29–30 October 2026 · Ethereum & beyond
The money moved.
The trail stayed.
Inside HackTrail’s pursuit of the suspected Binance hot-wallet drain: a night of token sales, fresh wallets and a race to follow the next transfer.
Channel updates from @BinanceHackTrail · checked 30 Oct · 02:41 UTC · source checks every 2 minutes
Follow the next move.
English dispatches from the public HackTrail channel ↗. Claims and estimates are attributed to the source; open each post for the full report.
Last source check: 30 Oct 2026 · 02:41 UTC
HackTrail: Tron: the TRX layering continues. A previously auto-tracked wallet forwarded almost its full balance to a new unknown…
HackTrail reports: 🧠 🔁 Tron: the TRX layering continues. A previously auto-tracked wallet forwarded almost its full balance to a new unknown address, one more hop in the chain. This could be preparation for an exchange, bridge or cross-chain swap, so the new address needs watching. Ethereum: the collector keeps dumping small-cap tokens via DEX, with no new outflow destinations.
Source: HackTrail · Last imported 30 Oct 2026 02:39 UTC
HackTrail: 02:37–02:38 UTC · sold ≈ $358K
HackTrail reports: 📋 02:37–02:38 UTC · sold ≈ $358K 💱 SUPER 1 143 554 ≈ $185K · PHA 2 436 828 ≈ $100K · OGN 2 163 932 ≈ $51K · RED 166 921 ≈ $22K 🟥 Tron: 1 678 603 TRX ≈ $601K: TXaqYL…FUX4 → TUgwcL…Nv6a [new] https://tronscan.org/#/transaction/fa6824224dac48025e89d144ecee491fc3b89eed1241b373211a58388bac6fd4
Source: HackTrail · Last imported 30 Oct 2026 02:39 UTC
HackTrail: 02:35–02:37 UTC · sold ≈ $301K
HackTrail reports: 📋 02:35–02:37 UTC · sold ≈ $301K 💱 PHA 4 547 125 ≈ $187K · OGN 2 436 832 ≈ $57K · G 9 987 252 ≈ $33K · RED 139 204 ≈ $18K · FUN 648 628 ≈ $4K · YFI 0.8698 ≈ $2K
Source: HackTrail · Last imported 30 Oct 2026 02:37 UTC
HackTrail: 02:33–02:35 UTC · sold ≈ $1.0M
HackTrail reports: 📋 02:33–02:35 UTC · sold ≈ $1.0M 💱 G 117 763 962 ≈ $391K · YFI 202.5022 ≈ $376K · PHA 3 317 760 ≈ $136K · RED 547 252 ≈ $71K · OGN 1 892 447 ≈ $45K
Source: HackTrail · Last imported 30 Oct 2026 02:35 UTC
HackTrail: 02:32–02:33 UTC · sold ≈ $1.1M
HackTrail reports: 📋 02:32–02:33 UTC · sold ≈ $1.1M 💱 YFI 290.531 ≈ $539K · PHA 7 436 425 ≈ $306K · G 26 377 038 ≈ $88K · OGN 3 508 029 ≈ $82K · RED 356 659 ≈ $46K
Source: HackTrail · Last imported 30 Oct 2026 02:35 UTC
HackTrail: 02:30–02:31 UTC · sold ≈ $433K
HackTrail reports: 📋 02:30–02:31 UTC · sold ≈ $433K 💱 G 58 940 031 ≈ $196K · PHA 2 319 022 ≈ $95K · YFI 35.408 ≈ $66K · OGN 1 816 142 ≈ $43K · RED 232 594 ≈ $30K · FUN 649 277 ≈ $4K
Source: HackTrail · Last imported 30 Oct 2026 02:33 UTC
HackTrail: 02:28–02:29 UTC · sold ≈ $491K
HackTrail reports: 📋 02:28–02:29 UTC · sold ≈ $491K 💱 G 104 632 216 ≈ $347K · OGN 2 744 509 ≈ $65K · PHA 1 293 282 ≈ $53K · YFI 7.3795 ≈ $14K · RED 93 362 ≈ $12K
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
HackTrail: 02:26–02:27 UTC · sold ≈ $150K
HackTrail reports: 📋 02:26–02:27 UTC · sold ≈ $150K 💱 OGN 3 036 571 ≈ $71K · PHA 789 791 ≈ $32K · YFI 14.7876 ≈ $27K · RED 60 610 ≈ $8K · G 1 982 466 ≈ $7K · FUN 649 927 ≈ $4K
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
HackTrail: 02:24–02:26 UTC · sold ≈ $416K
HackTrail reports: 📋 02:24–02:26 UTC · sold ≈ $416K 💱 NMR 30 926 ≈ $286K · OGN 1 774 199 ≈ $42K · YFI 17.7896 ≈ $33K · PHA 644 544 ≈ $26K · RED 172 072 ≈ $22K · G 1 834 625 ≈ $6K 🟥 Tron: 300 TRX ≈ $107: TXaqYL…FUX4 → TCWhYR…GuQP https://tronscan.org/#/transaction/bb78615b9107496a53538553f458b4b5001e31ccb0f707bb77a01af8e7ee7da3
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
HackTrail: Tron: the TRX storage made its first onward hop, to a new unlabeled address (unknown EOA), possibly staging for an exchange…
HackTrail reports: 🧠 Tron: the TRX storage made its first onward hop, to a new unlabeled address (unknown EOA), possibly staging for an exchange or bridge. Watch its next transfer. Ethereum: only routine token sales via DEX from the collector and a gas-funded helper; no new exit routes.
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
HackTrail: 02:20–02:21 UTC · sold ≈ $1.0M
HackTrail reports: 📋 02:20–02:21 UTC · sold ≈ $1.0M 💱 NMR 58 914 ≈ $546K · ENS 84 372 ≈ $397K · OGN 3 464 271 ≈ $81K · RED 59 237 ≈ $8K · FUN 1 302 459 ≈ $7K · G 536 369 ≈ $2K 🟥 Tron: 1 678 905 TRX ≈ $598K: TRBdWq…PRki → TYZ8AP…xFws [new] https://tronscan.org/#/transaction/1f2bc972b505b06c44b6d3582b48dec3d633c3a7ed8c097f26f4654423f0380e
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
HackTrail: 02:19–02:20 UTC · sold ≈ $76K
HackTrail reports: 📋 02:19–02:20 UTC · sold ≈ $76K 💱 OGN 1 522 392 ≈ $36K · NMR 2 432 ≈ $23K · ENS 1 827 ≈ $9K · RED 56 941 ≈ $7K · G 445 706 ≈ $1K
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
HackTrail: 02:17–02:18 UTC · sold ≈ $42K
HackTrail reports: 📋 02:17–02:18 UTC · sold ≈ $42K 💱 OGN 696 354 ≈ $16K · FUN 1 305 069 ≈ $7K · NMR 672.9898 ≈ $6K · RED 40 069 ≈ $5K · ENS 1 029 ≈ $5K · G 567 623 ≈ $2K
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
HackTrail: 02:13–02:15 UTC · sold ≈ $125K
HackTrail reports: 📋 02:13–02:15 UTC · sold ≈ $125K 💱 AXS 123 006 ≈ $105K · OGN 376 967 ≈ $9K · NMR 577.8721 ≈ $5K · CFG 38 685 ≈ $4K · RED 16 669 ≈ $2K
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
HackTrail: 02:12–02:13 UTC · sold ≈ $408K
HackTrail reports: 📋 02:12–02:13 UTC · sold ≈ $408K 💱 AXS 458 934 ≈ $390K · NMR 783.1117 ≈ $7K · CFG 58 027 ≈ $5K · OGN 111 079 ≈ $3K · RED 17 696 ≈ $2K
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
HackTrail: What has been sold
HackTrail reports: 💱 What has been sold Before the freezes, ~525M USDT on Ethereum was swapped into ETH through UniswapX and RFQ venues. More USDT went into Aave as collateral for a ~19.8K ETH loan. On Tron, ~234M USDT was turned into ~638M TRX on SunSwap. After that came a steady dump of tokens through Uniswap and DEX aggregators. Since our monitoring began (29 Oct, 22:16 UTC), the 25 largest tokens sold add up to about $190M at current prices: ENA ~$37M (all ~217M ENA, sold around $0.16) PEPE ~$33M, UNI ~$20M, LINK ~$16M, AAVE ~$15M USDe ~$9M, ONDO ~$8M, WLD ~$6M, ZRO ~$5.5M, RSR ~$4.7M Also sold: MORPHO, GTC, FET, PENDLE, SAND, CRV, SHIB, EIGEN, ZAMA, ETHFI, LDO, COMP, 1INCH, SNX, QNT and others. Earlier sales included WBTC (~$13M) and ~48M of the 88.5M RLUSD. Selling is still going on, at roughly $0.3–3.5M every couple of minutes (USDe, BNB, 1INCH, LDO, COMP and others). Actual proceeds are lower than these figures because of slippage. The proceeds are consolidated into ETH. ~$3.3M of BEAM was burned, which looks like a bridge transfer to another chain. This is unverified. 🏦 Where the money is now (30 Oct, 02:07 UTC) Ethereum: ~494K ETH (~$1.08B) across 37 addresses 0x8532…43d4: 197K ETH, storage, untouched 0xc887…286a: 138K ETH, proceeds of USDT→ETH 0x897c…8df3: 78K ETH 0x5440…c942: 33K ETH, RLUSD proceeds, still receiving 0x5227…2f8c: 11K ETH, the original collector Bitcoin: 18.3K BTC (~$1.4B) on 20 addresses, not moved Tron: 685M TRX (~$245M) on 5 addresses, plus 379M USDT frozen This is a shortened source excerpt; open the channel post for the complete analysis.
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
HackTrail: Binance hot wallets drained on four chains: about $5.8B in 12 minutes
HackTrail reports: 🔎 Binance hot wallets drained on four chains: about $5.8B in 12 minutes On 29 October 2026, between 20:10 and 20:22 UTC, Binance hot wallets on Solana, Bitcoin, Ethereum and Tron were emptied to fresh addresses. Arkham groups the attacker's ~70 addresses into one entity, "Binance Hacker", worth about $5.7–5.9B at market prices. HackTrail follows that money on-chain, minute by minute. 💰 What the attacker holds now: ≈ $5.6B • ≈ $3.1B can still be moved: BTC $1.40B · ETH $1.08B · other tokens $0.27B · TRX $0.24B · SOL $0.09B • ≈ $2.55B is frozen (USDT, USDC) (at market prices, 30 Oct 02:20 UTC; tokens net of the attacker's Aave debt) ⏱ Timeline (UTC, 29 Oct) 20:10 Solana 968K SOL left hot wallet 5tzFkiKs… for AffzF…gEaU. 20:20 Bitcoin, block 973732 18.3K BTC (~$1.4B) left bc1qm34l…7s3h in 11 transactions to bc1q0mtc…2mnm. In the same block it was split into ~1,000 BTC chunks across 19 addresses. 20:20–21:44 Ethereum ETH, ~60 tokens and 823M USDC were taken from Binance 14 (0x28C6…1d60). Another 28K ETH came from Binance 16. Everything was gathered at the collector 0x5227…2f8c. Binance 14 was drained three times: 20:24, 21:04 and 21:44. 20:20–20:22 Tron 612.7M USDT and 46.4M TRX left TDqSquXB… for TG5i…zsGi. 🛠 How it was done The Ethereum part used EIP-7702, which lets an ordinary wallet delegate its execution to a smart contract. The attacker sent one transaction carrying 50 pre-signed authorizations This is a shortened source excerpt; open the channel post for the complete analysis.
Source: HackTrail · Last imported 30 Oct 2026 02:30 UTC
The archive closes; the trail remains open
At 01:31 UTC on 30 October, the final message in the supplied HackTrail export reports another batch of token sales, including CRV, SHIB, USDe and GTC. Earlier alerts describe ETH moving into watched storage wallets. The archive ends without establishing a final cash-out or recovery. Later public-channel dispatches appear above this historical checkpoint.
Source: HackTrail · Last imported 30 Oct 2026 02:32 UTC
The money does not disappear in one move. It changes form, splits into branches and gathers again. Across one night of alerts, HackTrail turns that movement into a story you can follow—without pretending every gap in the trail has been closed.
This account condenses the supplied HackTrail chat history. Wallet roles, incident attribution and transaction interpretations are the bot’s findings unless stated otherwise.
29 Oct · 22:21 UTC · Opening report
01 The night begins with a balance.
There is no quiet opening. The supplied history begins with an alert subscription and a watchlist already carrying 351,468 ETH across 23 Ethereum addresses. HackTrail describes the trail as proceeds of a suspected Binance theft. Its collector label points back to transfers of 167,464 ETH from Binance 14 and 28,005.6 ETH from Binance 16. Those origin transfers precede the exported conversation; they are background reported by the bot.
The screenshot above gives the story its first striking image: a wallet holding roughly 195,469 ETH alongside dozens of tokens. Then the question changes. Where will the money go next?
Evidence for this chapter
Source: supplied Telegram export, messages 1125478–1125479. Times below refer to bot reports unless the text specifies transaction time.
29 Oct · 22:22–22:25 UTC · Bot reports
02 The tokens start turning into ETH.
PEPE moves first in the exported alerts. HackTrail reports roughly 163.8 billion tokens sold in three trades, with the seller’s ETH balance rising by about 316 ETH. Another burst brings roughly 104 ETH. In parallel, a UNI wallet sells about 155,900 UNI and adds roughly 426 ETH. Different tokens, the same destination: liquid ETH.
Then a much smaller transfer raises a different question. A wallet sends 0.2 ETH to a LI.FI bridge contract. HackTrail interprets it as a possible route test, but the destination chain and recipient are absent from the report. A bridge call is visible in the supplied evidence; the intended escape route remains a hypothesis.
Evidence for this chapter
Source: supplied Telegram export, messages 1125480–1125487. Times below refer to bot reports unless the text specifies transaction time.
29 Oct · 22:44 UTC · Bot report
03 A zero-value call, an unanswered question.
The suspected operator calls Binance 14 with a value of zero ETH and the selector 0x8a179be4. The bot reports that the transaction succeeded and that EIP-7702 delegation was still active. Zero value does not settle what happened inside the call.
HackTrail explicitly asks for the transaction’s transfer logs. It suspects another sweep-style operation, but the alert does not establish which assets, if any, left Binance 14 in that call. The mechanism is the lead; the missing logs are the unfinished work.
Evidence for this chapter
Source: supplied Telegram export, messages 1125488–1125489. Times below refer to bot reports unless the text specifies transaction time.
29 Oct · 22:47–22:53 UTC · Bot reports
04 An assembly line emerges.
The collector seeds fresh wallets with about half an ETH for gas. Next come the assets: roughly 2.57 million LINK, 167.14 WBTC and 127,953 AAVE are distributed to separate branches. HackTrail spots the pattern: fund a wallet, deliver a token, prepare the sale.
UNI sales accelerate. The bot reports roughly 2.82 million UNI sold during one transaction window and the seller’s ETH balance rising to 17,584 ETH. Then almost all of that ETH moves to 0x897c…8df3. HackTrail adds the receiving wallet to the trail. It calls this likely consolidation, not proof of a mixer, bridge or exchange deposit.
Evidence for this chapter
Source: supplied Telegram export, messages 1125490–1125500. Times below refer to bot reports unless the text specifies transaction time.
29 Oct · 22:53–23:05 UTC · Bot reports
05 Even the watcher has to question its map.
The liquidation spreads across PEPE, AAVE, LINK, ENA and USDe. ONDO arrives at the wallet previously selling UNI. What looked like separate token stories starts to look like one coordinated workflow.
The bot also catches its own limits. Some transaction windows are incompletely indexed; some transfer events fall outside a polling range. A reverted multicall is identified as a failed attempt, not a completed sale. Old wallet labels fall behind new behaviour. These caveats matter: a growing ETH balance is not a complete ledger of where every coin came from, and adding successive snapshots would count the same money again.
Evidence for this chapter
Source: supplied Telegram export, messages 1125501–1125571. Times below refer to bot reports unless the text specifies transaction time.
29 Oct · 23:13–23:39 UTC · Bot reports
06 Fresh addresses. The same choreography.
ONDO replaces UNI in one selling branch. SAND moves to a Safe, following an earlier SNX branch noted by the bot. FUN reaches a gas-funded wallet; WLD selling appears at another. A 5,700 ETH transfer leads to 0x79e7…544a after an earlier balance anomaly had left the movement unclear.
The operator returns with the same function selector. Again, the bot asks whether more assets were swept rather than treating the call itself as proof of another loss. Meanwhile the sales continue. The investigation’s rhythm becomes relentless: identify the branch, follow the proceeds, watch the next recipient.
Evidence for this chapter
Source: supplied Telegram export, messages 1125572–1125595. Times below refer to bot reports unless the text specifies transaction time.
29 Oct 23:40 – 30 Oct 00:11 UTC · Bot reports
07 The first decisive change in the control trail.
ENA, WLD, USDe, FUN and USDC continue to appear in the sale reports. Then, at 00:11:03 UTC, HackTrail reports that the EIP-7702 delegation at Binance 14 has changed from delegated code to empty code: revoked.
That is a change at the watched wallet, not a recovery of assets already moved. Within the same reporting minute, a gas-funded address receives roughly 87.85 million ZAMA. The trail has entered another phase: closing one control path does not close the pursuit of the money.
Evidence for this chapter
Source: supplied Telegram export, messages 1125596–1125615. Times below refer to bot reports unless the text specifies transaction time.
30 Oct · 00:13–01:00 UTC · Bot reports
08 The sellers begin feeding new reservoirs.
ZAMA, ZRO, RSR, PROM and MORPHO move through the expanding network. HackTrail repeatedly recognises the earlier signal: a small gas payment, followed by a much larger token allocation. Later reports show further sales, though a transfer into a branch does not itself prove that token was sold.
The PEPE branch sends 14,040 ETH to 0x79e7…544a. Another destination, 0x8d4b…9e19, receives about 805 ETH and then 2,156 ETH from separate sellers. A further 15,292 ETH moves from the wallet labelled for WBETH to 0xc887…286a. HackTrail suspects broader consolidation; its explanation that WBETH was converted remains an interpretation, not something the transfer alone proves.
30 Oct · 01:01–01:31 UTC · Final exported reports
09 A bigger watchlist. An unfinished chase.
At block 26,302,148, the bot reports 37 Ethereum addresses holding 479,979 ETH. It also lists 18,270.20 BTC across 20 Bitcoin addresses, 684,584,013 TRX and 378,719,468 USDT across five Tron addresses, and 970,544 SOL at one Solana address. These are separate historical watchlist balances, not a verified theft total.
The export keeps running after that checkpoint. RSR sales continue; FET, PENDLE, CRV, SHIB and GTC appear in later batches. ETH flows into already watched storage wallets. At 01:31 UTC the supplied history stops with another sale report. The last pages do not establish a final cash-out, recovery or identity. They leave a network of addresses—and the next transfer still to catch.
FOLLOW THE NEXT MOVE
A brilliant investigation, unfolding transaction by transaction.
HackTrail makes the chase legible: it connects the small gas transfer to the next token sale, follows the proceeds, and asks what the next address might reveal. The supplied history shows the value of patient, relentless analysis while the money is still moving.
Watch HackTrail on Telegram ↗Sources & method
This dossier reviews all 193 messages in the user-supplied 30 October Telegram export, including 191 messages displayed under the sender name “Monitor”, supplied by the owner as the history of @hacktrailbot. Repeated sale alerts are condensed into nine chapters; commands are excluded from the narrative. This is an editorial retelling of that source, not an independent determination of theft, ownership or responsibility. Supplemental illustrations supplied later by the owner include two Speculation Lab analyses and an earlier risk-message screenshot attributed to CZ. They are captioned separately from the bot narrative, with source caveats and time-zone notes.
All narrative times use UTC. The Telegram export displays Moscow time (UTC+3). Report times can lag the underlying transactions. Balances are snapshots across a changing watchlist; their difference is not an estimate of new theft. Cross-chain holdings are reported separately and are not added to ETH.
The image is supplied by the site owner. Explorer links are preserved from the export; the linked transactions have not all been independently re-audited. The original private chat, personal sender name and account metadata are not published.
Historical reference: HackTrail Bot · Collector wallet on Etherscan ↗