Binance hot wallet drain (29 Oct 2026): EIP-7702 takeover of Binance 14, Tornado-funded attacker, collector 0x5227f603…2f8c and frozen funds
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: Binance
- Incident date: 2026-10-29
- Reported: 2026-10-29
- Last updated: 2026-10-29
Binance hot wallets on Ethereum, Arbitrum and Avalanche were drained on 29 October 2026, starting at 20:20:59 UTC. Funds went to one collector address, 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c, which Etherscan labels "Binance Hot Wallet Exploiter 2". Tether and Circle froze stablecoins in that address and in several of the wallets that received funds from it. Large amounts of ETH and AVAX were not frozen. Attacker-side addresses in this report: - 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c (collector on Ethereum, Arbitrum and Avalanche; Exploiter 2) - 0…
Other addresses in this report: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c, 0x7c8601d4645b93cea45f71e118a729332e6b5ca0, 0x63e842b054bd624a465454d533c33f573e9c6fae, 0x19bee294a6daab49c9e5ab69a5da6c035c70f2bf, 0xe4f9070e1316de2988fc6f869fead8fb99cc74cd, 0xfd41da53d1175b29d40599a0e63545067f58f408, 0x8532fa14acaf483729c449b8458aeddb900543d4, 0x8d53903625b8e839b9df4bd28b0efb1cd6b8639a, 0x77edef23fbd05921c26fe29fcc3a65e14d2ac3eb, 0xccbef95633adb5cd2b5038db5a38d77e726ca263, 0xb171ca86f82070282138352ff7111b494060c8c3, 0x9749292d74fd460982d0912ea9515ea24736c762, 0x0ddf0480016e6bcb2c1f5d190d221fba1320697e, 0x811f15855476156ebf86ba3b84fafb8ceaa4e84c, 0xaa246bf639586a6ba46762d378ce50ca4fc654a0, 0x80358c5b8f9b2cc27147a1e0f2a6c9a30eb2c397, 0x897c80d1a9729e94460e2bd93178bd5215158df3, 0x3e2bf1ac6bf0934bbba6456c341c2ecbced632d5, 0xc887af690e0301cd4edbbce8f8d31b4ec65b286a