Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
The attacker first drained Binance 14 starting 20:24 UTC in a single transaction worth about $2.5B, minutes after Binance’s own signing infrastructure, under the attacker’s control, signed an EIP-7702 authorization delegating it to an attacker-deployed sweeper.
Blockaid Cosigner is an independent signing layer that sits on a wallet and utilizes signals from our exploit detection engine to reject malicious transactions.
Blockaid's transaction security engine classified the type-4 transaction that delegated Binance 14 as malicious on sight, with the reason that an EOA was being upgraded through EIP-7702 to an untrusted address.
Blockaid’s detection flagged the drain under two minutes after the sweep and before any public report
The delegation itself was visible onchain for three minutes and 24 seconds before the sweep
The operator address, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , was funded through three Tornado Cash withdrawals starting October 28.