- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: Binance
- Incident date: 2026-10-29
- Reported: 2026-10-29
- Last updated: 2026-10-29
Binance hot wallets on Ethereum, Arbitrum and Avalanche were drained on 29 October 2026, starting at 20:20:59 UTC. Funds went to one collector address, 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c, which Etherscan labels "Binance Hot Wallet Exploiter 2". Tether and Circle froze stablecoins in that address and in several of the wallets that received funds from it. Large amounts of ETH and AVAX were not frozen. Attacker-side addresses in this report: - 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c (collector on Ethereum, Arbitrum and Avalanche; Exploiter 2) - 0…
Other addresses in this report: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c, 0x7c8601d4645b93cea45f71e118a729332e6b5ca0, 0x63e842b054bd624a465454d533c33f573e9c6fae, 0x19bee294a6daab49c9e5ab69a5da6c035c70f2bf, 0xe4f9070e1316de2988fc6f869fead8fb99cc74cd, 0xfd41da53d1175b29d40599a0e63545067f58f408, 0x8532fa14acaf483729c449b8458aeddb900543d4, 0x8d53903625b8e839b9df4bd28b0efb1cd6b8639a, 0x77edef23fbd05921c26fe29fcc3a65e14d2ac3eb, 0x7aa4d3029e4c6a8e916300014ad95b6d6c03bfd1, 0xccbef95633adb5cd2b5038db5a38d77e726ca263, 0xb171ca86f82070282138352ff7111b494060c8c3, 0x9749292d74fd460982d0912ea9515ea24736c762, 0x0ddf0480016e6bcb2c1f5d190d221fba1320697e, 0x811f15855476156ebf86ba3b84fafb8ceaa4e84c, 0xaa246bf639586a6ba46762d378ce50ca4fc654a0, 0x80358c5b8f9b2cc27147a1e0f2a6c9a30eb2c397, 0x897c80d1a9729e94460e2bd93178bd5215158df3, 0x3e2bf1ac6bf0934bbba6456c341c2ecbced632d5, 0xc887af690e0301cd4edbbce8f8d31b4ec65b286a