Breaking News
How Binance 14 was emptied through an EIP-7702 delegation
About $6.3B left Binance wallets on eight chains in about 40 minutes; Ethereum was the largest leg. Binance has confirmed the incident, paused withdrawals and says it will cover all losses. An attacker got Binance's hot wallet 0x28C6…1d60 to delegate its account code to a contract the attacker had deployed six hours earlier. One sweep() call then moved the wallet's ETH and 63 tokens to 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c, and the same delegated code reached a second Binance wallet for USDC. The attacker has not been identified.
Flow of funds
The technique
Timeline, UTC, 29 October 2026
Three 0.098 ETH withdrawals from the 0.1 ETH pool fund the attacker EOA, the last at 08:23 on the 29th.
0x19be…f2bf. Used only against the attacker's own test account.
Type-4 tx delegates test EOA 0x9C29…bB6B to the v1 contract with three authorizations at nonces 0, 1, 2. Only one is valid, which is the pattern reused later.
0x63e842B054Bd624a465454D533C33F573e9c6fAe, compiled with Solidity 0.8.28, hardcoding the attacker EOA as the only allowed caller.
Test EOA 0x43AE…04BD delegated to the final contract, then called three times to exercise the sweep path.
1.08 ETH arrives from 0xe4F9…74cd, enough for the large sweep transactions.
Type-4 transaction carrying 50 authorizations signed by Binance 14's key, nonces 18,914,775 to 18,914,824. The one at 18,914,809 matches the live nonce and is applied. Binance 14's account code now points to the attacker's contract.
sweep(0x5227…, tokens[]) from the attacker EOA. Binance 14 sends 167,464 ETH and 63 tokens, 1.615B USDT among them, to the hub in a single transaction. A few token calls revert but the transaction succeeds.
Binance 16, which has no delegation, signs its own transfer of 28,005.6 ETH plus about $108M in USDT, RLUSD, WBTC, UNI, XAUt, ENA, LINK and PEPE to the hub.
Hub sends 0.5 ETH gas, then 500M USDT to Splitter A and 200M USDT to Splitter B. Look-alike spam tokens are airdropped onto the same addresses minutes later.
Splitter A sells about 325M USDT through UniswapX Dutch orders and a filler at 0x3997…678e, receiving roughly 122k ETH. Splitter B sells 10M across Uniswap v2, v3 and v4 pools for 3,552 ETH.
195,460 ETH leaves the hub for 0x8532…43D4, which has not moved since.
Attacker EOA calls Binance 14 (selector 0x043ff9d2), whose delegated code calls execute on Hot Wallet 34 with an ERC-20 transfer: 780M USDC to the hub. Another 43M follows at 20:59:47.
Splitter B forwards 190M USDT and 3,552 ETH to Exploiter 3, which parks 60M USDT in Aave as collateral, borrows 19,762 WETH, and sends 130M USDT on. Exploiters 4 and 5 sell that USDT on Uniswap. 57,892 ETH ends at Exploiter 7 after four hops. Splitter A's 175M USDT reaches 0xAa24…54a0 and is frozen there.
Same call again. Binance 14 had received 1,700 ETH and $4.4M of tokens from its deposit sweepers in the meantime, and they go straight to the hub. The delegation is still live.
Tether blacklists the hub (975M USDT) and later 0xAa24…54a0 (175M), Circle blacklists the hub (823M USDC), and Tether blocks it on XAUt. All four are confirmed by reading the contracts. The 700M USDT that left in the first nine minutes was partly sold before the freeze.
A pending executeBatch from Binance 14 to Hot Wallet 34 sits in the mempool. At 21:22 the hub moves 88.5M RLUSD out; at 21:44 sweep 3 takes another 200.39M USDT and 370 ETH that Binance had just routed into Binance 14; at 21:46 and 21:49 UNI and PEPE leave the hub. Binance says it is investigating a potential security issue; CZ says it looks like a hack and expects users to be made whole.
Step by step
- Obtain signatures from Binance 14's key. An EIP-7702 authorization is a signature over
(chain_id, delegate address, nonce). Binance 14 sends thousands of transactions an hour, so the attacker had 50 consecutive nonces signed at once and let the one matching the live nonce apply. This points to access to Binance's signing path rather than a stolen raw key: with the key in hand, the attacker could have sent transfers directly and would not have needed a nonce bracket. - Deploy a private delegate contract. The contract accepts calls only from the attacker's EOA and offers a sweep that forwards the full ETH balance and the balance of each listed token. It was tested twice on throwaway accounts before use.
- Pay gas from a mixer-funded EOA. The type-4 transaction and every sweep were sent by 0x7C86…5CA0, funded with three Tornado Cash withdrawals. Binance 14 itself needed no ETH for gas.
- Reach the second wallet through the first. Hot Wallet 34 is a smart-contract wallet that lists Binance 14 as an operator. Because the delegated code executes with Binance 14 as
msg.sender, the attacker called itsexecuteandexecuteBatchto transfer 823M USDC. - Keep the tap open. A delegation persists until Binance 14 signs a new authorization pointing at the zero address. Deposits that Binance's own sweepers keep routing into Binance 14 were taken again at 21:04 and can be taken again.
- Beat the freeze. 700M USDT was split to two fresh addresses within nine minutes and 335M of it sold for ETH before Tether acted. ETH cannot be frozen; the rest of the USDT on the hub was.
Update, 30 October 01:55 UTC
Binance has confirmed the incident, paused deposits and withdrawals, and promised to cover every loss. The delegation on Binance 14 is gone. The tally has grown to eight or nine chains and roughly $6.3B, with about $3B of it frozen.
What Binance did
- 00:13 UTC: official post confirming a security incident, suspending deposits and withdrawals, pledging to cover all losses and publish a post-mortem. Yi He is the voice; Richard Teng has not spoken.
- 00:52 UTC: "the current verified total frozen amount is around $3 billion."
- Delegation revoked. Binance 14's account code read empty at block 26,302,414 (01:54 UTC). Between 22:55 and 23:07 Binance moved what was left in Binance 14 to its own wallet 0xA97b…8d10. Tether's blacklist on Binance 14 (22:06) still stands.
Two more chains
- XRP: 233.5M XRP (~$296M) from five Binance XRP wallets. TechFlow puts the first attempt at 20:04:52 UTC, failed, with a 185M XRP transfer succeeding eight seconds later. That makes XRP, not Base, the first leg. Not re-read here.
- Solana: 970,522 SOL (~$96M). Not re-read here.
- Tron also lost 46.4M TRX on top of the 612.7M USDT.
New freezes beyond Tether and Circle
- Arbitrum Security Council ran an emergency transaction moving 74,559,805 ARB and 8,425 ETH (~$30.5M) out of 0x3E2b…32d5 into an intermediary wallet. Only the Council or an Arbitrum DAO vote can release it. ZachXBT reported it first.
- Ripple froze RLUSD tied to the attacker; Yi He cited about $200M, one tracker says 40.5M RLUSD, no official number. The attacker had already swapped 36M RLUSD for 15,439 ETH.
- World Liberty Financial froze the 27.8M USD1 still on the hub; Paxos also froze, amount unstated.
- Aave froze V3 markets on Ethereum and Avalanche; Kamino paused SOL/BTC borrowing on Solana.
Where the ETH sits
- Exploiter 8 0x8532…43D4: 197,460 ETH.
- Exploiter 19 0xc887…286A: 137,602 ETH, from Splitter A (122,310 at 21:47) and Exploiter 14 (15,292 at 00:59).
- Exploiter 11 0x897C…8DF3: 57,892 ETH.
- The hub sold its wBETH, ENA, WBTC, UNI and PEPE and now holds 9,936 ETH plus the frozen stablecoins.
Attribution is still open. Blockaid's CEO calls the signing-path abuse "very, very similar" to Bybit; SlowMist says a private-key leak "may be involved"; no agency or forensics firm has named anyone.
Seven chains verified here, one signing system
Ethereum was the biggest leg, not the only one. Read directly from the Bitcoin, Tron, Ethereum, Arbitrum, Optimism, Base and Avalanche nodes, about $5.8B left Binance wallets between 20:16 and 20:41 UTC; XRP and Solana, reported by TechFlow and not re-read here, add about $390M. Only Binance 14 was taken over with EIP-7702. Every other wallet, on every other chain, signed its own outgoing transfer.
| Chain | Source wallet | Moved | First tx (UTC) | How it was signed | Where it is now |
|---|---|---|---|---|---|
| Ethereum | Binance 14, Binance 16, Hot Wallet 34 | 197,540 ETH + 64 tokens ≈ $3.71B | 20:24:23 | Binance 14 via EIP-7702 delegation; Binance 16 signed itself; HW34 via its operator | $2.22B frozen on the hub and 0xAa24…54a0; ETH parked and swapped across Exploiter 2–12 |
| Bitcoin | bc1qm34…j77s3h | 18,270.2 BTC ≈ $1.43B | 20:20:06, block 973,732 | Own key, 11 transactions in one block | Sent to bc1q0mtc…l2mnm, already split into fresh addresses in 1,000 BTC lots. Cannot be frozen. |
| Tron | Binance-Hot 7 | 612,729,468 USDT | 20:22:45 | Own key | 312.7M still on TG5iBMQP…zsGi and 66M on TCzBTkqn…7Y62, both blacklisted by Tether (21:09, 21:21). 199M reached TSUUVjys…DvZpx unfrozen; 33M sold on SunSwap. |
| Arbitrum | Binance 54 0xB38e…891d | 74,559,805 ARB + 8,425 ETH | 20:30:34 | Own key | Forwarded to 0x3e2b…32d5 at 21:36, then seized by the Arbitrum Security Council into a frozen wallet. |
| Avalanche | Four Binance wallets | 1,813,999 AVAX + 8,409,928 USDT ≈ $32M | 20:33:18 | Own keys | AVAX moved at 21:45 and USDT at 22:06 to 0x8035…c397 vanity addresses. Aave froze its Avalanche markets. Missing from most tallies. |
| Optimism | 0xacd0…435a | 44,231,858 OP ≈ $4.5M | 20:18:23 | Own key | Still on the hub. |
| Base | 0x3304…566a | 4,735,627 VIRTUAL ≈ $2.7M | 20:16:19 | Own key | Still on the hub. This was the first move of the night. |
Corrected opening timeline, UTC
4.74M VIRTUAL leaves Binance's Base wallet.
44.2M OP leaves.
18,270.2 BTC in eleven transactions, all in block 973,732.
Binance 14 delegated to the attacker's contract.
612.7M USDT leaves Binance-Hot 7.
Sweep 1, $2.5B. Binance 16 adds 28,005 ETH 24 seconds later.
74.6M ARB leaves Binance 54.
1.81M AVAX from four wallets.
780M USDC pulled from Hot Wallet 34.
Blacklists the hub. Circle follows at 21:04:59, XAUt at 21:11:23, Tron addresses at 21:09 and 21:21. Tether blacklists Binance 14 itself at 22:06:23.
What the pattern says
- The first three legs took 25 minutes, not four. Base to USDC spans 20:16 to 20:41, and sweeps of Binance 14 continued until 21:44. Bitcoin to the Ethereum sweep alone is 4 minutes 17 seconds.
- Nine wallets signed their own payout. Bitcoin, Tron, Binance 16, Binance 54, the Optimism and Base wallets and the four Avalanche wallets all have empty account code. No delegation, no contract bug. Their keys, or the service that signs for them, produced the transactions.
- EIP-7702 was used once, where it paid off most. Binance 14 holds the token inventory and is the operator of Hot Wallet 34, so delegating it gave one atomic sweep of 63 tokens plus a path to 823M USDC, and it keeps draining whatever Binance routes in.
- What a freeze could reach. Stablecoins, XAUt, USD1, RLUSD and the Arbitrum funds are locked, about $3B by Binance's count. BTC, ETH, AVAX, OP, SOL, XRP and the DEX-sold USDT, about $3.3B, cannot be frozen by anyone.
- Most public totals undercount. Trackers that stop at Ethereum, Bitcoin and Tron miss Arbitrum, Optimism, Base and Avalanche, about $70M together.
What the hub holds, and what is frozen
Checked directly against each token contract at block 26,301,149 (21:40 UTC) with eth_call, not from news. The hub still holds 1,708 ETH plus 63 ERC-20 tokens worth about $2.27B. Three of them are frozen by their issuers and account for 81% of that value. The rest is ordinary ERC-20 supply that no issuer can stop.
| Token | Balance | USD | Status | Check |
|---|---|---|---|---|
| USDT Tether USD | 1,175,464,711 | $1,173,868,430 | frozen | Tether blacklist, isBlackListed = true |
| USDC USD Coin | 823,000,000 | $823,000,000 | frozen | Circle blacklist, isBlacklisted = true |
| wBETH Wrapped Binance Beacon ETH | 29,934.01 | $75,948,297 | cannot be frozen | no issuer freeze; Binance can upgrade the proxy |
| XAUt Tether Gold | 12,574.05 | $50,487,187 | frozen | Tether block list, isBlocked = true |
| UNI Uniswap | 7,011,783.90 | $47,259,423 | moved out | 7.02M UNI sent to 0x42CD…7810 at 21:46, selling via ParaSwap |
| ENA Ethena | 217,318,151 | $41,423,447 | cannot be frozen | |
| PEPE Pepe | 7.77T | $38,474,106 | moved out | sent to Exploiter 12 (0x600d…8298) at 21:49 |
| LINK Chainlink | 2,568,257.37 | $28,738,800 | cannot be frozen | |
| USD1 World Liberty Financial USD | 27,824,040 | $27,766,750 | not frozen yet | frozen() = false, issuer can freeze and drain |
| AAVE Aave | 127,952.75 | $16,426,574 | cannot be frozen | |
| WBTC Wrapped BTC | 167.15 | $13,355,907 | cannot be frozen | no per-address freeze |
| USDe Ethena USDe | 9,707,547 | $9,696,412 | cannot be frozen | no blacklist on USDe itself |
| ONDO Ondo | 21,844,884 | $8,661,562 | cannot be frozen | |
| PAXG Paxos Gold | 1,906.67 | $7,664,823 | not frozen yet | isFrozen = false, Paxos can freeze |
| WLD Worldcoin | 17,317,869 | $6,832,419 | cannot be frozen | |
| FUN FunFair | 714,911,344 | $6,282,591 | cannot be frozen | |
| ZAMA Zama | 87,853,171 | $6,140,585 | cannot be frozen | |
| ZRO LayerZero | 3,601,631 | $5,942,691 | cannot be frozen | |
| RSR Reserve Rights | 3,382,160,847 | $5,118,900 | cannot be frozen | |
| PROM Prometeus | 911,984.83 | $5,043,276 | cannot be frozen | |
| MORPHO Morpho | 1,762,888 | $3,843,096 | cannot be frozen | |
| GTC Gitcoin | 14,457,610 | $3,517,768 | cannot be frozen | |
| FDUSD First Digital USD | 3,454,895 | $3,441,884 | not frozen yet | frozen() = false, issuer can freeze |
| FET Fetch.ai | 19,791,935 | $3,341,611 | cannot be frozen | |
| PENDLE Pendle | 1,680,933 | $3,042,488 | cannot be frozen | |
| ERA Caldera | 38,603,849 | $2,805,149 | cannot be frozen | |
| SAND The Sandbox | 58,397,344 | $2,647,181 | cannot be frozen | |
| CRV Curve DAO | 8,148,735 | $2,550,234 | cannot be frozen | |
| SOPH Sophon | 1,693,247,181 | $2,500,892 | cannot be frozen | |
| WLFI World Liberty Financial | 48,525,612 | $2,490,965 | cannot be frozen | |
| EIGEN Eigen | 13,171,428 | $2,464,993 | cannot be frozen | |
| NIL Nillion | 32,674,294 | $2,370,226 | cannot be frozen | |
| SHIB Shiba Inu | 499.09B | $2,360,703 | cannot be frozen | |
| ETHFI ether.fi | 3,414,721 | $2,151,899 | cannot be frozen | |
| LDO Lido DAO | 6,244,624 | $2,123,291 | cannot be frozen | |
| LSK Lisk | 9,258,136 | $1,824,590 | cannot be frozen | |
| COMP Compound | 81,714.32 | $1,733,978 | cannot be frozen | |
| RED RedStone | 11,955,690 | $1,690,299 | cannot be frozen | |
| 1INCH 1inch | 19,034,040 | $1,616,314 | cannot be frozen | |
| SNX Synthetix | 8,405,742 | $1,589,206 | cannot be frozen | |
| WETH Wrapped Ether | 668.13 | $1,518,698 | cannot be frozen | |
| LA Lagrange | 27,959,137 | $1,514,127 | cannot be frozen | |
| OGN Origin | 59,506,796 | $1,490,308 | cannot be frozen | |
| BNB BNB (ERC-20) | 1,936.94 | $1,382,924 | cannot be frozen | |
| QNT Quant | 7,412.11 | $1,379,393 | cannot be frozen | |
| AXS Axie Infinity | 1,547,423 | $1,368,363 | cannot be frozen | |
| CFG Centrifuge | 12,731,967 | $1,311,214 | cannot be frozen | |
| RE Re Protocol | 3,621,589 | $1,301,997 | cannot be frozen | |
| NMR Numeraire | 127,141.45 | $1,233,272 | cannot be frozen | |
| ENS Ethereum Name Service | 235,232.05 | $1,180,865 | cannot be frozen | |
| PHA Phala | 25,917,841 | $1,140,106 | cannot be frozen | |
| YFI yearn.finance | 569.27 | $1,128,556 | cannot be frozen | |
| G Gravity | 324,356,074 | $1,127,880 | cannot be frozen | |
| CVX Convex | 541,770.24 | $1,126,298 | cannot be frozen | |
| SUPER SuperVerse | 6,525,852 | $1,109,826 | cannot be frozen | |
| IMX Immutable X | 8,197,793 | $1,079,362 | cannot be frozen | |
| RAD Radicle | 4,067,615 | $1,075,942 | cannot be frozen | |
| APE ApeCoin | 8,815,019 | $1,024,728 | cannot be frozen | |
| USDS Sky USDS | 1,014,445 | $1,014,292 | cannot be frozen | no freeze function |
| PLUME Plume | 66,315,587 | $999,078 | cannot be frozen | |
| SYRUP Maple SYRUP | 5,779,551 | $887,138 | cannot be frozen | |
| COTI COTI | 68,849,376 | $684,760 | cannot be frozen | |
| RLUSD Ripple USD | 0.48 | $0 | moved out | 88,541,065 RLUSD left at 21:22, now at 0xE702…958d; Ripple can pause accounts, not paused at 21:34 |
Frozen outside the hub
| Where | Asset | Status | Detail |
|---|---|---|---|
| 0xAa24…54a0 | 174,999,872 USDT | frozen | 175M USDT went hub → Splitter A → 0x811f…e84C → here at 21:08. Blacklisted before it could be sold. Received 22 ETH of gas it can no longer use. |
| Splitter A, Splitter B, Exploiter 3 | 0 USDT | blacklisted | Tether blacklisted all three, but each had already passed its USDT on. The freeze landed on empty accounts. |
| Exploiter 3 · 0x8d53…639A | 60,000,152 aEthUSDT | locked in Aave | 60M USDT was supplied to Aave v3 as collateral and 19,762 WETH borrowed against it, then the ETH was forwarded. The USDT sits in Aave's pool, which Tether cannot blacklist; the position will be liquidated rather than recovered. |
| 0xE702…958d | 88,541,065 RLUSD | not paused | Left the hub at 21:22 and hopped twice in 11 minutes. RLUSD has pauseAccounts and clawback; Ripple had not used them at 21:34. |
| 0x8532…43D4, Splitter A, Exploiter 7 | 195,460 + 122,293 + 57,892 ETH | cannot be frozen | Parked ETH, ETH from selling 335M USDT on Uniswap, and ETH from selling 130M USDT plus the Aave borrow, now at 0xb171…c8c3 after four hops. |
Why the hub still shows $2.4B, and who this looks like
Read from the chain at block 26,301,207 (21:52 UTC). The hub holds 2,078 ETH and 61 tokens priced at about $2.39B. That number is not loot the attacker can spend. Most of it is frozen, and Binance is still feeding the wallet it lost.
Four reasons the balance is not falling
- $2.05B is frozen in place. 1,175M USDT, 823M USDC and 12,574 XAUt are blacklisted by their issuers. They show in the balance because a freeze stops outgoing transfers; it does not take the tokens away.
- Binance 14 is still delegated. Its account code still points at the attacker's contract, nonce 18,914,854 and climbing. Binance has not signed the authorization that would reset it.
- Binance keeps paying into the compromised wallet. Customer deposit addresses sweep ETH and USDT into Binance 14 every minute, and about 200M USDT arrived from inside Binance around 21:40. Sweep 3 at 21:44:11 took 200.39M USDT, 370 ETH and a dozen small tokens. Tether's blacklist only blocks the way out, so that USDT landed on the hub and froze there, which is why the frozen USDT grew from 975M to 1,175M.
- The $390M that nobody can freeze is being split out token by token. 7.02M UNI went to 0x42CD…7810, which has already started selling through ParaSwap. 7.77T PEPE went to "Exploiter 12" 0x600d…8298. 88.5M RLUSD has hopped three wallets. Etherscan now labels at least twelve "Binance Hot Wallet Exploiter" addresses.
A $5B figure seen on some trackers is not this address. It comes from adding every attacker wallet across chains, the BTC that left Binance, or airdropped spam tokens with fake prices.
Attribution: nothing public yet
As of 21:55 UTC, Elliptic, TRM Labs, Chainalysis, ZachXBT and the FBI have not named anyone. What follows is a reading of the behaviour, not a finding.
What matches Lazarus / TraderTraitor
- Signing infrastructure, not a contract bug. Bybit (Feb 2025) and WazirX (Jul 2024) both fell through compromised signers. Here, 50 authorizations carry Binance 14's own signature and Binance 16 signed its own payout.
- Two days earlier, Binance said it had blocked North Korean "Contagious Interview" attacks that lure staff into running malicious code during fake job interviews.
- Gas from Tornado Cash. The WazirX attacker was funded the same way; Elliptic attributed that case to North Korea.
- Hours of rehearsal with a private contract on throwaway accounts before the real call.
- The laundering playbook. Everything freezable is turned into ETH within minutes, split into numbered fresh wallets, with Aave used to borrow ETH against USDT that would otherwise be frozen. For Bybit, Elliptic called this the group's "characteristic pattern": 11,000+ wallets, then THORChain into BTC over ten days.
What does not fit, or cuts the other way
- EIP-7702 is new for a state actor. Until now it was drainer-gang territory, where most malicious delegations reuse one shared sweeper bytecode. This contract is custom, Solidity 0.8.28, single hard-coded caller.
- An insider cannot be ruled out. Binance 16 paid the attacker and went straight back to serving withdrawals, and 200M USDT was moved internally into a wallet that was already compromised. A group that owns the signing pipeline produces the same picture, so this is not evidence either way.
What would settle it: a statement from the FBI, Elliptic or TRM; ETH from the Exploiter wallets moving through THORChain into BTC over the coming days; or address overlap with the Chinese laundering network ZachXBT exposed on 6 October as having washed over $1B for Lazarus after Bybit.
Evidence ledger
| Claim | Status | Basis |
|---|---|---|
| Binance 14 is delegated to 0x63e8…6fAe | on-chain | Etherscan "Authority" field on 0x28C6…1d60; type-4 tx 0xad99264d… with 50 authorizations, one valid. |
| 0x63e8…6fAe was deployed by the attacker | on-chain | Creation tx 0x97408e75… from 0x7C86…5CA0 at 15:59:11 UTC; bytecode embeds that address as the sole caller. |
| Sweep moved $2.5B in one tx | on-chain | Tx 0x53bd38b8…: internal 167,464.25 ETH plus 63 ERC-20 transfers from Binance 14 to 0x5227…. |
| USDC came out of Hot Wallet 34 through Binance 14 | on-chain | Tx 0xdc102dd8… from the attacker to Binance 14; Transfer event 780M USDC from 0xEe7a…4055; HW34 shows execute/executeBatch calls from Binance 14. |
| Attacker EOA funded by Tornado Cash | on-chain | Three internal transfers of ~0.098 ETH from the 0.1 ETH pool on Oct 28–29. |
| Attack was rehearsed the same day | on-chain | Type-4 txs 0xec5af21d… (13:51) and 0x7c5206cb… (16:25) on test EOAs, same delegate pattern. |
| ~325M USDT swapped for ~122k ETH | on-chain | Splitter A outflows to fillers; internal ETH inflows from the UniswapX Dutch Order Reactor V2 and 0x3997…678e totalling ~122,316 ETH. |
| USDT, USDC and XAUt on the hub are frozen | on-chain | eth_call at block 26,301,149: USDT isBlackListed, USDC isBlacklisted and XAUt isBlocked all return true for 0x5227…; USDT also true for 0xAa24…54a0. PAXG isFrozen, USD1 frozen() and FDUSD frozen() return false. |
| Signing infrastructure, not a single raw key | inferred | 50-nonce authorization bracket, no direct transfers signed by Binance 14, and Binance 16 signing its own payout while staying in normal service. |
| Binance customer losses | unconfirmed | Binance told Cointelegraph it is investigating a "potential security issue" and has not confirmed user funds were affected; CZ said it looks like a hack. Totals across chains quoted at $2.5B–$3.5B; ~16,700 BTC of outflows reported but not examined here. |