# The Binance hack: the good, the bad, the ugly

> Today I didn't follow the news. I asked Claude to check what happened on the blockchain, using only the API of my own blockchain explorer (see my previous article), and to write the story for me. 

All of it is based on blockchain data that I store myself and share through an open API. Claude did a very nice job – one more example of what blockchain data and AI can do together.

What the data shows – transparency and control:

The good: Tether and Circle froze $2.2 billion of the stolen USDT and USDC.
The bad: $729 million moved on to addresses we can't follow. For some wallets the blacklisting came just 36 seconds too late.
The ugly: 18,270 BTC sit untouched in 19 wallets. Everyone can see them, nobody can freeze them.

Besides the infographics, Claude also found a few bugs in the public API of btc.artjoms.ai. The main one is already fixed, so the explorer is more robust now.

Important: my explorer covers only Bitcoin, plus USDT and USDC on Ethereum and TRON.

Published 2026-10-30 · by Artjoms Krasnopjorovs (https://krasnopjorovs.com/)

[Binance hack slides (1) (PDF, 8 pages)](https://krasnopjorovs.com/assets/binance-hack-slides-1-af5ebd77.pdf)

[EN — full picture (PDF, 1 page)](https://krasnopjorovs.com/assets/en-full-picture-a0922acc.pdf)

Text of the PDF:

> BTC.ARTJOMS.AI ON-CHAIN TRACE · BITCOIN · ETHEREUM · TRON
> Binance hack: what was taken and what was stopped
> From 20:20 UTC on 29 Oct 2026 Binance hot wallets on three chains sent their funds to fresh addresses. Tether and Circle then froze what
> they could still reach. Bitcoin, USDT and USDC from our own index. Two facts come from other systems: they are marked ¹ ², with notes at
> the bottom.
> FROZEN BY THE ISSUERS
> 2,203.5 M
> USDT and USDC on Ethereum · 66.5% of the stolen stablecoins
> 3,311.2M
> USDT and USDC stolen on Ethereum and TRON
> 18,270.2 BTC
> stolen · 0 of 19 wallets have moved funds
> 729.0M
> USDT moved on before it could be frozen
> 378.7M
> USDT on TRON held by the attacker · no freeze in the data
> WHAT HAPPENED, MINUTE BY MINUTE · UTC
> 20:20:06 BITCOIN 11 withdrawals send 18,270.2 BTC from the Binance.com wallet to one new address. In the same block they are split across 18 fresh wallets, 17 of them with 1,000 BTC each; the 19th
> wallet follows 28 minutes later.
> 20:22:45 TRON Binance's hot wallet sends 612.7M USDT to a new address in a single transfer.
> 20:24:23 ETHEREUM Binance 14 sends 1,615.4M USDT to new address 0x5227…2f8c1. 24 seconds later Binance 16 adds 55.7M.
> 20:30–20:33 ETHEREUM The attacker moves 700.0M USDT on to two new wallets, 500.0M and 200.0M, and starts splitting it.
> 20:41–20:59 ETHEREUM 823.0M USDC arrive at 0x5227…2f8c from wallet 0xee7a…4055, in two transfers of 780.0M and 43.0M.
> 20:45–21:16 TRON 300.0M USDT leave the TRON address through a splitter wallet: 234.0M end up in long-running addresses, 66.0M stay in a fresh wallet.
> 21:01:35 FREEZE Tether blacklists 0x5227…2f8c with 971.1M USDT inside. At 21:04:59 Circle blacklists it with 823.0M USDC inside.
> 21:01–21:19 FREEZE Tether blacklists 7 more wallets on the traced trail, one by one. Five are already empty, two still hold 175.0M and 30.0M.
> 21:04, 21:44 ETHEREUM Binance 14 sends 204.3M more USDT to 0x5227…2f8c, which is already frozen.
> 22:06–23:54 FREEZE Tether and Circle also blacklist the two wallets the funds came from: Binance 14 and 0xee7a…40552.
> 30 Oct NOW The 18,270.2 BTC have not moved. The 378.7M USDT on TRON had not moved by 09:11 UTC, where the TRON data stops. The data holds no freeze on TRON.
> WHAT WAS TAKEN AND WHAT HAPPENED TO IT
> All the USDC was stopped, three quarters of the USDT, and nobody has touched the bitcoin
> frozen by the issuer held by the attacker, not moved moved on before it could be frozen
> USDC · Ethereum
> stolen 823.0M
> 823.0 · 100%
> Circle blacklisted the address 23.6 min after the first
> USDC arrived. Not one USDC left it.
> USDT · Ethereum
> stolen 1,875.5M
> 1,380.5 · 73.6% 495.0 · 26.4%
> Frozen: 1,175.5M on the main address, 175.0M and
> 30.0M in two later wallets.
> USDT · TRON
> stolen 612.7M
> 378.7 · 61.8% 234.0
> 378.7M sit in two wallets created during the hack. The
> data holds no freeze events on TRON.
> BTC · Bitcoin
> stolen 18,270.2 BTC
> 18,270.2 BTC · 100% · own scale
> 19 wallets: 17 of 1,000 BTC, 832.5 and 437.7. Bitcoin
> can't be frozen — yet not one satoshi has moved.
> RACE AGAINST THE FREEZE · USDT ON ETHEREUM
> Each row is one attacker wallet. The bar shows how long money sat in it; the red line is the moment Tether blacklisted it
> Five wallets were already empty when the blacklisting came, between 36 seconds and 9 minutes too late. Two were caught with money inside. Amounts in millions of USDT.
> funds in the wallet frozen blacklisting: T — Tether, C — Circle
> 20:20 20:30 20:40 20:50 21:00 21:10 21:20 21:30 21:40 21:50 UTC
> 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c1
> main address · 1,875.5 USDT + 823.0 USDC in
> T C
> frozen 1,175.5 USDT · 823.0 USDC
> 700.0 USDT left at 20:30–20:33
> 0x9749292d74fd460982d0912ea9515ea24736c762
> 500.0 from the main address
> empty 2 min 24 s before the blacklisting
> 325.0 to long-running addresses, 175.0 on
> 0x0ddf0480016e6bcb2c1f5d190d221fba1320697e
> 200.0 from the main address
> empty 8 min 48 s before the blacklisting
> 10.0 split over ~8 contracts, 190.0 on
> 0x8d53903625b8e839b9df4bd28b0efb1cd6b8639a
> 190.0 from 0x0ddf…697e
> empty 48 s before the blacklisting
> 60.0 to contract 0x2387…086a, 130.0 on
> 0x811f15855476156ebf86ba3b84fafb8ceaa4e84c
> 175.0 from 0x9749…c762
> never blacklisted
> 175.0 on at 21:08
> 0x77edef23fbd05921c26fe29fcc3a65e14d2ac3eb
> 130.0 from 0x8d53…639a
> never blacklisted
> 50.0 split over ~8 contracts, 80.0 on
> 0x7aa4d3029e4c6a8e916300014ad95b6d6c03bfd1
> 80.0 from 0x77ed…c3eb
> empty 1 min 24 s before the blacklisting
> 50.0 split over ~8 contracts, 30.0 on
> 0xaa246bf639586a6ba46762d378ce50ca4fc654a0
> 175.0 from 0x811f…e84c
> frozen 175.0
> caught after 6 min 36 s in the wallet
> 0xccbef95633adb5cd2b5038db5a38d77e726ca263
> 30.0 from 0x7aa4…bfd1
> empty 36 s before the blacklisting
> 30.0 on
> 0xb171ca86f82070282138352ff7111b494060c8c3
> 30.0 from 0xccbe…a263
> frozen 30.0
> caught after 2 min 48 s in the wallet
> ETHEREUM · WHERE 495.0M USDT WENT
> 325.0 — into 5 long-running addresses, each with thousands of transfers since
> summer 2026 or earlier
> 110.0 — three times split in one transaction across ~8 contracts: 10.0 + 50.0 +
> 50.0
> 60.0 — into one contract with half a million transfers since 2023
> None of these addresses has a label in the catalog: from here the trail joins general
> circulation. Full addresses below.
> TRON · 612.7M USDT
> Binance's hot wallet sent 612.7 in a single transfer at 20:22:45
> 378.7 sit in two fresh wallets: 312.7 and 66.0
> 234.0 went into 4 long-running addresses within 54 minutes
> No freeze events on TRON in the data yet: this chain's issuer events don't reach the live layer.
> SOURCE WALLETS
> Binance 14 → 1,819.7 USDT in 3 transfers
> Binance 16 → 55.7 USDT
> 0xee7a…4055
> 2
> (no label in the catalog) → 823.0 USDC
> Binance.com btc-w-604277115 → 18,270.2 BTC in 11 withdrawals
> The issuers also blacklisted both source wallets on Ethereum: Binance 14 — Tether at 22:06,
> Circle at 23:53; 0xee7a…4055 — Circle at 23:54.
> ALL ADDRESSES
> Ethereum
> SOURCES
> Binance 14 · 1,819.7 USDT out
> 0x28c6c06298d514db089934071355e5743bf21d60
> Binance 16 · 55.7 USDT out
> 0xdfd5293d8e347dfe59e90efd55b2956a1343963d
> no label in the catalog2 · 823.0 USDC out
> 0xee7ae85f2fe2239e27d9c1e23fffe168d63b4055
> ATTACKER WALLETS
> All 10 with full addresses in the race table above.
> WHERE 385.0M OF IT WENT
> 145.0 USDT in · since 2025 · ~29,000 transfers
> 0xbeef02961503351625926ea9a11ae13b29f5c555
> 100.0 USDT in · since Aug 2026 · ~10,900 transfers
> 0x0000000000be226afde21672a5e4adc45692e69d
> 60.0 USDT in · since 2023 · ~500,000 transfers
> 0x23878914efe38d27c4d67ab83ed1b93a74d4086a
> 50.0 USDT in · since 19 Oct 2026
> 0x74edc79fea13bdf1f7841570227127cec493bdd9
> 28.6 USDT in · since Jul 2026 · ~5,500 transfers
> 0x9b1303ebf09bc51b7fac376c9e421e8daae63b82
> 1.4 USDT in · since Jul 2026 · ~3,000 transfers
> 0xec4fb7e7c35c241e1138a2d8cfbb09f3ad1ccb22
> TRON
> SOURCE
> Binance hot wallet · 612.7 USDT out
> TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf
> ATTACKER WALLETS
> main · 612.7 in, 312.7 still there
> TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi
> splitter · 300.0 in, all sent on
> TPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN4
> parked · 66.0 in, still there
> TCzBTkqn66yApqbYoPezaEQosM5DAd7Y62
> WHERE 234.0M WENT
> 199.0 USDT in · long-running
> TSUUVjysXV8YqHytSNjfkNXnnB49QDvZpx
> 33.0 USDT in · long-running
> TVjuTE3V5bMVdpfNhid8kD2v35T2k1u1Br
> 2.0 USDT in · long-running
> TFGDbUyP8xez44C76fin3bn3Ss6jugoUwJ
> 0.01 USDT in (a test) · long-running
> TXJgMdjVX5dKiQaUi9QobwNxtSQaFqccvd
> Bitcoin
> SOURCE AND COLLECTION
> Binance.com · btc-w-604277115 · 18,270.2 BTC out
> bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h
> attacker collection · btc-w-715435127 · balance now 0
> bc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm
> 19 WALLETS HOLDING THE BTC · NONE HAS MOVED
> bc1q0ts8gaf9ht0rr4u02hr56f8thndqsc4kmkmfv3 1,000.0
> bc1qjwdw6vrzq4vf6hckutvx4ucj86awwv99mxnz7w 1,000.0
> bc1qdfhmlrdvg4tm87zjl0vyf0xflp5ql50q3g88gw 1,000.0
> bc1qz8hdwv8gmml0u96dsvnzsagz6krjyzxmgxupdp 1,000.0
> bc1q63qrfrpsg5hh0zzn3kp2xx9vljl7dq7tatsjxp 1,000.0
> bc1qs3aej5tmcdz0vctz8y9rjcxtxg8v5385577s56 1,000.0
> bc1qs6xnmhar38z44g2za93pv8ygdcwurrh8l87w3v 1,000.0
> bc1qm8v88m5fy6kuq9myva2eemwycxqd3e0zcrs2l8 1,000.0
> bc1q42flhayrzy3zh8lkyevw8qcjduurt9a35wlsyx 1,000.0
> bc1q2wvz0kcsn4hqmajwtey30ud27fl25w8pveznn6 1,000.0
> bc1qalwnl7dtaa73fsq5tyn0ghfy3fgfpqkt69tca8 1,000.0
> bc1qf5cyvv9w50tx9xx9s3xwsne0z87wvjj9l8a35u 1,000.0
> bc1qm2j6v3247khlwzxl7p9vqnfkghcllyhv9wjaat 1,000.0
> bc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968s 1,000.0
> bc1qg3nrzpuvq2pxqx74tcrywr09dc208ze96n3t53 1,000.0
> bc1qepc70u3u476vgvg3hfcwjgu4mecxe2uchs4lag 1,000.0
> bc1qnq6jj9jmlf3945m3l8s0kxnqehrsga300k8t3s 1,000.0
> bc1qrg025e2pgx0rwya2kpgtj30972p64jt0hn6zyt 832.5
> bc1qxg0l4p6xc50zuv9cl5f0l0wmaxjpg8wcy7s9ra 437.7
> Source: btc.artjoms.ai — own index of raw blocks · Bitcoin at block 973,797 · Ethereum at block 26,305,163 · TRON at block 87,559,363 (09:11 UTC on 30 Oct; the TRON node stalled after that) · exact on-chain amounts, M USDT/USDC · freezes: Blacklisted (Circle) and AddedBlackList
> (Tether) events from the issuer layer
> Labels in the btc.artjoms.ai catalog: Binance.com on Bitcoin — GraphSense public tag pack · Binance 14 and Binance 16 on Ethereum — Etherscan label snapshot, 2023 · Binance hot wallet on TRON — derived from our own chain data · roles such as main, splitter, parked and long-running are our reading of the flows, not catalog labels
> From other systems: ¹ the starting address 0x5227…2f8c came from public reports with Etherscan links; everything after it was traced in btc.artjoms.ai · ² that 0xee7a…4055 belongs to Binance comes from public reporting (Etherscan: Binance Hot Wallet 34); the btc.artjoms.ai catalog
> has no label for it
> btc.artjoms.ai

Source: https://krasnopjorovs.com/articles/the-binance-hack-the-good-the-bad-the-ugly