—
frozen by issuers
$3.66B
Drained from Binance hot wallets on 29 October 2026.
The attacker's EIP-7702 delegation on Binance 14 was still in place after the first drain: the same caller swept Binance 14 again at 21:04 and at 21:44 UTC. While that delegation stays, new deposits to Binance 14 can be swept the same way.
—
cannot be frozen
ETH, BTC, SOL, TRX and tokens with no blacklist
—
still with attacker
tracked wallets, not frozen
—
chains
Reading the live feedAttacker wallets on Ethereum, read from public RPCs every 30 seconds.
Binance 14 sweepsWatching transfers from Binance wallets into the receiver.
Is it still moving?
The latest moves out of attacker wallets on Ethereum, newest first. Repeated transfers of one token from one wallet within an hour are grouped into one line.
Waiting for the live feed.
—
outflow pace, last hour
USD value of tokens leaving watched attacker wallets
—
receiver USDT, live
Tether-blacklisted: it can receive, it cannot send
—
receiver USDC, live
Circle-blacklisted
—
attacker caller nonce
0x7C86…5CA0 goes up by one on each new call
Where is the money now?
Value in tracked attacker wallets, by chain and by asset, at live prices.
By chain
By asset
How did the money move?
From the three Binance wallets to the receiver, then hop by hop. Band width is USD value at the time; colour is the status of the wallet it reaches. Hover a band for the transfer.
- frozen
- idle, cannot be frozen
- moved on, being sold
- burned
What is being sold?
Tokens the attacker is selling or moving out. Sold is what left the wallet; left is the live balance; pace is the last hour of the live feed.
Every tracked wallet
Who froze what, and when?
Tether, Circle and Aave acted on-chain within 90 minutes of the first drain. Each dot is one transaction; the line above is the running total drained on Ethereum, the shaded step is what issuers had frozen.
Four steps, one transaction
What changed lately
AI-generated
Written by a language model from this page's own live data. It can be wrong; the numbers above are the source.
How this page knows
Traced data
The flow map, freeze log and Ethereum snapshot come from Blockscout and Etherscan reads on 29 Oct 2026, up to 22:47:35 UTC. USD values in the flow map use Etherscan prices at that time (ETH $2,273).
Press-only claims are marked as press. Everything else links to a transaction or address.
Live data
All data on this page comes only from free, public RPCs and APIs, with no paid data provider. The only paid service is the AI read-out, which OpenRouter (GLM 5.3 FlashX) writes from this data every 10 minutes. The live feed reads ERC-20 transfer logs of the receiver and the seller wallets from public Ethereum RPCs (publicnode, Tenderly, MEV Blocker, BlockPI, dRPC), server-cached and polled every 30 seconds.
Balances on all chains are read directly on-chain every 90 seconds: public EVM RPCs with Multicall3 for Ethereum and L2s, public Tron and Solana RPCs, mempool.space and Blockstream for Bitcoin. Issuer freezes are checked with the token contracts' own blacklist calls. Prices come from the free DefiLlama API.
What is filtered out
Attacker wallets get flooded with address-poisoning spam: fake tokens that copy a real symbol (USDT, ETH) and emit transfers to look-alike addresses. The server drops any token that has no DefiLlama price. The page also hides rows whose symbol is not plain text, rows of an ERC-20 called ETH, and rows sent to an address that shares its last four characters with a tracked wallet but is not it.
Not financial advice.