On October 29, 2026, roughly $6.3 billion left 17 Binance hot wallets across nine chains. The first stablecoin freeze landed 37 minutes after the main Ethereum sweep, and within 80 minutes issuers had frozen $2.64 billion of the stolen assets.

The incident in brief

The drain ran from about 20:04 to 23:56 UTC. On Ethereum, Binance’s hot wallet had signed an EIP-7702 delegation to the attacker’s code, so at 20:24:23 UTC one call was enough to sweep 167,464 ETH, 1.6 billion USDT and 62 other tokens to 0x5227…2f8c.

TRM Labs puts the total at $6.36B across 10 chains, including about $28M on Avalanche, and Elliptic at $6.43B across 11.

Binance first blamed a compromised engineer’s laptop and later said there had been additional points of breach. On October 31 the FBI attributed the hack to North Korea’s TraderTraitor group. As of October 30 the attacker still held about 508,000 ETH, 18,270 BTC, 233.5M XRP, 670M TRX and 970,000 SOL; its Ethereum stash wallets have received more since (see below). No issuer can freeze those, so we traced them.

Freezes: $2.73 billion across 631 addresses

Our freeze tracker reads every issuer’s blacklist events, across all major issuers and chains. For this incident it found 631 addresses frozen in connection with the hack, holding $2.73 billion.

We checked every freeze above $1M against its onchain transaction. Amounts are the balances frozen today.

Tether froze 0x5227…2f8c at 21:01:35 UTC, 37 minutes after the sweep. By 21:44, 80 minutes after the sweep, issuers had frozen $2.64B, and by midnight $2.726B, of which $2.33B sat on Ethereum and $379M on TRON.

A frozen address can still receive, and this one kept doing so. Tether’s first freeze caught $971M of USDT on the receiver, but the compromised Binance wallet then sent it another $204M at 21:04 and 21:44 UTC. That money arrived already frozen, which is why the receiver’s frozen USDT reads $1.18B today.

We matched them against the FBI’s published TraderTraitor list for this hack and against our own threat-intel attribution.

We keep pre-emptive bans separate from real freezes. On November 2, Agora blacklisted all 608 FBI-listed addresses on both Arbitrum and Base, 1,216 bans in all, before any AUSD had reached them. These froze no money, so our totals record the bans without adding them to the dollar figure.

Freezes kept arriving for a week. As the attacker’s funds reached new wallets, Tether, Circle and Paxos froze them on Ethereum and TRON, in amounts from small sums up to about $570K each. The last one, $122K of USDC, landed on November 6 at 04:47 UTC, and as of November 9 at 12:11 UTC there have been no new hack-related freezes.

The freezes that missed by seconds

At 20:33 UTC, 28 minutes before the first freeze, 200M USDT went from the receiver to a fresh wallet and then on through four more. Tether blacklisted each wallet in turn:

Of the 200M, 30M was frozen at the end of the chain, about 110M was swapped for ETH on decentralized exchanges, and 60M went into Aave, where a USDT freeze can’t reach it. Only the final $30M counts toward the $2.73B.

Fund flows: following what couldn’t be frozen

The day after the hack, we traced the Ethereum dispersal from the receiver to eight stash wallets, which now hold about 522,400 ETH. Every stash balance reconciled with the traced inflows, and as of November 10 none of them has sent a single transaction. Our forward-hop tracker keeps watching these wallets, so their first outgoing transaction will surface as soon as it happens. We also found the live laundering paths: TRON wallets swapping TRX into USDT through SunSwap into freshly funded wallets, and a commingling wallet fanning ETH out to new addresses.

How Webacy keeps pace with a moving attacker

Freezes only reach stablecoins. Our technology is built to track risk as fast as the money moves:

• Ingesting vast amounts of data, with validation. We pull in multiple intelligence sources, including industry blocklists and issuer freezes read straight from the chain. Before anything is tagged, we check it against the chain, so pools and token contracts aren’t mislabeled as the attacker.
• Forward-hop tracking. The tracker follows money out of confirmed attacker wallets.
• Taint scoring on the receiving side. Each receiving wallet gets a taint score, so a mule scores high and a dusted bystander scores low.
• Behavioral monitoring. We train models on malicious money movement to predict risk, rather than solely reacting.
• A human in the loop. The tracker proposes and a person approves when a decision is necessary.

Where the pressure went: DeFi vault runs

Stablecoin pegs barely moved, and our depeg monitor correctly stayed quiet. USDT dipped from about 0.9990 to a low near 0.9980 between 02:00 and 03:00 UTC on October 30, and USDC from 0.9995 to 0.9987. Both stayed in our "normal" tier throughout.

The pressure showed up in DeFi lending vaults instead, where several USDC vaults on Morpho lost about half or more of their deposits within two days:

Source: Morpho public API, 05:00 UTC October 29 vs 05:00 UTC October 31.

Across the vaults we rate, 31 fell below a critical level of deposits withdrawable within two days of the hack, 26 of them on Morpho. In our liquidity-mismatch measure, the number of vaults whose available cash fell short of the critical level of deposits or their largest depositor’s position rose from 82 to 102. As markets pinned at full utilization, borrow rates climbed, and Pendle Ecosystem High Yield USDC’s APY went from 6.1% to 20.8%. During a run, a sudden jump in yield is a red flag.

The same thing happened on Solana. Within two hours of the Ethereum sweep, Kamino’s main USDC lending reserve went from 91% to 99% utilization as its deposits fell from $132M to $120M, and its supply rate jumped from 4.4% to as high as 38%. USDC vaults that lend into it, including Solflare’s, Squads’ and Solana Mobile’s, showed yields near 38% on October 30. Deposits came back over the following day, and by 21:00 UTC on October 30 the rate was back to about 3%.

Our exit-liquidity signal measures how much of a vault depositors could withdraw right now, and it tracked the run as it happened. Pendle Ecosystem High Yield USDC fell from 0.45 to 0.035 (illiquid) on the night of the hack, and RockawayX hit 0 on the morning of October 30. On Aave v3 Ethereum, the USDT pool’s withdrawable cash fell from $236M at 23:00 UTC on October 29 to $1,591 at 10:00 on October 30, against $2.47B of deposits. The pool had reached 100% utilization: every dollar supplied was lent out, so nothing could be withdrawn until borrowers repaid.

Aave moved quickly as well. After an attacker wallet supplied 60M USDT and borrowed about 19,760 WETH (about $44.6M), its guardian multisigs froze 175 V3 reserves across 16 networks and 117 V4 reserves across 4 networks between 21:42 and 23:04 UTC (Aave governance forum). The V3 reserves were unfrozen around 12:26 UTC on October 30. A frozen reserve accepts no new deposits or borrows, but the existing positions and their risk are still there.

The attacker became an Aave lender

The wallet that supplied that USDT was 0x8d53…639a, the second hop in the chain above. It supplied 10M USDT at 20:57:59 and 50M at 21:00:11. Tether blacklisted it at 21:02:47, but by then the 60M had become aUSDT, Aave’s deposit token, which a USDT blacklist doesn’t touch. So for the rest of the run on the pool, one of its larger lenders was the attacker, holding a claim bigger than all the cash left in it. On November 4 at 14:49 UTC the position was partly liquidated and 24.4M of the attacker’s aUSDT was liquidated.

Why use Webacy in the next one

The same event froze $2.73B of stablecoins, pushed the rest through hundreds of fresh wallets and drained USDC lending vaults within hours. Webacy tracks all three in one place.

If you need wallet screening, freeze intelligence or vault and stablecoin risk monitoring in real-time, reach out to the Webacy team.