Binance Hack Investigation | Update #02
Investigators have identified where approximately $3.1 billion of the stolen cryptocurrency was held after the Binance hack.
According to Bitquery's on-chain investigation, at 03:54 UTC on 30 October:
- Approximately 490,361 ETH was held across attacker-linked wallets.
- Approximately 18,270 BTC was held across 19 Bitcoin addresses.
- The rest was held on other chains: approximately 682.7 million TRX, 233.5 million XRP and 970,549 SOL.
- Several of the largest Ethereum holding wallets had made no outgoing transfers.
- No transfers to exchanges, mixers or bridges had been identified from the remaining holdings.
One interesting finding: the attacker originally took approximately 200,630 ETH, but subsequently held more than twice that amount.
The additional ETH was acquired by converting stolen stablecoins and other tokens.
Our focus now is on tracking movement from these holding addresses and distinguishing actual transfers from internal consolidation, swaps and recovery actions.
Two Ethereum addresses worth monitoring:
Wallet 1:
https://etherscan.io/address/0x8532FA14ACAf483729C449b8458aedDb900543D4
Wallet 2:
https://etherscan.io/address/0xc887aF690E0301CD4edBbCe8F8d31b4EC65B286A
These balances represent a historical snapshot and will change if funds move.
Investigators have identified where approximately $3.1 billion of the stolen cryptocurrency was held after the Binance hack.
According to Bitquery's on-chain investigation, at 03:54 UTC on 30 October:
- Approximately 490,361 ETH was held across attacker-linked wallets.
- Approximately 18,270 BTC was held across 19 Bitcoin addresses.
- The rest was held on other chains: approximately 682.7 million TRX, 233.5 million XRP and 970,549 SOL.
- Several of the largest Ethereum holding wallets had made no outgoing transfers.
- No transfers to exchanges, mixers or bridges had been identified from the remaining holdings.
One interesting finding: the attacker originally took approximately 200,630 ETH, but subsequently held more than twice that amount.
The additional ETH was acquired by converting stolen stablecoins and other tokens.
Our focus now is on tracking movement from these holding addresses and distinguishing actual transfers from internal consolidation, swaps and recovery actions.
Two Ethereum addresses worth monitoring:
Wallet 1:
https://etherscan.io/address/0x8532FA14ACAf483729C449b8458aedDb900543D4
Wallet 2:
https://etherscan.io/address/0xc887aF690E0301CD4edBbCe8F8d31b4EC65B286A
These balances represent a historical snapshot and will change if funds move.