Tracing the $6.3 Billion Binance Hack — AML Chase Has Just Begun

November 1, 2026

The full picture of the $6.3B Binance hack in four facts:

Tornado Cash funded the operator over 36 hours before the sweep. Just 204 seconds separated the wallet takeover from the drain.
Within 41 minutes of the sweep, Tether and Circle froze about $2B in stablecoins.
AnChain.AI examined 122 transactions across 10 chains. The FBI attributed the theft to North Korea’s TraderTraitor.
As of Nov. 2, about $3.24B remained in theft-linked wallets, mostly ETH and BTC. The AML chase has just begun.

Two transactions, 204 seconds apart

It's a well crafted attack against Binance Ethereum assets. As simple as 2 transactions shortly apart, which wiped out billion dollars of crypto assets instantly and shocked the industry.
At 20:20:59 on October 29, 2026, the hacker submitted 0xad99264d…d051298b. Its value field read 0 ETH. Inside were 50 signed EIP-7702 authorizations, each naming the same sweeper contract and a different nonce, Ethereum’s transaction counter. All 50 signatures identify Binance 14 as the signer. Only nonce 18,914,809 matched the wallet’s counter. That one match allowed the contract to execute with the wallet’s permissions.

At 20:24:23, the hacker then called Binance 14 in 0x53bd38b8…0e88e2f3. The execution trace shows 167,464 ETH moving to the collector. In the same receipt, log 519 from the Ethereum USDT contract records 1,615,409,498,973,240 base units. With six decimals, that is 1,615,409,498.973240 USDT sent to the same address.

The collector also received funds from Binance 16. At 20:38:47 it forwarded 195,460 ETH to an address later listed by the FBI (0x551d7961…b1b02c76). That was a second hop. Adding it to the stolen total would count the same ETH twice.

EIP-7702 specification · Archived sweep receipt · FBI address bulletin

Fig. 1. The operator rehearsed on three wallets. Once installed on Binance 14, the delegation persisted for nearly four hours. Block reconstruction · Rehearsal transactions

One wallet and the multichain loss

Binance estimated its October 29 loss at $6.3 billion. An independent public reconstruction valued the theft at roughly $6.43 billion across 11 chains. Our initial estimate of $3.52 billion measured inflows to a single Ethereum collector over 40 minutes. Bitcoin and TRON hot wallets also sent ordinary signed transfers. EIP-7702 explains the takeover of Binance 14 specifically.

Binance incident update · AnChain.AI’s initial trace

Fig. 2. Breakdown of the Binance lost assets in Oct 2026. Other assets include native ETH, XRP and SOL.

Tornado Cash funded the operator before the theft

Three withdrawals from Tornado Cash’s 0.1 ETH pool paid about 0.294 ETH after fees to the operator. Two arrived on October 28 (0xd9e59064…4fe59008, 0xa79503c2…4281221a) and one on October 29 (0x18ae9a75…2d8b1cae). The same address later submitted the delegation and the sweep. A withdrawal identifies who received ETH, while the pool’s zero-knowledge proof conceals which earlier deposit funded it.

These transactions funded preparations. In the records reviewed through November 1, we found no verified post-theft deposit of Binance proceeds into Tornado Cash.

Where stolen funds crossed chains

Relay. A published bridge match pairs the October 31 TRON deposit 55abdfbd68…de816070 at 15:22 UTC with the Ethereum payout 0x9a3dbf99…e9584d8a. The pair is a lead that can be checked on both networks.

THORChain. At 03:55:45 on October 30, a TRON request to swap 15,800 USDT named the Ethereum recipient 0x15104a9c…5fe0feb7 in its memo (109b6b6aa3…186cdde2). By 06:20, published tracing had linked five payouts totaling 13.63 ETH from Binance and eight totaling 349.46 ETH from the earlier Bitget theft to that address. When the wallet sent 61 ETH onward in 0xad7af2e6…30935d7f, its balance already contained funds from both sources. The Binance share of that payment remains unknown.

Check refunds before counting a bridge transfer. A separate 99,998 TRX request at 03:43:09 (196cce3479…0cc6976d) succeeded on TRON. At 04:08:36 a refund returned 98,315.94809 TRX and named the original hash in its memo (93eef62870…b9c0d9e1). A successful source-chain receipt alone cannot establish that ETH reached the requested destination.

THORChain memo specification · Relay order lookup · Published analysis of the shared payout wallet

Fig. 3. Each row follows a separate trail. The THORChain amounts are totals for multiple payouts to one Ethereum address.

‍

What the FBI attributed to North Korea

On October 31, the FBI attributed the theft to North Korea’s TraderTraitor. A shared payout wallet connects the laundering of the Binance and Bitget proceeds. It cannot identify the person who gained access to Binance’s signing system. Binance reported multiple breach points and said it had found no evidence of a private-key leak.

FBI attribution and addresses · Binance statement

What investigators and custody teams can verify

Replay the delegation. Compare the wallet’s code at Ethereum blocks 26,300,752 and 26,300,753. The latter contains the delegation marker 0xef0100 followed by the sweeper address. Recover the authorization signer separately from the sender that paid the gas.
Reconcile each bridge. Preserve the inbound hash, decoded memo or order, payout and any refund. Record a requested destination separately from a confirmed receipt.
Contain a compromised wallet. Reject unexpected delegations at signing time, alert on changes to wallet code and suspend incoming funding until the delegation clears. Binance 14 cleared its delegation at 00:10:35 on October 30 (0xafbf94c9…8dac7209).

‍

The AML race to stop the cash-out

It was a a remarkable success that the crypto industry acted fast this time to freeze $2 billion in stablecoins:

- At 21:01:35 UTC, about 37 minutes after the stolen USDT reached the main Ethereum collection address, Tether blacklisted it and froze 1.18 billion USDT.

- At 21:04:59 UTC, Circle blacklisted the same address while it still held 823 million USDC. Tether transaction · Circle transaction

Within hours of the theft, AnChain.AI published the collection address and explained how the attacker gained control of Binance 14. Two days later, the FBI attributed the theft to North Korea’s TraderTraitor. Together with the U.S. Secret Service and IRS Criminal Investigation, it urged operators to block transfers tied to the published addresses. AnChain.AI investigation · FBI bulletin and address list

As of November 2, an estimated $3.24 billion remained in theft-linked wallets, mostly in ETH and BTC. Those balances give investigators a place to follow the next transfer. Establishing who controls the keys or whether any funds have been sold off-chain requires additional evidence. November 2 balance estimate

AI can help attackers find and test vulnerabilities faster. Whether it played a role in the Binance breach remains unknown. For defenders, the opportunity is to shorten mean time to respond (MTTR), a priority AnChain.AI outlined at the 2023 RSA Conference Innovation Sandbox. An AI agent can trace the next transfer, check the token contract and balance, and put the transaction hash in an investigator’s hands while the issuer can still freeze the funds. RSA Innovation Sandbox talk · Research on AI-assisted attacks

AML Chase Has Just Begun

- Follow our agents on AnChain.AI News.

- To investigate a lead, paste a transaction hash into AnChain.AI Insights and ask Tracer, “Where did the funds go next?”

‍

Disclaimer. This article is for technical education only and does not provide legal or financial advice. The transaction data, address labels, and tracing conclusions may be incomplete or inaccurate. Always consult a qualified blockchain forensics professional before taking legal or financial action based on this analysis.

‍Appendix: AnChain.AI curated Binance hack addresses & txn

Below are samples of the 122 transactions across various blockchains that AnChain.AI team were able to attribute as of today.

Full data is is free upon request: info@anchain.ai

55 addresses identified in the case records

122 transactions across 10 blockchains

‍