Binance and Bitget hacks: commingling wallet and linked wallets on Tron, Ethereum, Bitcoin, XRP, Avalanche, OP, Polygon and Base (30 Oct 2026)
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: Binance, Bitget
- Incident date: 2026-10-30
- Reported: 2026-10-30
- Last updated: 2026-10-30
ZachXBT says stolen funds from the Binance exploit and the Bitget exploit were commingled at one Ethereum address, 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7, after arriving through THORChain (https://x.com/zachxbt/status/2116030284261179538, posted 04:51 UTC on 30 October 2026). This report files that address, the wallets now holding its ETH, and linked wallets on Ethereum, Tron, Bitcoin, XRP Ledger and Avalanche. It links the BlockintAI Binance reports (https://blockint.ai/c3?report=cad68b7e-53fd-4072-b113-30196922d5e0, https://blockint.ai/c3?report=b6debab5-a058-4076-9223-31b7c81349dc) and…
Other addresses in this report: 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7, 0xe5cec77934a9aa7a5c63692965a1f07ab933ad29, 0x3912c37412baae4c7abe2e969298b9c55a6c912f, 0x7dcb564ae3ab5f25fda877882a4739e597a377e2, 0x181a9d83f78e38c573c824088879da346cc3e08e, 0xc9cd1054d89d6faf75b22f0bd0c0fef44a274c7c, 0x3a793b6ffea212acc8e2d2b9b45a3db7c9c4248d, 0x3a2c6bbe9775fff0cc8ada21d2c565928c5b8a65, 0x415e50c7cc3f5a77b2ec13494507b425d44a8f60, 0xf86bd1865945b1d86dedb03ce40d2d9b3a14358f, 0xb8ea8bdf42629587be3b67260cce0d2383b81330, 0x2c461674652d4d4586841887f6728f62c138fca6, TDNF7CwfcKvgtaRPrMg4isijtf73kr8uRA, TB2kmKaAh5BQ1ynFbGMcYvAavL62Ws862n, T9yzecVr8uhMZ46JHBFUi6qzK5zqPnqchL, TKBLWEB2CVk1LWdbi8SHfnF2XeUWExvpod, TYZ8AP4caGYmccXwexziAgr2x5CsGTxFws, TXaqYL2WLXHCYwdCTLQ2Vhh4E4mUqgFUX4, TUgwcLY3uV3bXD8quu1ymLUCec4mCXNv6a, TYKpPVSBQAdHpFLF4Sf9yG4Qkb71EVpeFc
See more (35)
TJ1Dzg742PXAp4gV7FxUZeCJtiDgaSZhGk, TUoVsNvkSbCQFty1tLViCgvMjNRGGEK6eM, TMfBqjTDEAd2HpeeSNtaAGzWixpQCAyQxY, TPME13GsWU7cnP53yHNS2hVJBK1cedWBKw, 0xcd684d22e8c3600e6ee93b5a57923c3b517f3396, 0x5f35678d1618c8ff902272111fc88384952048c1, 0x4784c6f0ac85643eb742153fa346eefa1ad1c096, 0xb09b0daba8fa67e077390199e6745bd57caf7c62, 0xe55d10dfef2f7f71e130944821d003693e62787a, TNFUrTqcBXdY77sriXjtbLcU3S3BNSHBvC, 0xe0a28bea2ad45c8c14de33a454d30d14442598a1, 0x049a297dc430f6e29f2616ce1b422cb5770a7510, 0xc84a750ad92cb7d509a5d9a0d1f69131b211622d, bc1qxtl05lnr7jewlcg95yjq8k8llenyhsem0hdpp0, bc1qeeld470e89fuuqtce7wc2jy457z8e8nr82atq5, bc1qrupla0a2cvn933jyln2w74n65cc2smhyfd065l, bc1qm3s8xmyzpa050vw96l9vja66f5ngl5endc6asf, bc1q3yvsrtafwc8h87lp7jlwn0yua4aqmehlpv3r83, bc1qvmnnu4jxrmgc2n3u7ph234hmc9hp2a3rk6hf9e, rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn, r3ZqSCQ1MdYUc498XDW3gsumeN4PPJawAR, rUMntqQwnFM3KQHHi3zBZFPW6981QqQs4C, rMYVWrwcLLNzJ9mtBuGDfoLUbF4cQnUABQ, 0xad456c79732e0e0b2fc1d1368b9069b4bb08e8b5, 0xb77d96c8676abdb1b2eec3a5a41a028e8e722c61, 0x03b0ee5d82990cff1bda48651ac3e436d1a020ea, 0xa3b3dee870f01560fdbe5af659c9c9135748886f, 0x6abec14ec8dba805c3bc2e9133214a3c7688cc3f, 0x4bd7a51d216e7d406811b11ffc8e1caad452b29f, 0xa32668de8843533dd15af7f29cfaacdfdc42a675, 0x13723799ec02d2ab3933be11c7eb7c9904eac7c1, 0x1192093ad796156e29025af779542d6de62d7a16, 0x2ef0f69cb884a0bd8a64a6cf88c61e716f87f033, 0x62b16e7eb76be5adbe544659cf246ff870ffc82e, 0x294828705974ad04d86a24a2ff6efe762505a0edLinked reports: Binance hot wallet drain (29 Oct 2026): EIP-7702 takeover of Binance 14, Tornado-funded attacker, collector 0x5227f603…2f8c and frozen funds, Binance hot wallet drain (29 Oct 2026), follow-up: 28 more attacker wallets on Ethereum, Avalanche and Tron, Bitget exchange hack - official attacker receiving addresses