Foreword
Billions of dollars in digital assets were transferred out, yet the wallet private keys have not been confirmed to have been leaked. This is the most compelling question surrounding the Binance security incident: how exactly did the attackers bypass the security boundary between the company's internal systems and on-chain wallets to convert certain access permissions into effective asset transfer capabilities?
According to Binance's initial disclosure, the incident may have started with the compromise of a DevOps engineer's laptop, subsequently affecting internal service containers and unauthorized withdrawal processes. Meanwhile, TRM Labs attributed a high degree of confidence in the incident to the North Korean-related threat activities of TraderTraitor; on-chain investigators also raised suspicions related to Lazarus. These assessments provide context for the incident but do not replace the technical verification of every key transaction, nor do they directly prove the identity of the actual operator.
GCSA's special forensic investigation chose a different approach: instead of focusing on the total amount of loss or attacker attribution, it returned to publicly verifiable transactions, signatures, and states. The study reviewed 18 original transactions and their outer signatures, verified 50 initial authorization signatures and 1 revocation authorization signature related to Binance 14, and tracked the specified block states of delegated calls, asset transfers, zero-address revocations, and frozen wallets.
One type-4 transaction contained 50 authorizations, but this does not mean that all 50 delegations were actually effective; a valid signature proves signing capability but cannot deduce whether the private key was stolen or which internal system initiated the request. GCSA further verified three consecutive transactions associated with MetaMask Gas Station: the deposited ETH precisely matched the maximum gas budget of the subsequent two transactions, providing verifiable evidence for analyzing third-party service interactions. However, the claims that "the attacker mistakenly selected USDT," that MetaMask possesses a real IP address, and that identity was locked by IP address are currently only unverified speculations.
This is also the main difference between this report and general event reporting: it clearly separates "observed on-chain facts," "evidence-based technical inferences," and "root causes and attribution that still require off-chain verification." The review of key Ethereum chains is not a full audit of all ten chains; assets being blacklisted does not equate to recovery; and the estimated impact of the event, approximately $6.3 billion, cannot be directly regarded as the final net loss.
The lessons learned from this incident extend beyond a single exchange. The boundaries of digital asset security have long since expanded from the private keys themselves to terminal devices, signature services, permission approvals, continuous delivery environments, and third-party infrastructure. While a public ledger can reconstruct how assets moved, truly answering the questions of "how permissions were breached and who was operating behind the scenes" still relies on a complete chain of on-chain and off-chain evidence.
Key findings of GCSA
Authorization Mechanism: All 50 EIP-7702 signatures were verified as valid signatures for their respective wallets. However, the validity of a signature and the actual execution of authorization are two separate issues, and this cannot be used to directly conclude that the private key has not been leaked.
Funding Path: The report examined some Ethereum asset transfers on Binance 14 and Hot Wallet 34; it covered key transaction samples rather than independent write-offs of total cross-chain losses.
Gas Station: The associated recharge amount precisely matches the maximum gas budget of the two transactions. This may prompt you to legally preserve service logs, but it does not imply that the IP address has been obtained or the true identity has been confirmed.
Status of handling: The report verified the revocation of the entrustment, the USDT blacklist, and the target wallet balance; the revocation of authorization, asset freezing, and actual return are different evidentiary matters.
Scope of Study: This independent review focuses on key Ethereum transactions. The root cause of the intrusion, the full cross-chain write-off, the actual amount recovered, and the attacker's identity still require further evidence.
GCSA Binance Cyber Attack Investigation Report
October 30, 2026 | Full Event Recap and Review of Key Ethereum Links | Version 2.0
Data retrieval deadline:2026-10-30 14:03 JST (Japan, UTC+9) / 2026-10-30 05:03 UTC.
On-chain state anchor:Block 26303316, 2026-10-30 04:55:47 UTC. This report is an updated snapshot as of the above time.
Key conclusions
This incident has resulted in an official disclosure and cross-chain investigation report of a platform-level security incident. Key on-chain evidence supports Binance 14's EIP-7702 delegation, asset transfer, and subsequent zero-address revocation; however, the complete root cause of the intrusion, the final net loss, and the actual amount recovered are still not fully understood.
| Key points of the investigation | Conclusion of this edition |
|---|---|
| Official statement on the incident | Binance estimates the total impact at approximately $6.3 billion, with about $3 billion frozen on-chain; the announcement states that SAFU and company funds will cover the losses, and deposits and withdrawals will be suspended. [S01] |
| Intrusion path | Preliminary official investigation suggests the incident may involve compromised DevOps laptops, access to service containers, and unauthorized withdrawals; however, no evidence of private key leakage has been found. This is not the final conclusion regarding the root cause. [S01] |
| Ethereum Delegation and Revocation | This review confirmed that the hashes of all 18 original transactions matched the outer signature; all 50 initial authorizations and 1 revocation signature were restored to Binance 14. See pages 7–8 for details. [E01] |
| Latest key frozen balance | The target address remains on the USDT blacklist, with a balance of 174,999,872.327620 USDT; an increase of 0.000100 USDT from the previous snapshot. Freezing does not equate to a refund. [E01] |
| Attribution of Attacks to Organizations | Research institutions have already proposed high-confidence attributions; the names of the institutions, the degree of public disclosure of evidence, and the boundaries of law enforcement confirmation must be preserved, see page 5 for details. |
Report Scope and Reading Guide
The original report retains the structure of "evidence methods, address, authorization, revocation, gas station, cash flow, path diagram, item-by-item index, and unclosed evidence," but adds a full event timeline, monetary scope, business impact, and progress of handling. The original template identifiers are only used to maintain document continuity and do not indicate that this update has been separately signed by the institution.
Pages 2–5: Methodology, Timeline, Total Amount and Attribution; Pages 6–11: On-chain Special Project; Pages 12–13: Impact and Subsequent Verification; Pages 14–15: Index of the Original 18 Transactions and New Transaction Additions; Pages 16–17: Source and Attachments.
Evidence Methods and Updates in this Version
Source level identifiers: E = This public on-chain query; S = External public source; O = Original report provided by the user.
| grade | Methods used | Supportable conclusions |
|---|---|---|
| E01 Current Node Data | Save request, response, source, and fetch time; read fixed blocks. | Specific transaction fields, events, signatures, and specified block status; not self-built node consensus proof. |
| S Official/First-party | Binance announcements, protocol specifications, service documentation, and risk team statements. | This proves that the institution made the relevant disclosures; its preliminary investigation and valuation do not automatically become independent audit conclusions. |
| S Research/Media | Data from TRM, Reuters, and other sources were used to record the statistical points in time. | Cross-chain scale, external attribution, and response progress; third-party investigations were not fully redone. |
| O01 Original Report | A 10-page v1.0 PDF provided by the user. | The original structure and investigative leads have been preserved; the old evidence package mentioned in the original report was not provided with this document. |
Substantial updates compared to v1.0
The update adds a platform-wide and cross-chain perspective; separates the official preliminary investigation from on-chain facts; re-encodes and verifies the original 18 transaction hashes, outer signatures, and 51 authorized signatures; updates the key USDT state anchor to 26303316 and adds the newly discovered micro-transaction T19. The original numbering remains unchanged for easy comparison.
This limitation and irreplaceable evidence
The two domains of PublicNode belong to the same provider and cannot be considered as two independent node sources; access to the other provider failed. Partial queries regarding historical codes and historical balances returned HTTP 403, therefore, replay of the state before and after reversal or independent EVM step-by-step execution was not completed. Failure responses are also retained.
Some web pages have limited direct access; the main text is retrieved through the search service's page index. When the original post has access restrictions, it is only cited using attributive media. Reports differentiate between event occurrence time, report publication time, query time, and on-chain block time. If the announcement does not specify a timezone, no forced conversion is made.
This investigation did not involve access to internal terminals, HSM/MPC, approval systems, customer accounts, or law enforcement materials. There were no signed or broadcast transactions, and no asset transfers, authorization revocations, or external evidence requests were triggered. The causes of any internal system issues or the identities of any individuals involved cannot be determined solely by this public inquiry.
Full event timeline
On-chain precise time is based on UTC; JST = UTC+9, Beijing/Hong Kong time = UTC+8.
| UTC | Japan Time JST | Events and Evidence |
|---|---|---|
| 10-29 20:05–20:09 | 10-30 05:05–05:09 | The XRP Ledger transfers reported by TRM were among the earliest; they were not part of this independent cross-chain signature verification. [S02] |
| 10-29 20:20:59 | 10-30 05:20:59 | Binance 14 Authorization Transaction T02: A type-4 transaction containing 50 authorizations. [E01] |
| 10-29 20:24:23 | 10-30 05:24:23 | The first round of bulk transfers was T03; the starting point for key Ethereum funding chains. [E01] |
| 10-29 20:30:11 | 10-30 05:30:11 | The main collection address distributed 500 million USDT, T04. [E01] |
| 10-29 20:41:23 | 10-30 05:41:23 | Hot Wallet 34 transferred out 780 million USDC, T05. [E01] |
| 10-29 20:58–21:01 | 10-30 05:58–06:01 | Aave's risk team disclosed an attack on a linked wallet for collateralized lending. [S04] |
| 10-29 21:08:23 | 10-30 06:08:23 | The target wallet received 175 million USDT, T07. [E01] |
| 10-29 21:12:59 | 10-30 06:12:59 | The Gas Station transaction is associated with three consecutive transactions T09–T11 within the same block. [E01] |
| 10-29 21:14:59 | 10-30 06:14:59 | The target wallet has been blacklisted by USDT, T13. [E01] |
| 10-29 21:46:23 | 10-30 06:46:23 | The target wallet can still transfer ETH (T15); USDT blacklisted addresses are frozen. [E01] |
| 10-30 00:10:35 | 10-30 09:10:35 | Binance 14 Zero-address order cancellation transaction T17. [E01] |
| 10-30 02:52:11 | 10-30 11:52:11 | Original report status anchor point: Block 26302699. [O01] |
| 10-30 04:55:47 | 10-30 13:55:47 | The current fixed anchor point is block 26303316. [E01] |
Binance's security notification page shows 2026-10-30 02:23, but the time zone is not specified and no absolute timeline is inserted. The time of the first known transaction on a particular chain, the first media report, or the announcement cannot be used to determine the start time of the entire intrusion.
Definitions of loss, freeze and recovery
The main table of totals retains the original definitions for each source; all US dollars refer to USD.
| Source/Time Point | Numerical values and properties | How to interpret |
|---|---|---|
| Binance Security Notice [S01] | Approximately 6.3 billion: Total impact estimated; Approximately 3 billion: Already frozen. | There is no publicly available address-by-address reconciliation ledger, so the final net loss is not calculated based on this. |
| TRM [S02] | 6.36 billion: based on the exchange rate at the time of transfer; 6.23 billion: subsequent valuation of the same batch of assets. | Statistics cover ten chains, and changes in valuation are different from new theft and misappropriation. |
| Chainalysis / Reuters [S03] | At least 5.912 billion; as of 00:30 UTC | The amount is not added to the amount of other institutions because of the difference between "at least" and the coverage. |
| The original report and this RPC [O01/E01] | Only covers specified Ethereum transactions and target balances | Local receipts can be accurate to the smallest unit, but they cannot directly represent the entire event. |
Cross-chain scope and current survey coverage
TRM lists the scope as Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. Its key observation is the parallel operation of multi-chain ordinary signature transfers and Ethereum's delegation mechanism; this report's independent review focuses on Ethereum and does not claim to have completed transaction-by-transaction signature verification for the other nine chains. [S02 / E01]
Freezing party and handling procedures
| main body | Publicly available information already obtained | limit |
|---|---|---|
| Tether / Circle | Reuters quoted: The former is nearly $1.57 billion, and the latter is over $800 million. [S05] | Earlier snapshots may contain multiple chains; they cannot be added to the official total frozen amount. |
| WLFI / BitGo | Media reports quoted He Yi as saying: 27 million USD1 and approximately 2 million USD in WLFI. [S06] | The number of tokens, their dollar valuation, and the issuer should be listed separately. |
| Arbitrum | The report cites: 74,559,805 ARB and approximately 8,425 ETH were frozen in an intermediary wallet. [S07] | This falls under specific L2 governance and disposal; it has not been returned to Binance. |
"Freezing" means that the movement of assets is restricted; "recovery" requires verifiable return or legal takeover; "compensation" requires evidence of receipt or payment. 63 - 30 = $3.3 billion is merely an arithmetic difference between two approximations and cannot be considered the final net loss, compensation shortfall, or the attacker's current holdings.
Intrusion path and attack organization attribution
Separate on-chain capabilities, internal root causes, institutional attributions, and judicial determinations.
| advocacy | Current status of evidence | This report states |
|---|---|---|
| DevOps Notebook → Service Containers | Binance's initial investigation. [S01] | Possible initial intrusion path; no device image, access logs, or complete technical review were obtained. |
| Private key has been leaked | The valid signature is visible; the private key itself is not visible. | On-chain systems cannot distinguish between key leaks, abuse of signature services, and manipulation of approval processes. |
| EIP-7702 Protocol Vulnerability | The valid entrustment and subsequent transfer are visible. [E01/S08] | The authorization mechanism was used for asset control, but the vulnerability in the protocol implementation was not proven. |
| TraderTraitor / North Korean Attribution | TRM's high-confidence assessment claims to combine on-chain and off-chain intelligence. [S02] | Using "TRM attribution," without writing a cost report, independently confirming or closing the case. |
| MetaMask Real IP / Personnel Identity | Only transaction patterns and external labels are available. | Without verification of server logs and legitimate identity, one cannot claim to have obtained a real IP address or locked down a person. |
The most evidence-supported technical narrative currently available
A valid delegated signature exists for Binance 14, and the submitter places these signatures into a type-4 transaction. Subsequently, an external call is executed within the delegated account context, resulting in a bulk asset transfer. On-chain documentation details "what happened"; however, off-chain evidence is still needed to explain how the signatures were generated, who controlled which device, and how the approval system failed.
The batch nonce window may be used to adapt to high-frequency trading accounts; this is one explanation, and it cannot be concluded from 50 authorizations alone that "the attacker did not have the private key" or "could only access the signature interface." Similarly, the official statement that "no evidence of leakage was found" does not prove that all keys were never exposed.
The causal chain still needs to be closed
Evidence of terminal intrusion → Identity and session acquisition → Service container access → Business request/approval → Actual signature record → On-chain transaction. This process must be chained together using request ID, signature digest, time synchronization, and immutable logs; a single transaction hash cannot replace the entire internal attack path.
Core address
The address name retains the original report and block explorer label; the label is not an attribution field in the blockchain consensus.
| Role | Full URL (clickable to open in browser) |
|---|---|
| Binance 14 | 0x28c6c06298d514db089934071355e5743bf21d60 |
| Authorization submission and invocation address | 0x7c8601d4645b93cea45f71e118a729332e6b5ca0 |
| Delegation code address | 0x63e842b054bd624a465454d533c33f573e9c6fae |
| Main collection address | 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c |
| First transit address | 0x9749292d74fd460982d0912ea9515ea24736c762 |
| Second transit address | 0x811f15855476156ebf86ba3b84fafb8ceaa4e84c |
| Key target address | 0xaa246bf639586a6ba46762d378ce50ca4fc654a0 |
| Hot Wallet 34 | 0xee7ae85f2fe2239e27d9c1e23fffe168d63b4055 |
| Gas Station Top-up Address | 0xb42f812a44c22cc6b861478900401ee759ebead6 |
| Gas Station Payment Address | 0xe3478b0bb1a5084567c319096437924948be1964 |
| USDT contract (Ethereum) | 0xdac17f958d2ee523a2206206994597c13d831ec7 |
| T10 approval spender | 0x6131b5fae19ea4f9d964eac0408e4408b66337b5 |
Transaction relationships can prove what actions occurred between addresses; one cannot determine the liability of a common controller, joint criminal activity, or service provider solely based on receipts, fee payments, address tags, public service connections, or dust transfers. [O01/E01]
Verification of 50 authorized items
Corresponding to T02; the original order of the authorizationList is preserved, and the browser's sorting is not used to replace the original order on the chain.
T02 is located in block 26300753, index 138; time is 2026-10-29 20:20:59 UTC. Sender 0x7c86…5ca0, receiver Binance 14, outer nonce=1069, input=0x, receipt successful. [E01]
This is50 authorizations within a single type-4 transaction, not 50 authorization transactions. All chain_ids are 1, all delegates are 0x63e8…6fae; nonces are in reverse order from 18,914,824 to 18,914,775.
| Original Index | nonce range | Expected processing |
|---|---|---|
| 0–14 | 18,914,824 → 18,914,810 | The current nonce is higher than the one reconstructed in the original report; skip. |
| 15 (Item 16) | 18,914,809 | Matches this state; sets a delegate, and increases the account nonce to 18,914,810. |
| 16–49 | 18,914,808 → 18,914,775 | Below the updated nonce; skip. |
T01 for the same block index 133 uses Binance 14 nonce 18,914,808. The original report reconstructed the pre-grant nonce based on this and cross-checked it with browser validity records. This time, the full block and grant fields were retrieved again, but there is no independent historical stateDiff/trace, therefore "Item 16 takes effect" must retain the method boundary. [O01/E01]
Signature and execution validity are two types of checks.
All 50 initial authorization signatures were restored to Binance 14; the authorization for the revoked transaction also matched. Signature restoration checks whether the corresponding key was validly signed; execution validity also depends on the nonce, code, and chain ID at the time. 50 valid signatures do not mean all 50 were executed. The appendix retains the item-by-item results and the original order. [E01]
The authorization digest is calculated using keccak256(0x05 || RLP(chain_id, delegate, nonce)). The protocol places authorization processing before execution; failure of the outer execution will not automatically revoke an already effective delegation, therefore, receipt.status alone cannot be used to determine whether the authorization was successful. [S08]
Cancellation and delegated invocation at 00:10
This corresponds to T17; canceling the entrustment and recovering funds, as well as canceling the ERC-20 allowance, are different operations.
| Fields | The value obtained this time |
|---|---|
| Block/Time | 26301896, Index 190; 2026-10-30 00:10:35 UTC (JST 09:10:35). |
| Outer layer send and receive | All are Binance 14; type 4; outer nonce 18,914,903. |
| Authorization | chain_id=1; nonce=18,914,904; target is an all-zero address. |
| Receipt / New Snapshot | status=1; Binance 14 code=0x for block 26303316. |
| Historical status restrictions | The eth_getCode query for 26301895 and 26301896 returned a 403 error; the historical state difference was not obtained. |
The outer nonce differs from the authorization nonce by 1, conforming to the processing order where the sender's nonce is incremented first. Zero-address authorization means clearing the delegation code. The transaction content, protocol rules, and subsequent empty code support the reversal conclusion, but cannot be described as an independent replay of the execution state before and after reversal. [E01/S08]
Risk boundary after cancellation
The interval between T02 and T17 is 3 hours, 49 minutes, and 36 seconds. After clearing the delegate, subsequent calls will no longer run the original code through that delegate; it will not revoke transferred assets, clear all ERC-20 historical allowances, or prove that the original signature infrastructure has been repaired.
Delegation contract invocation and source code credibility
The original report recorded the first round of selector 0x8a179be4, 65 entries in calldata (including ETH placeholders), and 64 receipt logs. Another call to selector 0x043ff9d2 in T05 involved Hot Wallet 34, and the receipt supported its transfer of 780,000,000 USDC to the main aggregation address. [O01/E01]
The original report stated that the browser's Target.sol was an AI reconstruction display from 00:30 UTC on October 30, 2026, and not the attacker's original source code. Without independent compilation matching and instruction-by-instruction tracing, it cannot be concluded that the source code and page tags alone are completely equivalent to the deployment logic. [O01]
MetaMask Gas Station Key Transactions
Block 26301011, 2026-10-29 21:12:59 UTC; T09–T11 are located consecutively at indices 85, 86, and 87.
| index | Behavior | Precise values |
|---|---|---|
| 85 / T09 | Recharge address → Target wallet | 33,667,835,195,600,075 wei (0.033667835195600075 ETH) |
| 86 / T10 | Target wallet → USDT approved | Spender: see address table; Credit limit: 2^256−1; nonce=0 |
| 87 / T11 | Target wallet → USDT transfer | Redirecting to 0xe347…1964; 127.672480 USDT; nonce=1 |
Maximum Gas Budget Verification
T10: 49,285 × 357,379,522,580 wei; T11: 46,503 × 345,233,327,425 wei. The sum of the two is 33,667,835,195,600,075 wei, exactly the same as the recharge in T09. [E01]
This checks the upper limit of gasLimit × maxFeePerGas. The actual cost for T10 and T11, calculated as gasUsed × effectiveGasPrice, totals 0.023108419450134449 ETH; this cannot be mixed with the maximum budget, nor can the exchange transaction be inferred based on the ETH limit and USDT payment amount. [E01]
Facts, strong inferences, and unproven matters
| level | This report judges |
|---|---|
| On-chain facts | Three consecutive transactions, identical exact budgets, and token approval and transfer logs. |
| Pattern Attribution | It follows the same payment method as Gas Station and is supported by the original report's browser tab; however, it was not directly confirmed by the MetaMask backend. |
| Unable to derive | The existence of ETH does not presume "mistakenly selected USDT", nor can it determine the client version, Sentinel entry point, IP address retention, or the actual operator. |
T08 shows that the target wallet received 2 ETH at 21:10:59 UTC. MetaMask's official documentation states that even with the native token, other tokens can be chosen to pay transaction fees; therefore, "already have ETH" and "use a third-party payment method" are not contradictory. [E01/S09]
Fields that can be legally linked later include bundle, request ID, quote, time, server access logs, and proxy chain. This is an evidence preservation suggestion and does not imply that any private logs have been obtained.
Fund flow and latest freeze status
The following are key links for Ethereum USDT; transit points are not counted as part of the total event loss.
| October 29, UTC | Path/Event | USDT quantity |
|---|---|---|
| 20:24:23 / T03 | Binance 14 → 0x5227…2f8c | 1,615,409,498.973240 |
| 20:30:11 / T04 | 0x5227…2f8c → 0x9749…c762 | 500,000,000 |
| 20:59:11 / T06 | 0x9749…c762 → 0x811f…e84c | 175,000,000 |
| 21:08:23 / T07 | 0x811f…e84c → 0xaa24…54a0 | 175,000,000 |
| 21:12:59 / T11 | Target wallet → 0xe347…1964 | 127.672480 |
| 21:14:59 / T13 | USDT AddedBlackList (Target Wallet) | The event itself does not include a balance. |
| Snapshot | Balance/Status | Evidence Interpretation |
|---|---|---|
| Old version 26302699 | 174,999,872.327520; true | As stated in the original report, the old evidence package was not provided; access to the same block is restricted this time. |
| This time 26303316 | 174,999,872.327620; true | 04:55:47 UTC anchor, new specified block eth_call response. [E01] |
| Difference between the two versions / T19 | +0.000100 USDT | A small transfer was made at 04:52:23 UTC on October 30th, in block 26303299. [E01] |
The original snapshot satisfies 175,000,000 − 127.672480 = 174,999,872.327520. The token sending address for T19 is 0xe347a7aa40f814469279760735c289cbcdbe1964, which is similar to the Gas Station receiving address only in the beginning and end; the complete address is different. It must not be mistakenly identified as a second payment from the service provider or an address jointly controlled by attackers.
The incremental query range is blocks 26302700–26303316. The inbound transaction was retrieved, but no USDT outbound logs for the target address were returned. This window query is consistent with the new snapshot, but it does not mean that the old block balance has been retrieved again.
Receive 20 ETH after T14; transfer back 21.995031755405165251 ETH on T15. The USDT blacklist does not freeze ETH or the entire Ethereum address. The second approval on T12 does not mean the exchange is complete.
The initial 167,464.247856558836135296 ETH was displayed via an internal browser call from the original report. Since there is no trace available this time, it will not be relabeled as independent evidence of this execution. The 780 million USDC in T05 differs from the externally reported total of approximately 823 million USDC.
Business Impact and Ecological Management
Record services, asset control, and user commitments separately; do not treat news headlines as the overall platform status.
| object | Information obtained up to the data cutoff date | Interpretation |
|---|---|---|
| CoinSecurity Global Deposit and Withdrawal | The latest official announcement still indicates a suspension; no clear announcement regarding resumption has been received. [S01] | The status is publicly disclosed, not real-time login or end-to-end availability testing. |
| Spot/Contract/Alpha | Media reports cite a precautionary halt to Alpha trading. [S06] | This does not mean that all spot and derivatives trading has ceased. |
| User funds/reserve | The official commitment is to cover the losses and update the reserve certificate after the repairs are completed. [S01] | The commitment is not based on individual user compensation payments or the latest full solvency audit. |
| Aave | The risk team announced a freeze on new loan issuance and borrowing; repayments, withdrawals, and liquidations continue. [S04] | Unlike the protocol pause, this source did not identify Aave itself as being compromised. |
| Regional entities | Binance TH stated that it operates independently and has preemptively suspended digital asset deposits and withdrawals; other services are operating normally. [S10] | Different legal entities/wallet systems cannot be automatically merged into the same scope of infringement. |
DeFi transmission risks
LlamaRisk reported that an attack-linked wallet borrowed approximately 19,762 WETH using 60 million USDT as collateral; its 01:00 UTC disclosed position was still over-collateralized. New positions have been frozen to limit further lending, but existing utilization, collateral prices, and liquidation risks still require continued monitoring. [S04]
Market impact should be treated as data at the point in time of the event.
Reuters reported that BTC and ETH fell during the incident, and other research indicated that valuations changed with price. This report does not attribute all market volatility following the incident to an attack, does not package historical intraday prices into real-time quotes at the time of report delivery, and does not provide trading directions based on these prices. [S03]
Current workable user communication guidelines
Deposit, withdrawal, and compensation arrangements are subject to the latest announcements from official channels; the old wallets and attack addresses in this report are only for identification and verification. Any external messages claiming "unfreezing verification" or "compensation collection" and requesting wallet connection, mnemonic phrase handing over, or fund transfers are not part of the processing procedures verified in this report.
Unclosed evidence and subsequent verification
The following are work priority suggestions and do not indicate that internal actions, asset freezes, or contact with service providers have been taken.
| Priority/Issue | Current status | Complete the conditions |
|---|---|---|
| P0 Initial Entry Point and Signature Source | According to the official preliminary investigation, on-chain signatures do not locate the device. | Terminal images, EDR, identity sessions, container and CI/CD logs, and signature/approval records are associated with digests. |
| P0 cross-chain signature permission | The study points out that multi-chain asset transfers have not been fully verified on a chain-by-chain basis. | Separate permissions for blockchain and wallet, complete address list and all abnormal signature requests. |
| P0 Undo and Restore Security | The new snapshot has an empty code; reading historical states remains restricted. | Verify the before and after states of archive nodes, stateDiff, and abnormal delegation/allowance checks and repairs. |
| P1 Total Amount / Frozen General Ledger | The figures from different institutions cannot be directly added or subtracted. | Transaction-level deduplication, chain/asset/address details, unified valuation time, freeze status, and return voucher. |
| P1 Gas Station Related | Strong support for on-chain mode; no backend confirmation. | Preserve the request time, bundle/request ID, price quote, and server logs, and verify them in accordance with the law. |
| P1 Organizational Attribution | There are signed, high-confidence studies that are not the conclusion of this study. | Publicly available, verifiable indicators, cross-event correlation evidence, and formal law enforcement determinations. |
| P2 Reserves / User Repayment | There was a commitment to cover losses, but no proof of completion has been received. | New reserve snapshots, liability caliber, actual supplementary assets, and user account reconciliation. |
Specific update trigger conditions for the next version of the report
Release official technical recaps or deposit/withdrawal recovery announcements; changes in freeze/refund status; obtain a deduplicated ledger across the entire chain; emergence of new, verifiable attribution evidence; or changes in the code, balance, or blacklist status of key addresses. Each update must retain the previous snapshot, rather than overwriting historical values.
This report is a one-time cutoff snapshot. No background monitoring or automatic update tasks were created; subsequent changes will not be automatically written back to the delivered PDF.
Transaction Index
The complete hash can be viewed by clicking on Etherscan; the transaction number is consistent with the original report. All RPC receipts for this transaction were successful.
T01 Binance 14 before authorization, normal transaction
UTC 10-29 20:20:59 | Block 26300753 | Index 133 | Status 0x1
0xca63641eaeb49779d80ba11ce4fe894d635f2e98c032e9efd5bb4ce304ae56da
T02 50 Items of Delegation and Authorization
UTC 10-29 20:20:59 | Block 26300753 | Index 138 | Status 0x1
0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b
T03 First Round Batch Transfer
UTC 10-29 20:24:23 | Block 26300770 | Index 189 | Status 0x1
0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3
T04 aggregated address distributed 500 million USDT
UTC 10-29 20:30:11 | Block 26300799 | Index 218 | Status 0x1
0x68d7d69deaeb9750c38020b4f8d3728146ca8d2267eba1e38cf9b56722ad659a
USDC transfer via T05 Hot Wallet 34
UTC 10-29 20:41:23 | Block 26300855 | Index 26 | Status 0x1
0xdc102dd89dded5a83f1008906883ffb7c81ff3b7d7965d8c7277d170b5e17481
T06 transit 175 million USDT
UTC 10-29 20:59:11 | Block 26300942 | Index 117 | Status 0x1
0x1fb992f92a45afec23d7d5740c7958a644fb90ef0cba19ca39bd2c6534fb670b
T07 target wallet received 175 million USDT
UTC 10-29 21:08:23 | Block 26300988 | Index 58 | Status 0x1
0xb6d7d3ffcbdd0465e1ab743a8d943218176cac7b15edefa7b7bcd5e853e4266f
T08 target wallet received 2 ETH
UTC 10-29 21:10:59 | Block 26301001 | Index 80 | Status 0x1
0xb9ecd720caf142fcd2c5eec36510930bc5d6a0c0ebfd69ec8084b47a464d2ae9
Top up at T09 Gas Station
UTC 10-29 21:12:59 | Block 26301011 | Index 85 | Status 0x1
0x9a3a5d8ce9ae4d5865f21f92b741cc51fa75ac19cd9bb79d23fa2224ba38ccc3
T16/T18 are third-party zero-value or dust comment clues, and are not considered as evidence of involvement in an attack simply because funds were transferred to the target address. Blocks and receipts can verify the existence of the transaction; additional evidence is required to link external address tags to the natural person attribution.
Transaction Index (Continued)
The complete hash can be viewed by clicking on Etherscan; the transaction number is consistent with the original report. All RPC receipts for this transaction were successful.
T10 USDT Unlimited Quota Authorization
UTC 10-29 21:12:59 | Block 26301011 | Index 86 | Status 0x1
0x3825815ffa7d04c818f11d6708da7c87f6dc218362a501f432b7f26a651739c6
T11 USDT payment
UTC 10-29 21:12:59 | Block 26301011 | Index 87 | Status 0x1
0x11be88b460501b4652e760c41e08cc1f18575e14b6c6ffbb3383e043c2decf34
T12 Second USDT Authorization
UTC 10-29 21:14:35 | Block 26301019 | Index 70 | Status 0x1
0x4c96890a51f65f5ce41f6b2921b43fd5c62a467eba87de2f29fc32c75f7bfbc8
T13 USDT Blacklist Trading
UTC 10-29 21:14:59 | Block 26301021 | Index 199 | Status 0x1
0x0c07a5e428ce233a3bcb40f257ad899594421341d63ce94016822063362707bf
T14 target wallet received 20 ETH
UTC 10-29 21:29:11 | Block 26301092 | Index 58 | Status 0x1
0xbba4ede016d92774812b742656cb1b7ee50fa6ca31315f5d168707cccd72a4b7
T15 target wallet transfer of ETH
UTC 10-29 21:46:23 | Block 26301178 | Index 127 | Status 0x1
0xcb9f8b9fab72935389945f689f4b012b0005738108234daa6594d0f31469a39f
T16 Third-party zero-value postscript transaction
UTC 10-29 22:06:47 | Block 26301280 | Index 300 | Status 0x1
0x5594c9508b7ec5fc5b1dca0892acf554c89f595cd14e3237dd197823870360ed
T17 Cancellation of EIP-7702 Delegation
UTC 10-30 00:10:35 | Block 26301896 | Index 190 | Status 0x1
0xafbf94c92a8d749988411669fa14d4f8866d9b4420b4ebd299f28e958dac7209
T18 Third-party transaction, 69 yuan, postscript.
UTC 10-30 02:52:11 | Block 26302699 | Index 138 | Status 0x1
0xf117e2f197fdf502cad7194ed362f2551d2df4032c858fdd3ca5f6f758bbf34e
T19 New addition this time: 0.000100 USDT micro-transfer.
UTC 10-30 04:52:23 | Block 26303299 | Index 255 | Status 0x1
0x2b482d64b3a8a8b63db8d3634662cd9145b95fb87f8d7633c6d1bc41bf767e88
T19 has obtained transaction, receipt, and transfer logs; it is not included in the original total of 18 hash/outer signature verifications.
T16/T18 are third-party zero-value or dust comment clues, and are not considered as evidence of involvement in an attack simply because funds were transferred to the target address. Blocks and receipts can verify the existence of the transaction; additional evidence is required to link external address tags to the natural person attribution.
Verifiable source registration (I)
The source number corresponds to the main text; clicking the link under the title will open the original page.
[S01] Binance | Security Incident Update
https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
Page dated 2026-10-30 02:23, time zone not specified; full text retrieved via search index. Includes official preliminary investigation, total amount, suspension, and commitments.
[S02] TRM Labs | Binance incident analysis
Page 2026-10-29; Main text statistics as of 10-30 00:30 UTC. Institutional cross-chain scale and attribution, retrieved from search index.
[S03] Reuters / MarketScreener | Analysts react
Page 10-29 23:40 EDT; quoted from Chainalysis 00:30 UTC statistics. Media citation, not impersonating the original ledger.
[S04] LlamaRisk / Aave governance | Response
https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954
Last updated 2026-10-30 01:00 UTC. First-party risk servicer discloses lending and freezing measures.
[S05] Reuters / Investing.com | Issuer freezes
October 29, 18:26 (Updated 18:30), time zone unknown. Earlier media snapshot frozen by the publisher.
[S06] Reuters / AsiaOne | Binance security incident
https://www.asiaone.com/money/binance-hacked-32b-assets-frozen-security-incident
Page 10-30 01:47, time zone unknown. Cited by Alpha, WLFI / BitGo, etc.; the title "Singapore Dollar" and the text "US Dollar" should not be mixed.
[S07] CoinMarketCal/TradingView | Arbitrum freezes
2026-10-30; Quoting Arbitrum's statement. The original X text has not been directly verified.
Verifiable sources and supporting evidence
All data in this report were compiled as of the deadline; however, the coverage time varies depending on the source.
[S08] Ethereum EIP-7702 | Set Code for EOAs
https://eips.ethereum.org/EIPS/eip-7702
Protocol rules source; authorization digest, nonce, zero address clearing and processing order.
[S09] MetaMask | Gas Station
https://support.metamask.io/manage-crypto/transactions/metamask-gas-station/
Official function description: Users can actively choose to pay transaction fees in other tokens; this does not prove the specific client or server logs in this case.
[S10] Binance TH | Deposit / withdrawal notice
October 30, 2026; Public Notice Regarding Regional Entities. This information is retrieved via search index and does not replace a check of the entity's current service status.
[S11] Cointelegraph | Live incident coverage
The latest readable entry was obtained on October 30 at 3:49 AM UTC; it is used for cross-checking progress and finding the original post entry.
[S12] Reuters / The Star | TRM attribution
2026-10-30 12:33 MYT (13:33 JST); used to verify the daily dissemination and time of attribution studies.
Local materials and evidence package
[O01] The user provided GCSA_Binance_Forensic_Report_CN.pdf, 10 pages, version 1.0. Its older CSV, HTML, and script versions were not provided with the file and were not presented as received attachments in this instance.
Original PDF SHA-256: 9cd681ed994fa6d757e7caf0d492407d8910bc973ce441aa7f1d7af42741994e
[E01] This evidence package includes: the original 18 public RPC transactions/receipts and the newly added T19, specified block queries, signature verification results, failure responses, source registration, and SHA256SUMS.txt. Provider: ethereum-rpc.publicnode.com / ethereum.publicnode.com; both domains belong to the same service provider.
The attachment only contains the data actually obtained and generated in this instance. The hash is used to check for file changes; it is not a legal timestamp and cannot prove the correctness of upstream nodes or media content. Internal account information, keys, private IPs, or logs that were not obtained are not attached.
Copyright Notice: This report and related technical analysis are exclusively published by the GCSA Global Cybersecurity Alliance. For reprint permission, please retain the official GCSA source and original link in full, and do not maliciously alter the core viewpoints of the report.
Please follow GCSA on the following social media platforms; we will update you with the latest news as soon as possible.
GCSA Twitter:x.com/gcsahk
GCSA Telegram Channel:t.me/gcsaofficial
GCSA WeChat Official Account:https://mp.weixin.qq.com/s/ld1pKGj7bMnmXN_Fty-OYA
Source:Global Cybersecurity Alliance (GCSA)
Website:www.gcsa.org
Get updates in your inbox
We respect your privacy. See our Privacy Policy