The Binance HackReconstructed, step by step

On October 29 a wallet funded only through Tornado Cash attached its own code to Binance 14, one of the exchange's main Ethereum hot wallets, and swept it in a single transaction. Every step had been rehearsed on mainnet that afternoon. This report rebuilds the whole attack from the Ethereum record and 53,181 posts, step by step.

Download the report · PDF, 77 pages Data and code on GitHub

6h 29mfrom the first rehearsal to the delegation

1 of 50signed authorizations took effect

3h 49mattacker code live on Binance 14

8 minfrom the sweep to the first public post

The whole hack on one page

Forty hours, six lanes, one clock

Gantt chart of the Binance hack: funding, rehearsals, the attack on Binance 14, issuer freezes, Binance statements and social posts, October 28 to 30, 2026 — Left: the setup, Oct 28 06:00 to Oct 29 20:00. Right: the attack night at about 9.5 times the scale. Every mark is a verified transaction or a timestamped public statement.

Inside the report

Six acts, then the public record

IThe setupOct 28 07:39 to Oct 29 18:20

Mixer funding, two sweeper contracts, two full rehearsals.

IIThe drain20:05 to 21:00

Delegation, one sweep, 823M USDC through a trusted wallet.

IIIThe open door20:24 to 00:10

Re-sweeps, 533 incoming transfers, then revocation.

IVThe response21:05 to 00:52

Issuer freezes, Binance statements, withdrawals paused.

VThe moneyread live, 03:20 UTC Oct 30

About $2.66B frozen or recovered; about $2.83B unfrozen in traced addresses.

VIThe public record20:32 onward

How posts reconstructed each step, and how fast.

Flow of traced funds by chain into frozen or unfrozen status — Where the funds went. US dollars at CoinGecko spot, 03:22 UTC Oct 30. The BTC, Tron, XRP and SOL legs are attributed to Binance by Whale Alert labels.

Open data

Every table behind the report

Dataset	What it holds	Download
Timeline events	Every event on the timelines: time, lane, detail, first public post.	Parquet CSV
Step-by-step acts	The six acts as timestamped steps.	Parquet CSV
Verified positions	Every traced balance, read live on six chains, with freeze status.	Parquet CSV
Top posts and accounts	The most-engaged posts of the event window: account, network, followers, engagements, link.	Parquet CSV
Raw on-chain reads	About 220 requests and responses, each with its UTC time, replayable.	Browse
AI guide	Schemas, key facts and quoting rules for assistants and analysts.	.md

How we built it

Every number traces to a transaction, a live read or a post

Ethereum transactions, receipts, contract code and the 50 authorizations were decoded from a public JSON-RPC node, with address histories from the Blockscout API. Balances were read live between 03:20 and 03:27 UTC on October 30 on Ethereum, Bitcoin, Tron, XRP Ledger, Solana and Arbitrum, and freeze status was read from each token contract. Social data comes from LunarCrush across X, TikTok, YouTube, Instagram, Reddit and news; each on-chain step is matched to the first public post that described it.

git clone https://github.com/JoeVezzani/binance-hack-reconstructed
cd binance-hack-reconstructed
python3 verify/replay_reads.py          # replay every on-chain read
pip install -r requirements.txt
cd build && python3 build_report_v2.py   # rebuild the PDF