# D.S.I. — Binance hot-wallet outflows, Ethereum mainnet, 2026-10-29

Evidence window: blocks 26295000 to 26301061 (the latest block read, about 21:20 UTC). Sources: the public RPC `ethereum-rpc.publicnode.com` (eth_getTransactionByHash, eth_getCode, eth_call balanceOf) and the Blockscout API (`eth.blockscout.com/api/v2`: address transactions, internal transactions, token transfers, labels). Etherscan was not queried. No Binance, Tether or Circle statement was checked in this run, so none is cited.

Labels: **FACT** = read from the chain, with the tx, block or call given. **INFERENCE** = my reading of facts. **OPEN** = not answered here.

## Summary (verdict)

Verdict: **probable unauthorized drain of at least two Binance hot wallets, done with valid Binance signing authority.** Confidence: medium-high that the outflows were not routine; low on how the signing authority was obtained.

Binance 14 (0x28C6…1d60) signed an EIP-7702 authorization that delegated its code to a contract the caller 0x7C86…5CA0 had deployed 21 minutes earlier. The authorization tuple list held 50 pre-signed nonces. The caller then swept 64 tokens and about 167,464 ETH to a fresh address, 0x5227…2f8c. Binance 16 (0xDFd5…963d), a plain EOA, signed its own transfers of 28,005.6 ETH and 8 tokens to the same address. Within 20 minutes the funds were split, USDT was swapped to ETH through UniswapX and Uniswap v4, and lookalike-address poisoning started. Every step is consistent with someone holding Binance signing capability, through a compromised key or signer or an insider. A rogue operator action cannot be told apart from a theft on chain. Hours earlier the caller rehearsed the same delegation and sweep on three small wallets of its own. **About 975M USDT and 823M USDC are still unmoved at 0x5227…2f8c at block 26301061 and can be frozen by their issuers.** That is the most urgent fact in this report.

## Timeline (UTC, 2026-10-29)

| UTC | Block | Transaction | What happened |
|---|---|---|---|
| 02:28:59 | 26295416 | 0x6b76e874…06d8 | Caller 0x7C86 deploys contract 0x19bee294…f2bf (FACT) |
| 13:51:35 | 26298811 | 0x16b5acc3…dca | Type-4 tx: 0x8378…Bc3 authorizes delegation to 0x19bee294 (FACT) |
| 13:51:59 | 26298813 | 0xec5af21d…21d9 | Type-4 tx: 0x9C29…B6B delegates to 0x19bee294 (FACT) |
| 14:04–14:06 | 26298875–26298886 | 0x7da240ba…, 0x82806bd8…, 0xdc4ee2fe…, 0xe5dd5bf1… | 0xFD41…f408 funds both test wallets with 6 USDT + 1 USDC and 3 USDT + 1 USDC (FACT) |
| 14:19:59 | 26298953 | 0xa2e0cd41…4c9 | Caller calls sweep (0x8a179be4) on 0x8378; 6 USDT + 1 USDC go to 0x24A4…a4dE (FACT) |
| 14:24:11 | 26298974 | 0x6aaae5bc…1df4 | sweep on 0x9C29; 3 USDT + 1 USDC go to 0x24A4…a4dE (FACT) |
| 15:59:11 | 26299449 | 0x97408e75…329c | Caller deploys 0x63e842b0…6fae (FACT) |
| 16:20:47 / 16:25:59 | 26299557 / 26299583 | 0xb2148eb8…782, 0x7c5206cb…95d | Type-4 txs: 0x43AE…04BD delegates to 0x63e842b0 (FACT) |
| 16:30:11 | 26299604 | 0x9c2dbed1…4f2f | sweep on 0x43AE; 2.541994 USDT + 0.01 ETH go to 0x24A4…a4dE (FACT) |
| 16:47:23 | 26299690 | 0x2b8eb62a…f58f | Caller calls 0x4782f779 on 0x43AE; 1 ETH goes to 0xe4F9…74cd, the wallet that funded it with 1.01 ETH at 16:24 (tx 0xfd3f9dd9…) (FACT) |
| 18:20:47 | 26300155 | 0x96cae1ec…ebe5 | Self-transaction by the caller, value 1.082 ETH (FACT; purpose OPEN) |
| 20:20:59 | 26300753 | 0xad99264d…298b | Type-4 tx sent by the caller to Binance 14 with 50 authorization tuples signed for Binance 14, all delegating to 0x63e842b0, nonces 0x1209dd7–0x1209e08 (FACT) |
| 20:24:23 | 26300770 | 0x53bd38b8…e2f3 | sweep on Binance 14: 167,464.248 ETH plus 64 token transfers go to 0x5227 (FACT) |
| 20:24:47 | 26300772 | 0x51f263fa…39f, 0xd4e08d3e…, others | Binance 16 sends 28,005.6 ETH, 55,739,800.5 USDT, 84.5 WBTC, 25,943,825.8 RLUSD, PEPE, LINK, UNI, XAUT, ENA (FACT) |
| 20:29:11 | 26300794 | 0x942b702e…75f5 | 0x5227 sends a 0.5 ETH test to 0x9749…C762 (FACT) |
| 20:30:11 | 26300799 | 0x68d7d69d…659a | 500,000,000 USDT to 0x9749…C762 (FACT) |
| 20:31:35 | 26300806 | 0x5f0a445d…7100 | 0.5 ETH test to 0x0Ddf…697e (FACT) |
| 20:33:23 | 26300815 | 0x1fc0ef33…c81c | 200,000,000 USDT to 0x0Ddf…697e (FACT) |
| 20:34–20:49 | 26300820–26300895 | 0x290e94a9…, 0x4fa18262…, 0xfa949551…, 0xa861a556…, 0x7b0ad8b5…, 0xe5ccc3a8…, 0x1b623b43…, 0xc59188f1…, 0x3fd5ec34… | 0x9749 sells about 325M USDT through UniswapX (V2DutchOrderReactor 0x0000…89Be) and a settlement contract (0x3997…678e), receiving about 122,312 ETH (FACT) |
| 20:38:47 | 26300842 | 0x551d7961…2c76 | 0x5227 sends 195,460 ETH to 0x8532…43D4 (FACT) |
| 20:41:23 | 26300855 | 0xdc102dd8…7481 | Caller calls 0x043ff9d2 on Binance 14; 780,000,000 USDC moves from 0xEe7a…4055 to 0x5227 in the same tx (FACT) |
| 20:47:47 | 26300886 | 0x152e005f…f8cc | 0x0Ddf swaps about 10M USDT through Uniswap UniversalRouter and v4 PoolManager for about 3,552 ETH (FACT) |
| 20:52:59–20:54:35 | 26300911–26300919 | 0xc0fab33d…5183, 0x121cd104…62b2 | 0x0Ddf sends 190,000,000 USDT and 3,552.3 ETH to 0x8d53…639A (FACT) |
| 20:59:11 | 26300942 | 0x1fb992f9…670b | 0x9749 sends 175,000,000 USDT to 0x811f…e84C (FACT) |
| 20:59:47 | 26300945 | 0x3b9625b3…9ca7 | Second 0x043ff9d2 call; another 43,000,000 USDC from 0xEe7a to 0x5227 (FACT) |
| 21:04:23 | 26300968 | 0x31c4c9fe…a91d | Second sweep on Binance 14: 1,699.92 ETH plus residual tokens (3,917,639.77 USDT, etc.) to 0x5227 (FACT) |
| 21:01–21:11 | 26300952–26301001 | 0x925dda93…, 0x332cb78f…, 0xb9ecd720… | 0x9749 sends small ETH amounts (0.5–2 ETH) to 0x5C23…a4FC, 0x811f…e84C and 0xAa24…54a0 (FACT) |
| ~21:20 | 26301056 | 0x4f325fb4… | 0x5227 sends 984,249,380 BEAM to an address beginning 0x0000000000 (FACT; full destination OPEN) |

## 1. Mechanism

- FACT: In tx 0xad99264d…298b (block 26300753) the caller sent an EIP-7702 (type-4) transaction to Binance 14. Its authorization list holds 50 tuples, each with a valid signature for Binance 14, delegating to 0x63e842b0…6fae, with consecutive authority nonces 0x1209dd7–0x1209e08 (18,906,583–18,906,632). `eth_getCode(Binance 14, latest)` returns `0xef0100 63e842b0…6fae`, so the delegation was still in force at block 26301061.
- FACT: An EIP-7702 authorization only takes effect when signed by the authority's own key. The caller cannot produce one for Binance 14 without Binance 14's signing capability.
- INFERENCE: Fifty pre-signed nonces is a way to make sure one of them matches a busy hot wallet's nonce at inclusion time. Whoever signed had unrestricted, repeatable signing over arbitrary EIP-7702 messages from Binance 14's key, not just over ordinary transfers.
- FACT: Binance 16 (no code at latest) signed and sent its own transfers to 0x5227 in block 26300772 (for example 0x51f263fa…39f, 28,005.6 ETH). A second, independent key was therefore used.
- FACT: The 780M + 43M USDC moved from 0xEe7a…4055 (an ERC1967 proxy) inside the caller's 0x043ff9d2 calls on Binance 14. INFERENCE: the delegated code used an existing USDC allowance or role that 0xEe7a had granted to Binance 14. OPEN: who 0xEe7a is and what that relationship was.
- **Class (INFERENCE):** compromise of signing authority over at least two Binance hot-wallet keys, through key theft, signer or HSM-policy compromise, or an insider. EIP-7702 delegation was the *instrument* that made bulk sweeping of Binance 14 possible. It is not a protocol flaw: no bug in 7702 or in the tokens is needed to explain the chain data. The chain cannot separate a compromise from an authorized-but-rogue operator action.
- What would tell a hack from a routine treasury move:
  - Hack-like signals present (FACT): a delegation to a contract deployed the same day by an unlabelled outsider EOA; 0x5227 was a fresh address with no history before block 26300770; test transfers followed by splits within minutes; immediate stablecoin-to-ETH swaps (FACT, section 3), which a treasury move has no reason to do and which reduce issuer-freeze exposure; lookalike poisoning around the destinations; a rehearsal on throwaway wallets.
  - Routine-move signals absent: no flow back into known Binance wallets, no Binance-labelled destination, and no announcement seen (OPEN, not checked).
  - What would reverse the verdict: funds returning to Binance-labelled addresses, the 7702 delegation being cleared by Binance 14 itself, or a Binance statement describing a planned migration.

No step-by-step method is given here, on purpose.

## 2. Scope

| Wallet | Role | Lost (FACT, block) |
|---|---|---|
| 0x28C6c06298d514Db089934071355E5743bf21d60 | Binance 14 (Blockscout tag "Binance: Hot Wallet") | Block 26300770: 167,464.248 ETH and 64 token transfers. Largest: 1,615,409,498.97 USDT; 62,597,239.68 RLUSD; 27,760,801.82 USD1; 9,707,546.77 USDe; 3,454,894.92 FDUSD; 1,014,445.39 USDS; 11,372.47 XAUT; 1,898.47 PAXG; 82.54 WBTC; 668.13 WETH; 29,934.01 WBETH; 1,936.94 BNB; 198.37M ENA; 2.26M LINK; 6.19M UNI; 7.18T PEPE; 499.07B SHIB; plus about 45 others (full list in tx 0x53bd38b8…e2f3). Block 26300968: 1,699.92 ETH, 3,917,639.77 USDT and 21 residual tokens. Blocks 26300855 and 26300945: used as the conduit for 823M USDC taken from 0xEe7a. |
| 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d | Binance 16 (labelled per the brief) | Block 26300772: 28,005.6 ETH; 55,739,800.5 USDT; 84.5 WBTC; 25,943,825.8 RLUSD; 583,592,986,820.1 PEPE; 304,598.2 LINK; 819,997.1 UNI; 1,199.3 XAUT; 18,819,171.4 ENA. 849 ETH remains. |
| 0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055 | ERC1967 proxy, unlabelled on Blockscout | 823,000,000 USDC (blocks 26300855 and 26300945). Whether it is Binance-controlled is OPEN. |

- FACT: The only other addresses whose code points at the caller's contracts are the three test wallets: 0x43AE delegates to 0x63e842b0, and 0x8378 and 0x9C29 delegate to 0x19bee294. I checked every type-4 transaction sent by the caller in the window, but only the caller's own transactions. A type-4 transaction relayed by a different sender would not show up in that check (OPEN).
- OPEN: Other Binance-labelled wallets were not enumerated. Only Binance 14 and 16 were checked.

## 3. Money trail

At block 26301061 (balances FACT, read with eth_call balanceOf and Blockscout coin_balance):

- **0x5227f603…2f8c** (first-hop collector): received the totals above. Sent 0.5 ETH and 500M USDT to 0x9749, 0.5 ETH and 200M USDT to 0x0Ddf, and 195,460 ETH to 0x8532. **Still holds 975,066,939.25 USDT, 823,000,000 USDC and 1,708.78 ETH**, plus most of the non-stable tokens. It sent 984,249,380 BEAM in block 26301056, so outflows are still running.
- **0x9749292D…C762**: sold about 325M USDT for ETH through UniswapX (V2DutchOrderReactor 0x00000011F84B9aa48e5f8aA8B9897600006289Be; fills to fillers 0x74edC79F…, 0x0000000000be226a…, 0xBEEf0296…, 0xEc4FB7e7…, 0x9b1303EB…) and SimpleSettlement 0x39974015…. It sent 175M USDT to 0x811f…e84C (now 0 USDT, so forwarded further; OPEN where). It holds 122,312.8 ETH and 0 USDT.
- **0x0Ddf0480…697e**: swapped about 10M USDT on Uniswap (UniversalRouter 0x23617e59…, v4 PoolManager 0x000000000004444c…). Sent 190M USDT and 3,552.3 ETH to 0x8d53…639A, which now holds 0 USDT (forwarded further; OPEN). Holds 0.06 ETH.
- **0x8532FA14…43D4**: holds 195,460 ETH, untouched.
- Bridges, mixers, exchanges: none seen in the hops traced (FACT for the hops traced). UniswapX fillers and settlement contracts are DEX liquidity, not exchanges. The next hops from 0x811f and 0x8d53 are OPEN.
- Still running: **yes** (FACT, block 26301056).

## 4. The three earlier EIP-7702 targets

- FACT: 0x837810E3…aFBc3, 0x9C29BA2D…dbB6B and 0x43AEdb9B…04BD had no meaningful holdings. Minutes before each sweep they were funded by 0xFD41dA53…f408 (6 USDT + 1 USDC, 3 USDT + 1 USDC, and 2.541994 USDT) and by 0xe4F9070e…74cd (1.01 ETH). The sweeps took exactly those amounts (plus 0.01 ETH) to 0x24A4AE36…a4dE. The 0x4782f779 call returned 1 ETH to 0xe4F9.
- FACT: their delegations were still in force at the latest block: 0x8378 and 0x9C29 to 0x19bee294, 0x43AE to 0x63e842b0.
- INFERENCE (high confidence): these are rehearsal wallets under the caller's own control, not victims. The wallets that granted delegations show no third-party value, and the funders and the sweep recipient form a closed loop. Nothing of value was taken from them.

## 5. What can still be stopped or reversed (balances at block 26301061, FACT)

| Address | USDT (Tether can freeze) | USDC (Circle can blacklist) | Other |
|---|---|---|---|
| 0x5227f603…2f8c | 975,066,939.25 | 823,000,000.00 | 1,708.78 ETH; RLUSD (Ripple), USD1, FDUSD, PAXG (Paxos), XAUT (Tether) and others, issuer-freezable depending on each contract (OPEN per token) |
| 0x9749292D…C762 | 0 | 0 | 122,312.8 ETH (not freezable) |
| 0x0Ddf0480…697e | 0 | 0 | 0.06 ETH |
| 0x811f1585…e84C | 0 (175M passed through) | 0 | 1.49 ETH |
| 0x8d539036…639A | 0 (190M passed through) | 0 | 0.10 ETH |
| 0x8532FA14…43D4 | 0 | 0 | 195,460 ETH (not freezable) |

- The delegation on Binance 14 to 0x63e842b0 is still in force (FACT). INFERENCE: while it stays in place, whoever controls the caller can keep moving anything deposited to Binance 14, and Binance 14 should stop receiving deposits. Binance can clear it by signing a new 7702 authorization to the zero address from Binance 14's key, assuming its key is still under its control.
- ETH and most ERC-20s have no pause. UniswapX swaps are final.
- OPEN: whether 0xEe7a still grants Binance 14 a USDC allowance. If it does, the owner of 0xEe7a should revoke it.

## 6. Address-poisoning traffic (separate from the incident)

FACT, all in blocks 26300797–26301039. None of these move value out of the victim wallets.

- Lookalikes of 0x9749…C762: 0x9749F766…C762, 0x9749e7aD…C762, 0x97497624…C762 and 0x9749110a… sent 0-value or dust transfers to 0x5227 (txs 0xf30310e6…, 0xf0c8cdb3…, 0x3e623279…, 0x8235d06a…). The fake tokens "ЕΤН" and "USDΤ" (Cyrillic and Greek letters with invisible characters) appear as if sent from 0x5227 to 0x9749110a… (blocks 26300802 and 26300807), and a 0.01 USDT dust transfer came from 0x97497624… (block 26300805).
- Lookalike of 0x0Ddf…697e: fake "ЕТН" 0.5 from 0x5227 to 0x0dDF2795… (block 26300818).
- A zero-value USDT transferFrom from 0x5227 to 0xD565…1529 (block 26300933, tx 0x63461684…), and dust ETH from 0xd48D2597… to both 0x5227 and 0x8532 (blocks 26300990 and 26301039).
- INFERENCE: these are third-party poisoning bots reacting to the large flows, trying to get the sender to copy a lookalike address. They should not be counted as incident flows or as destinations of stolen funds.

## 7. Who to tell first

1. **Tether**: freeze 975M USDT at 0x5227 (and check 0x811f / 0x8d53 downstream). Public contact: tether.to support / compliance@tether.to (from public Tether pages; not re-verified in this run).
2. **Circle**: blacklist 823M USDC at 0x5227. Public contact: circle.com support / Circle compliance (not re-verified here).
3. **Binance security**: Binance 14 delegation still in force; Binance 16 key in question. Public contact: Binance Bug Bounty / security team via binance.com, and official @binance channels.
4. Owner of 0xEe7a…4055 (identity OPEN), and the issuers of RLUSD (Ripple), USD1, FDUSD, PAXG (Paxos) and XAUT (Tether) for the remaining stable and gold tokens at 0x5227.
5. Uniswap Labs / UniswapX filler operators for tracing only. They cannot reverse fills.

Contact routes are from public knowledge and were not fetched in this run (OPEN).

## Unanswered / limits

- No Binance, Tether or Circle announcement was checked. All verdicts are from chain data only. X posts were not used.
- Next hops beyond 0x811f, 0x8d53, 0x5C23, 0xAa24 and the BEAM recipient were not traced.
- Bytecode of 0x63e842b0 and 0x19bee294 was not decompiled. Function roles are inferred from the observed effects.
- Other Binance-labelled wallets were not systematically checked.
- Amounts are from Blockscout's decoded token transfers. USDT and USDC balances were cross-checked with eth_call.