So, here’s what happened: Binance hot wallets were drained of $5.60B today across Ethereum, Bitcoin and Tron. $200m were transferred few minutes ago, so hack is still ongoing Here is what is on-chain rn: what is frozen vs not, and the addresses to watch. ➮ Totals ✧ $5.60B pulled from Binance hot wallets ✧ 3 chains: Ethereum, Bitcoin, Tron ✧ 67 assets, 63 of them swept out of Binance 14 in a single tx ✧ Attack vector not confirmed at time of writing ➮ Frozen so far: $2.38B ✧ $1.56B USDT frozen by @Tether_to: $1.18B on Ethereum + $379M on Tron ✧ $823M USDC frozen by @circle ✧ Thats ~42% of the haul neutralized within the day ➮ Not frozen: ~$2.6B ✧ 18,270 BTC ($1.45B) - nobody can freeze this ✧ 197K ETH ($451M) - same ✧ ~$730M USDT still unfrozen, Tether can still act on it ✧ Rest: TRX ($234M), RLUSD ($88.5M), WBETH ($75M), XAUT ($50M) and a tail of smaller tokens ➮ Addresses to watch (paste into etherscan / mempool / tronscan) Ethereum, attacker main, holds the frozen USDT + USDC: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c Ethereum, 195,460 ETH parked here: 0x8532fa14acaf483729c449b8458aeddb900543d4 Main sweep tx, 63 tokens out of Binance 14: 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3 Bitcoin, 18,270 BTC received: bc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm Tron, 612.7M USDT received, 313M of it frozen: TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi Tron, 216M USDT, not frozen: TSUUVjysXV8YqHytSNjfkNXnnB49QDvZpx ➮ Context ✧ Previous record: Bybit, Feb 2025, $1.5B in ETH. This is ~3.8x that ✧ Binance 2019 hack: ~7,000 BTC, ~$40M, covered by SAFU ✧ Binance 2022 BNB bridge: ~$570M, most of it frozen by validators within hours ✧ Moreover, SAFU fund was ~$1B at last disclosure. This hack is 5x+ that, so the coverage question is Binance balance sheet, not SAFU ➮ What matters next 1/ Whether Tether freezes the remaining ~$730M USDT, and whether Ripple does the same with $88.5M RLUSD 2/ First outbound hops from the BTC and ETH addresses, bridges or mixers. Until then $1.9B is just sitting there 3/ Binance withdrawal status and an official statement on how 63 tokens got signed out of Binance 14 4/ Whether this follows Bybit pattern: that money went through THORChain within days, same route would show up fast here Will update as the addresses move.