Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
At 20:24:23, three minutes and 24 seconds later, the operator called sweep on Binance 14 (transaction ), sending 167,464 ETH, 1.615B USDT, and about 60 other tokens to a collection address with no prior history, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c . Binance 14 was left with 1 ETH. At prices at the time, the basket was worth about $2.5B.
0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c, described as: Attacker (Collection address with no prior history, per Blockaid: received the 20:24:23 UTC sweep). WalletsBlockaid Cosigner is an independent signing layer that sits on a wallet and utilizes signals from our exploit detection engine to reject malicious transactions.
Blockaid's transaction security engine classified the type-4 transaction that delegated Binance 14 as malicious on sight, with the reason that an EOA was being upgraded through EIP-7702 to an untrusted address.
Blockaid’s detection flagged the drain under two minutes after the sweep and before any public report
The delegation itself was visible onchain for three minutes and 24 seconds before the sweep
The operator address, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , was funded through three Tornado Cash withdrawals starting October 28.