Binance and Bitget hacks: commingling wallet and linked wallets on Tron, Ethereum, Bitcoin, XRP, Avalanche, OP, Polygon and Base (30 Oct 2026)
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: Binance, Bitget
- Incident date: 2026-10-30
- Reported: 2026-10-30
- Last updated: 2026-10-30
ZachXBT says stolen funds from the Binance exploit and the Bitget exploit were commingled at one Ethereum address, 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7, after arriving through THORChain (https://x.com/zachxbt/status/2116030284261179538, posted 04:51 UTC on 30 October 2026). This report files that address, the wallets now holding its ETH, and linked wallets on Ethereum, Tron, Bitcoin, XRP Ledger and Avalanche. It links the BlockintAI Binance reports (https://blockint.ai/c3?report=cad68b7e-53fd-4072-b113-30196922d5e0, https://blockint.ai/c3?report=b6debab5-a058-4076-9223-31b7c81349dc) and…
Other addresses in this report: 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7, 0xe5cec77934a9aa7a5c63692965a1f07ab933ad29, 0x3912c37412baae4c7abe2e969298b9c55a6c912f, 0x7dcb564ae3ab5f25fda877882a4739e597a377e2, 0x181a9d83f78e38c573c824088879da346cc3e08e, 0xc9cd1054d89d6faf75b22f0bd0c0fef44a274c7c, 0x3a793b6ffea212acc8e2d2b9b45a3db7c9c4248d, 0x3a2c6bbe9775fff0cc8ada21d2c565928c5b8a65, 0x415e50c7cc3f5a77b2ec13494507b425d44a8f60, 0xf86bd1865945b1d86dedb03ce40d2d9b3a14358f, 0xb8ea8bdf42629587be3b67260cce0d2383b81330, 0x2c461674652d4d4586841887f6728f62c138fca6, TDNF7CwfcKvgtaRPrMg4isijtf73kr8uRA, TB2kmKaAh5BQ1ynFbGMcYvAavL62Ws862n, T9yzecVr8uhMZ46JHBFUi6qzK5zqPnqchL, TKBLWEB2CVk1LWdbi8SHfnF2XeUWExvpod, TYZ8AP4caGYmccXwexziAgr2x5CsGTxFws, TXaqYL2WLXHCYwdCTLQ2Vhh4E4mUqgFUX4, TUgwcLY3uV3bXD8quu1ymLUCec4mCXNv6a, TYKpPVSBQAdHpFLF4Sf9yG4Qkb71EVpeFc
See more (35)
TJ1Dzg742PXAp4gV7FxUZeCJtiDgaSZhGk, TUoVsNvkSbCQFty1tLViCgvMjNRGGEK6eM, TMfBqjTDEAd2HpeeSNtaAGzWixpQCAyQxY, TPME13GsWU7cnP53yHNS2hVJBK1cedWBKw, 0xcd684d22e8c3600e6ee93b5a57923c3b517f3396, 0x5f35678d1618c8ff902272111fc88384952048c1, 0x4784c6f0ac85643eb742153fa346eefa1ad1c096, 0xb09b0daba8fa67e077390199e6745bd57caf7c62, 0xe55d10dfef2f7f71e130944821d003693e62787a, TNFUrTqcBXdY77sriXjtbLcU3S3BNSHBvC, 0xe0a28bea2ad45c8c14de33a454d30d14442598a1, 0x049a297dc430f6e29f2616ce1b422cb5770a7510, 0xc84a750ad92cb7d509a5d9a0d1f69131b211622d, bc1qxtl05lnr7jewlcg95yjq8k8llenyhsem0hdpp0, bc1qeeld470e89fuuqtce7wc2jy457z8e8nr82atq5, bc1qrupla0a2cvn933jyln2w74n65cc2smhyfd065l, bc1qm3s8xmyzpa050vw96l9vja66f5ngl5endc6asf, bc1q3yvsrtafwc8h87lp7jlwn0yua4aqmehlpv3r83, bc1qvmnnu4jxrmgc2n3u7ph234hmc9hp2a3rk6hf9e, rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn, r3ZqSCQ1MdYUc498XDW3gsumeN4PPJawAR, rUMntqQwnFM3KQHHi3zBZFPW6981QqQs4C, rMYVWrwcLLNzJ9mtBuGDfoLUbF4cQnUABQ, 0xad456c79732e0e0b2fc1d1368b9069b4bb08e8b5, 0xb77d96c8676abdb1b2eec3a5a41a028e8e722c61, 0x03b0ee5d82990cff1bda48651ac3e436d1a020ea, 0xa3b3dee870f01560fdbe5af659c9c9135748886f, 0x6abec14ec8dba805c3bc2e9133214a3c7688cc3f, 0x4bd7a51d216e7d406811b11ffc8e1caad452b29f, 0xa32668de8843533dd15af7f29cfaacdfdc42a675, 0x13723799ec02d2ab3933be11c7eb7c9904eac7c1, 0x56c3b3224973dc7240877e630f37a160a5332714, 0x1192093ad796156e29025af779542d6de62d7a16, 0x2ef0f69cb884a0bd8a64a6cf88c61e716f87f033, 0x62b16e7eb76be5adbe544659cf246ff870ffc82eLinked reports: Binance hot wallet drain (29 Oct 2026): EIP-7702 takeover of Binance 14, Tornado-funded attacker, collector 0x5227f603…2f8c and frozen funds, Binance hot wallet drain (29 Oct 2026), follow-up: 28 more attacker wallets on Ethereum, Avalanche and Tron, Bitget exchange hack - official attacker receiving addresses