Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
At 20:20:59 the operator sent a type-4 transaction to Binance 14, 0x28C6c06298d514Db089934071355E5743bf21d60 , carrying 50 EIP-7702 authorizations signed with the Binance 14 key, one per nonce from 18,914,775 to 18,914,824, each delegating the wallet to the sweeper.
0x28C6c06298d514Db089934071355E5743bf21d60, described as: Victim ('Binance 14', per Blockaid, the Binance hot wallet that received the 50 authorizations and was swept. Listed as a victim wallet, NOT an attacker address). AddressesBlockaid's transaction security engine classified the type-4 transaction that delegated Binance 14 as malicious on sight, with the reason that an EOA was being upgraded through EIP-7702 to an untrusted address.
Blockaid’s detection flagged the drain under two minutes after the sweep and before any public report
The delegation itself was visible onchain for three minutes and 24 seconds before the sweep
The operator address, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , was funded through three Tornado Cash withdrawals starting October 28.
Tether and Circle froze about $1.8B in the main collection address within 40 minutes, and with later freezes by other issuers and the Arbitrum Security Council, Binance puts the verified total frozen at about $3B.