Case fileliveupdated Sun, 1 Nov 2026, 08:29 UTC

Where the Binance hack funds are now

The wallets that took about $6.30B from Binance on 29 October, read on the Bitcoin and Ethereum blockchains every two minutes. What is frozen, what still sits where it landed, and where the rest went.

WhaleRadar follows these wallets until 19 November, three weeks after the hack. The page then stays as a record.

$2.61Bcan still move, at today’s prices

$2.41Bfrozen or blocked in the wallets followed here

$816Malready sent to addresses not followed here

Where the money is

Still where it landedin the wallets the funds first went to$2.45B37%
Moved on, followed herein wallets the funds moved on to$155M2%
Frozen or blockeda test transfer of one unit from the wallet fails$2.41B36%
Sent to addresses not followed hereswaps, contracts and services included$816M12%
On other chainsas reported, not followed here$779M12%

Values at today’s prices, so the parts change with BTC and ETH. Together $6.62B against the $6.30B Binance reported. Binance counted its total at the prices of 29 October. BTC held: 18,270 BTC. ETH held: 522,410 ETH.

The bitcoin 19 wallets, 18,270 BTC

All 18,270 BTC went to one address at 20:20 UTC on 29 October and were split within minutes: 17 wallets of exactly 1,000 BTC, one of 832.5 and one of 437.7. Bitcoin has no issuer that can freeze it.

The Ethereum wallets 13 holding funds now · 29 emptied

Wallet	Holds	Value	Frozen	Status
ETH 20x5227f6…2f8c	1,175,464,713 USDT823,000,000 USDC12,574 XAUT+7	$2.09B	$2.09B	last move 31 Oct 07:30 UTC
ETH 80x8532fa…43d4	197,460 ETH	$448M	–	unmoved for 2 days
ETH 190xc887af…286a	137,602 ETH	$312M	–	unmoved for 2 days
ETH 110x897c80…8df3	78,415 ETH	$178M	–	unmoved for 2 days
ETH 210xaa246b…54a0	174,999,872 USDT	$175M	$175M	unmoved for 2 days
ETH 170x54401f…c942	40,601 ETH	$92.1M	–	unmoved for 2 days
ETH 12 → 10x79e70d…544a	34,280 ETH	$77.7M	–	unmoved for 2 days
ETH 140x7f9dc9…15e3	29,934 WBETH	$75M	$75M	last move 30 Oct 00:59 UTC
ETH 160xe7024a…958d	40,541,065 RLUSD	$40.6M	$40.6M	last move 29 Oct 23:05 UTC
ETH 2 → 170x03b0ee…20ea	17,260 ETH	$39.1M	–	unmoved for 2 days
ETH 70xb171ca…c8c3	30,000,000 USDT	$30M	$30M	last move 29 Oct 21:35 UTC
ETH 2 → 11 → 10x8d4b8e…9e19	9,788 ETH	$22.2M	–	unmoved for 2 days
ETH 2 → 6 → 10xc2096a…850a	7,003 ETH	$15.9M	–	unmoved for 2 days

Prices and whales on Hyperliquid numbers mark bursts of moves out of the tracked wallets, $25M or more

BTC

Short 64%
$1.59B of whale money

ETH

Short 54%
$1.47B of whale money

Opened or addedClosed or trimmedLiquidatedLongShortTimeline entryDot size is the money, moves close together add up · moves of $1M or more

#	Burst of moves	Movedof it to addresses not followed	BTC, hour after	ETH, hour after	Hyperliquid whales, hour after
1	29 Oct 20:30 UTCto 03:38 UTC · 694 moves	$4.36B$796M	−2.5%	−3.4%	BTC $4.7M toward shorts · ETH $10.4M toward shorts
2	30 Oct 05:15 UTCto 05:35 UTC · 4 moves	$71.6M$0	+0.4%	−0.2%	BTC $13.5M toward longs · ETH $2.2M toward shorts

The hour after a burst is a time window, not a cause. Prices move for many reasons at once.

Where the money went the largest addresses not followed here

0xbeef02…c555$145M4 moves
0x000000…e69d$99.9M1 move
Uniswap v4 · PoolManager0x000000…8a90$72.4M89 moves
Aave v3 · USDT0x238789…086a$59.9M2 moves
0x74edc7…bdd9$49.9M1 move
Uniswap v3 · WETH/USDT 0.3%0x4e68cc…fa36$41.1M5 moves
Uniswap v3 · ENA/WETH 1%0x08b8ce…2c00$38.8M13 moves
Uniswap v2 · PEPE/WETH0xa43fe1…ec9f$36.7M68 moves

A name stands only where an address is clearly public: a verified contract, or a trading pool as it records itself on Ethereum. Every other address stays an address. Money sent to a pool was usually swapped for something else.

Latest moves $1M or more, newest first

31 Oct 20:02 UTCETH 2 → 3 → ETH 2 → 11 → 11,018 ETH$2.3MTransaction
31 Oct 17:33 UTCETH 2 → 16 → ETH 2 → 11 → 1480 ETH$1.1MTransaction
31 Oct 08:44 UTCETH 2 → 1 → ETH 2 → 6 → 1470 ETH$1.1MTransaction
31 Oct 08:42 UTCETH 2 → 5 → ETH 2 → 6 → 1932 ETH$2.1MTransaction
31 Oct 08:40 UTCETH 2 → 6 → ETH 2 → 6 → 11,104 ETH$2.5MTransaction
31 Oct 07:30 UTCETH 2 → ETH 2 → 13,621,588 RE$1.4MTransaction
31 Oct 07:17 UTCETH 2 → ETH 2 → 2580,766,087 FUN$1.5MTransaction
31 Oct 07:15 UTCETH 2 → ETH 2 → 39,258,136 LSK$2.6MTransaction
31 Oct 06:52 UTCETH 2 → ETH 2 → 432,825,145 NIL$2.4MTransaction
31 Oct 05:14 UTCETH 2 → 5 → 0xc511ff…7d9c662,005,450 SOPH$1MTransaction
31 Oct 05:02 UTCETH 2 → ETH 2 → 51,693,247,180 SOPH$2.6MTransaction
31 Oct 04:39 UTCETH 2 → ETH 2 → 653,329,985 ZAMA$3.6MTransaction
31 Oct 04:28 UTCETH 2 → 0x544bd3…af85908,793 PROM$5.1MTransaction
30 Oct 06:50 UTCETH 2 → 8 → ETH 2908,793 PROM$5.1MTransaction
30 Oct 06:30 UTCETH 2 → 12 → ETH 2580,766,088 FUN$1.5MTransaction
30 Oct 05:33 UTCETH 2 → 14 → ETH 12 → 12,857 ETH$6.4MTransaction

A message when these wallets move

A Telegram message when the tracked wallets send $10M or more, with the amount, where it went and BTC or ETH on Hyperliquid at that moment.

Get the messages on Telegram

How this page works

The bitcoin wallets come from a public trace of the blocks the coins left in, the Ethereum wallets from the labels a block explorer gave the attacker’s addresses. A wallet the money moves on to is followed from the wallet it came from, once it receives $1M or more and is not a contract.
Balances and moves are read from the Bitcoin and Ethereum blockchains every two minutes. Values use Hyperliquid’s BTC and ETH prices and public token prices for the rest.
Frozen or blocked means a test transfer of one unit out of the wallet fails, usually because the token’s issuer froze the address.
Funds on TRON, Solana, Arbitrum and Avalanche are not followed here. Their total comes from Binance’s own figures.

The case file: timeline and sources

Download card

As of Sun, 1 Nov 2026, 08:29 UTC. Wallet data from the Bitcoin and Ethereum blockchains, prices and whale moves from Hyperliquid. Not financial advice.