | To |
|---|---|---|---|---|
| 2026-10-29 7h ago |
ETH | 23,314 | $55.0M | Contract |
| 2026-10-29 7h ago |
USDT | 130,000,000 | $130.0M | Contract |
What the attacker wallets still hold
| Coin | Amount | Value now |
|---|---|---|
| USDT | 1,350,464,585 | $1.35B |
| ETH | 500,937 | $1.12B |
| USDC | 823,033,005 | $823.0M |
| XAUt | 12,574 | $50.1M |
| RLUSD | 40,541,065 | $40.5M |
| USD1 | 27,824,040 | $27.8M |
| PAXG | 1,907 | $7.6M |
| FUN | 583,276,570 | $1.5M |
Stablecoins are valued at $1 even if the issuer has frozen them.
Tagged attacker wallets (32)
| Wallet | ETH now |
|---|---|
| Binance Hack: Linked Wallet 6 (funded by the hacker, hop 1) | 197,460.00 |
| Binance Hack: Linked Wallet 28 (funded by the hacker, hop 2) | 137,602.00 |
| Binance Hack: Linked Wallet 27 (funded by the hacker, hop 2) | 78,415.25 |
| Binance Hack: Linked Wallet 29 (funded by the hacker, hop 2) | 32,953.57 |
| Binance Hack: Linked Wallet 30 (funded by the hacker, hop 2) | 19,740.00 |
| Binance Hack: Receiving Wallet 1 | 17,263.27 |
| Binance Hack: Linked Wallet 13 (funded by the hacker, hop 1) | 11,560.92 |
| Binance Hack: Linked Wallet 31 (funded by the hacker, hop 2) | 2,962.30 |
| Binance Hack: Linked Wallet 14 (funded by the hacker, hop 1) | 2,857.00 |
| Binance Hack: Linked Wallet 16 (funded by the hacker, hop 1) | 110.89 |
| Binance Hack: Linked Wallet 11 (funded by the hacker, hop 1) | 9.91 |
| Binance Hack: Linked Wallet 12 (funded by the hacker, hop 1) | 0.62 |
| Binance Hack: Linked Wallet 20 (funded by the hacker, hop 1) | 0.50 |
| Binance Hack: Linked Wallet 22 (funded by the hacker, hop 2) | 0.10 |
| Binance Hack: Linked Wallet 19 (funded by the hacker, hop 1) | 0.07 |
| Binance Hack: Linked Wallet 4 (funded by the hacker, hop 1) | 0.06 |
| Binance Hack: Linked Wallet 17 (funded by the hacker, hop 1) | 0.05 |
| Binance Hack: Linked Wallet 9 (funded by the hacker, hop 1) | 0.02 |
| Binance Hack: Linked Wallet 15 (funded by the hacker, hop 1) | 0.01 |
| Binance Hack: Linked Wallet 10 (funded by the hacker, hop 1) | 0.01 |
| Binance Hack: Linked Wallet 21 (funded by the hacker, hop 1) | 0.01 |
| Binance Hack: Linked Wallet 8 (funded by the hacker, hop 1) | 0.00 |
| Binance Hack: Linked Wallet 26 (funded by the hacker, hop 2) | 0.00 |
| Binance Hack: Linked Wallet 23 (funded by the hacker, hop 2) | 0.00 |
| Binance Hack: Linked Wallet 24 (funded by the hacker, hop 2) | 0.00 |
Showing the 25 largest of 32; all are included in the totals.
Hack date, amount and method: DefiLlama hacks database. Wallet followed: the first wallet to receive the funds taken from the hot wallet, found from public on-chain transfers (no Etherscan tag yet). Transfers read from the Ethereum blockchain, last updated 2026-10-30 04:15 UTC. Only ETH and tracked tokens are valued; transfers under $10K are left out. Information only. We don’t recover funds or identify people.
Questions
Where did the stolen Binance CEX funds go?
From the 32 wallets that first received the funds taken in the Binance CEX hack, we see $185.0M to contracts. Funds usually pass through further wallets after this first step, so this shows the first step only.
How much is still in the Binance CEX attacker wallets?
About $3.42B in ETH and tracked tokens, read from the blockchain on Oct 30, 2026 04:15 UTC.
How much was stolen in the Binance CEX hack?
DefiLlama's hacks database records about $5.78B taken on 2026-10-29.
Does Deep Blue Alpha recover stolen funds?
No. We show public on-chain transfers from the wallet that first received the stolen funds. We don't trace funds beyond what is shown, recover assets, or identify people.
