The Binance hack: the good, the bad, the ugly
Today I didn't follow the news. I asked Claude to check what happened on the blockchain, using only the API of my own blockchain explorer (see my previous article), and to write the story for me. All of it is based on blockchain data that I store myself and share through an open API. Claude did a very nice job – one more example of what blockchain data and AI can do together. What the data shows – transparency and control: The good: Tether and Circle froze $2.2 billion of the stolen USDT and USDC. The bad: $729 million moved on to addresses we can't follow. For some wallets the blacklisting came just 36 seconds too late. The ugly: 18,270 BTC sit untouched in 19 wallets. Everyone can see them, nobody can freeze them. Besides the infographics, Claude also found a few bugs in the public API of btc.artjoms.ai. The main one is already fixed, so the explorer is more robust now. Important: my explorer covers only Bitcoin, plus USDT and USDC on Ethereum and TRON.
First published on LinkedIn on 30 Oct 2026.
Text of the PDF
BTC.ARTJOMS.AI ON-CHAIN TRACE · BITCOIN · ETHEREUM · TRON
Binance hack: what was taken and what was stopped
From 20:20 UTC on 29 Oct 2026 Binance hot wallets on three chains sent their funds to fresh addresses. Tether and Circle then froze what
they could still reach. Bitcoin, USDT and USDC from our own index. Two facts come from other systems: they are marked ¹ ², with notes at
the bottom.
FROZEN BY THE ISSUERS
2,203.5 M
USDT and USDC on Ethereum · 66.5% of the stolen stablecoins
3,311.2M
USDT and USDC stolen on Ethereum and TRON
18,270.2 BTC
stolen · 0 of 19 wallets have moved funds
729.0M
USDT moved on before it could be frozen
378.7M
USDT on TRON held by the attacker · no freeze in the data
WHAT HAPPENED, MINUTE BY MINUTE · UTC
20:20:06 BITCOIN 11 withdrawals send 18,270.2 BTC from the Binance.com wallet to one new address. In the same block they are split across 18 fresh wallets, 17 of them with 1,000 BTC each; the 19th
wallet follows 28 minutes later.
20:22:45 TRON Binance's hot wallet sends 612.7M USDT to a new address in a single transfer.
20:24:23 ETHEREUM Binance 14 sends 1,615.4M USDT to new address 0x5227…2f8c1. 24 seconds later Binance 16 adds 55.7M.
20:30–20:33 ETHEREUM The attacker moves 700.0M USDT on to two new wallets, 500.0M and 200.0M, and starts splitting it.
20:41–20:59 ETHEREUM 823.0M USDC arrive at 0x5227…2f8c from wallet 0xee7a…4055, in two transfers of 780.0M and 43.0M.
20:45–21:16 TRON 300.0M USDT leave the TRON address through a splitter wallet: 234.0M end up in long-running addresses, 66.0M stay in a fresh wallet.
21:01:35 FREEZE Tether blacklists 0x5227…2f8c with 971.1M USDT inside. At 21:04:59 Circle blacklists it with 823.0M USDC inside.
21:01–21:19 FREEZE Tether blacklists 7 more wallets on the traced trail, one by one. Five are already empty, two still hold 175.0M and 30.0M.
21:04, 21:44 ETHEREUM Binance 14 sends 204.3M more USDT to 0x5227…2f8c, which is already frozen.
22:06–23:54 FREEZE Tether and Circle also blacklist the two wallets the funds came from: Binance 14 and 0xee7a…40552.
30 Oct NOW The 18,270.2 BTC have not moved. The 378.7M USDT on TRON had not moved by 09:11 UTC, where the TRON data stops. The data holds no freeze on TRON.
WHAT WAS TAKEN AND WHAT HAPPENED TO IT
All the USDC was stopped, three quarters of the USDT, and nobody has touched the bitcoin
frozen by the issuer held by the attacker, not moved moved on before it could be frozen
USDC · Ethereum
stolen 823.0M
823.0 · 100%
Circle blacklisted the address 23.6 min after the first
USDC arrived. Not one USDC left it.
USDT · Ethereum
stolen 1,875.5M
1,380.5 · 73.6% 495.0 · 26.4%
Frozen: 1,175.5M on the main address, 175.0M and
30.0M in two later wallets.
USDT · TRON
stolen 612.7M
378.7 · 61.8% 234.0
378.7M sit in two wallets created during the hack. The
data holds no freeze events on TRON.
BTC · Bitcoin
stolen 18,270.2 BTC
18,270.2 BTC · 100% · own scale
19 wallets: 17 of 1,000 BTC, 832.5 and 437.7. Bitcoin
can't be frozen — yet not one satoshi has moved.
RACE AGAINST THE FREEZE · USDT ON ETHEREUM
Each row is one attacker wallet. The bar shows how long money sat in it; the red line is the moment Tether blacklisted it
Five wallets were already empty when the blacklisting came, between 36 seconds and 9 minutes too late. Two were caught with money inside. Amounts in millions of USDT.
funds in the wallet frozen blacklisting: T — Tether, C — Circle
20:20 20:30 20:40 20:50 21:00 21:10 21:20 21:30 21:40 21:50 UTC
0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c1
main address · 1,875.5 USDT + 823.0 USDC in
T C
frozen 1,175.5 USDT · 823.0 USDC
700.0 USDT left at 20:30–20:33
0x9749292d74fd460982d0912ea9515ea24736c762
500.0 from the main address
empty 2 min 24 s before the blacklisting
325.0 to long-running addresses, 175.0 on
0x0ddf0480016e6bcb2c1f5d190d221fba1320697e
200.0 from the main address
empty 8 min 48 s before the blacklisting
10.0 split over ~8 contracts, 190.0 on
0x8d53903625b8e839b9df4bd28b0efb1cd6b8639a
190.0 from 0x0ddf…697e
empty 48 s before the blacklisting
60.0 to contract 0x2387…086a, 130.0 on
0x811f15855476156ebf86ba3b84fafb8ceaa4e84c
175.0 from 0x9749…c762
never blacklisted
175.0 on at 21:08
0x77edef23fbd05921c26fe29fcc3a65e14d2ac3eb
130.0 from 0x8d53…639a
never blacklisted
50.0 split over ~8 contracts, 80.0 on
0x7aa4d3029e4c6a8e916300014ad95b6d6c03bfd1
80.0 from 0x77ed…c3eb
empty 1 min 24 s before the blacklisting
50.0 split over ~8 contracts, 30.0 on
0xaa246bf639586a6ba46762d378ce50ca4fc654a0
175.0 from 0x811f…e84c
frozen 175.0
caught after 6 min 36 s in the wallet
0xccbef95633adb5cd2b5038db5a38d77e726ca263
30.0 from 0x7aa4…bfd1
empty 36 s before the blacklisting
30.0 on
0xb171ca86f82070282138352ff7111b494060c8c3
30.0 from 0xccbe…a263
frozen 30.0
caught after 2 min 48 s in the wallet
ETHEREUM · WHERE 495.0M USDT WENT
325.0 — into 5 long-running addresses, each with thousands of transfers since
summer 2026 or earlier
110.0 — three times split in one transaction across ~8 contracts: 10.0 + 50.0 +
50.0
60.0 — into one contract with half a million transfers since 2023
None of these addresses has a label in the catalog: from here the trail joins general
circulation. Full addresses below.
TRON · 612.7M USDT
Binance's hot wallet sent 612.7 in a single transfer at 20:22:45
378.7 sit in two fresh wallets: 312.7 and 66.0
234.0 went into 4 long-running addresses within 54 minutes
No freeze events on TRON in the data yet: this chain's issuer events don't reach the live layer.
SOURCE WALLETS
Binance 14 → 1,819.7 USDT in 3 transfers
Binance 16 → 55.7 USDT
0xee7a…4055
2
(no label in the catalog) → 823.0 USDC
Binance.com btc-w-604277115 → 18,270.2 BTC in 11 withdrawals
The issuers also blacklisted both source wallets on Ethereum: Binance 14 — Tether at 22:06,
Circle at 23:53; 0xee7a…4055 — Circle at 23:54.
ALL ADDRESSES
Ethereum
SOURCES
Binance 14 · 1,819.7 USDT out
0x28c6c06298d514db089934071355e5743bf21d60
Binance 16 · 55.7 USDT out
0xdfd5293d8e347dfe59e90efd55b2956a1343963d
no label in the catalog2 · 823.0 USDC out
0xee7ae85f2fe2239e27d9c1e23fffe168d63b4055
ATTACKER WALLETS
All 10 with full addresses in the race table above.
WHERE 385.0M OF IT WENT
145.0 USDT in · since 2025 · ~29,000 transfers
0xbeef02961503351625926ea9a11ae13b29f5c555
100.0 USDT in · since Aug 2026 · ~10,900 transfers
0x0000000000be226afde21672a5e4adc45692e69d
60.0 USDT in · since 2023 · ~500,000 transfers
0x23878914efe38d27c4d67ab83ed1b93a74d4086a
50.0 USDT in · since 19 Oct 2026
0x74edc79fea13bdf1f7841570227127cec493bdd9
28.6 USDT in · since Jul 2026 · ~5,500 transfers
0x9b1303ebf09bc51b7fac376c9e421e8daae63b82
1.4 USDT in · since Jul 2026 · ~3,000 transfers
0xec4fb7e7c35c241e1138a2d8cfbb09f3ad1ccb22
TRON
SOURCE
Binance hot wallet · 612.7 USDT out
TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf
ATTACKER WALLETS
main · 612.7 in, 312.7 still there
TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi
splitter · 300.0 in, all sent on
TPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN4
parked · 66.0 in, still there
TCzBTkqn66yApqbYoPezaEQosM5DAd7Y62
WHERE 234.0M WENT
199.0 USDT in · long-running
TSUUVjysXV8YqHytSNjfkNXnnB49QDvZpx
33.0 USDT in · long-running
TVjuTE3V5bMVdpfNhid8kD2v35T2k1u1Br
2.0 USDT in · long-running
TFGDbUyP8xez44C76fin3bn3Ss6jugoUwJ
0.01 USDT in (a test) · long-running
TXJgMdjVX5dKiQaUi9QobwNxtSQaFqccvd
Bitcoin
SOURCE AND COLLECTION
Binance.com · btc-w-604277115 · 18,270.2 BTC out
bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h
attacker collection · btc-w-715435127 · balance now 0
bc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm
19 WALLETS HOLDING THE BTC · NONE HAS MOVED
bc1q0ts8gaf9ht0rr4u02hr56f8thndqsc4kmkmfv3 1,000.0
bc1qjwdw6vrzq4vf6hckutvx4ucj86awwv99mxnz7w 1,000.0
bc1qdfhmlrdvg4tm87zjl0vyf0xflp5ql50q3g88gw 1,000.0
bc1qz8hdwv8gmml0u96dsvnzsagz6krjyzxmgxupdp 1,000.0
bc1q63qrfrpsg5hh0zzn3kp2xx9vljl7dq7tatsjxp 1,000.0
bc1qs3aej5tmcdz0vctz8y9rjcxtxg8v5385577s56 1,000.0
bc1qs6xnmhar38z44g2za93pv8ygdcwurrh8l87w3v 1,000.0
bc1qm8v88m5fy6kuq9myva2eemwycxqd3e0zcrs2l8 1,000.0
bc1q42flhayrzy3zh8lkyevw8qcjduurt9a35wlsyx 1,000.0
bc1q2wvz0kcsn4hqmajwtey30ud27fl25w8pveznn6 1,000.0
bc1qalwnl7dtaa73fsq5tyn0ghfy3fgfpqkt69tca8 1,000.0
bc1qf5cyvv9w50tx9xx9s3xwsne0z87wvjj9l8a35u 1,000.0
bc1qm2j6v3247khlwzxl7p9vqnfkghcllyhv9wjaat 1,000.0
bc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968s 1,000.0
bc1qg3nrzpuvq2pxqx74tcrywr09dc208ze96n3t53 1,000.0
bc1qepc70u3u476vgvg3hfcwjgu4mecxe2uchs4lag 1,000.0
bc1qnq6jj9jmlf3945m3l8s0kxnqehrsga300k8t3s 1,000.0
bc1qrg025e2pgx0rwya2kpgtj30972p64jt0hn6zyt 832.5
bc1qxg0l4p6xc50zuv9cl5f0l0wmaxjpg8wcy7s9ra 437.7
Source: btc.artjoms.ai — own index of raw blocks · Bitcoin at block 973,797 · Ethereum at block 26,305,163 · TRON at block 87,559,363 (09:11 UTC on 30 Oct; the TRON node stalled after that) · exact on-chain amounts, M USDT/USDC · freezes: Blacklisted (Circle) and AddedBlackList
(Tether) events from the issuer layer
Labels in the btc.artjoms.ai catalog: Binance.com on Bitcoin — GraphSense public tag pack · Binance 14 and Binance 16 on Ethereum — Etherscan label snapshot, 2023 · Binance hot wallet on TRON — derived from our own chain data · roles such as main, splitter, parked and long-running are our reading of the flows, not catalog labels
From other systems: ¹ the starting address 0x5227…2f8c came from public reports with Etherscan links; everything after it was traced in btc.artjoms.ai · ² that 0xee7a…4055 belongs to Binance comes from public reporting (Etherscan: Binance Hot Wallet 34); the btc.artjoms.ai catalog
has no label for it
btc.artjoms.ai