Has the Binance hack’s bitcoin operator done this before?
Summary
On 29 October 2026, Binance’s bitcoin hot wallet B1 sent 18,270.2 BTC in 11 withdrawals to the attacker’s wallet H1. In the same block, a script split it into seventeen pieces of exactly 1,000 BTC (H5) and swept the chain leftovers, 832.5 BTC, into H3. Six blocks later it swept five untouched withdrawals, 437.7 BTC, into H4. None of it has moved since.
On 31 October 2026 the FBI attributed the theft to TraderTraitor, a North Korean state hacking group. That names the group. This report looks for one member of it: the operator who wrote and ran the script that moved the bitcoin. Scripts leave fingerprints. We read the hack’s, then searched six months of the blockchain for the same hand at work.
The closest match is a run on 16 September 2026, six weeks before the hack (Lead 1). It repeats the hack’s script at one thousandth of the size: thirteen transactions in one block, the same fixed fees, a merge that also splits off a piece, and a fee-rate sweep of the leftovers at the end. Its money was gathered in 2020, partly through a custodial mixer, then held untouched for three years and staged fourteen months before the run. It never dealt with an exchange directly. Four payments left its wallets before the run. Followed coin by coin, small parts of two of them reach regulated exchanges (Cash App, Bybit and Kraken) through other people’s wallets, and most of the other two went into CoinJoin mixing. The exchanges can identify their customers, which makes those trails worth following up as possible routes back to Lead 1’s operator.
Nothing on-chain links Lead 1, or any other lead, to the hack’s wallets H1 to H5. This is a fingerprint match, not an identification. The report sets out the evidence, how rare the match is, and what would confirm or rule it out.
On the network side, 11 of the 19 transactions spending from H1 and its wallets entered the network through the same node in the Chicago area, which carried about 1% of all transactions that hour. It is a busy public node, so it most likely sat next to the hacker’s node rather than being it.
Who this report is looking for
On 31 October 2026 the FBI publicly attributed the Binance theft to TraderTraitor, a North Korean state hacking group, confirming what several analytics firms had already reported. The FBI said the stolen funds were being converted mainly into ether; the 18,270 BTC described in this report had not moved at the time of writing. The attribution names the group behind the intrusion. It does not say who handled the bitcoin.
Large thefts are usually divided between people: some gain access, others move the money. On Bitcoin the second job leaves the clearest trail. Someone chose a wallet, wrote or configured a script, set its fees, and decided how to cut and park 18,270 BTC in a single block. Those choices are habits, and habits repeat.
So the question here is narrow. What does the operator’s work look like, and has the same work appeared on the blockchain before the hack? We do not name anyone. We identify a way of working, and the places it has appeared.
Leads 2 to 6 are named by their starting wallets in the leads table. Full register with every address
The operator’s fingerprint
Read from the 19 transactions that spent from H1 and the wallets it created. Each trait alone is common. The combination is what we searched for.
How rare is this fingerprint?
We measured each habit in ordinary Bitcoin traffic, using about 2.5 million transactions from every 50th block between 28 April and 31 October 2026. The shares are estimates from that sample.
| Trait | Share of all transactions |
|---|---|
| Native SegWit only: every input and output is a bc1q address | 17.6% |
| Transaction version 2 | 85.6% |
| Replace-by-fee signal on every input | 69.3% |
| Locktime set to the current block | 4.4% |
| Short “low-R” signatures | 58.2% |
| All five together | 2.4%, about 1 in 42 |
| All five, plus the hack’s exact fee rule | 0.017%, about 1 in 5,900 |
| All of that, plus an output of a round amount | 0.002%, about 1 in 53,000 |
Six months of Bitcoin is roughly 127 million transactions. Only 16 groups of linked transactions split coins with the hack’s fees and then kept their round pieces, and one of them is the hack. Only one, Lead 1, repeats every step of the hack’s sequence.
What the terms mean
Native SegWit (P2WPKH). Addresses starting with bc1q. The format arrived in 2017 and makes transactions cheaper. Many wallets use it by default, but many transactions mix in older addresses starting with 1 or 3, or newer ones starting with bc1p. Only about one transaction in six uses bc1q from end to end.
Version 2. A number in the transaction header that allows certain time locks. Almost every modern wallet uses it, so it only rules out old software.
Replace-by-fee signal. Every input carries a sequence number. The value the hack used tells the network the sender may later swap the transaction for one paying a higher fee. Bitcoin Core and Electrum set it by default. Many other wallets and services do not.
Locktime at the current block. The wallet writes the current block height into the transaction so it cannot be mined into an earlier block, which stops miners rewriting recent history to collect fees. Bitcoin Core and Electrum do this, and about one time in ten step back a random number of blocks, up to 99, to blur when the transaction was made. Most other wallets and most exchanges leave the field at zero, which is why only about 4% of transactions carry it.
Low-R signatures. A Bitcoin signature is made of two numbers. Bitcoin Core and Electrum re-sign until the first number is small enough to save one byte, so their signatures are 71 bytes or fewer. Other software makes 72-byte signatures about half the time.
Fixed fee instead of a fee rate. Wallets normally price fees by size: they estimate a rate in satoshis per virtual byte and multiply it by the transaction’s size. The hack paid a flat amount instead, 500 sats with one input and 700 with two, which is 300 plus 200 per input. A one-input split of 141 vB at 500 sats and a two-input merge of 208 vB at 700 sats work out to different rates, so no fee-rate wallet produces both. Wallets do not do this on their own; the fee was set by hand or by a script.
Round amounts. Payments are usually priced in dollars or euros, so their bitcoin amounts are uneven, such as 0.01384917 BTC. Exact amounts like 1,000 BTC or 0.05 BTC usually mean someone moving their own coins in planned sizes. Only about one transaction in a hundred has an output that is a whole multiple of 0.01 BTC.
Change that steps down by the fee. Each split sends out one round piece and returns the rest as change. With a fixed fee, the change shrinks by exactly the same amount every step. A wallet paying by fee rate does not leave this pattern.
Keeping the pieces. Exchanges and payout services also split coins into round amounts, but they pay those pieces out to customers within days. The hacker split the coins and left every piece where it was. This behaviour, not the fee, separates runs like the hack’s from hundreds of payout chains.
How the search narrowed down
How we searched
- Read the hack. The 19 transactions from H1 onward gave the fingerprint above.
- Collect every transaction built the same way. Using Flow, the bitcoin analytics engine at followthesats.com, we read all 27,027 blocks from 28 April to 31 October and kept the 2,975,518 transactions with all five wallet settings, at any fee, with up to ten inputs and four outputs.
- Link and score. Transactions were linked wherever one spent another’s output, giving 928,985 groups. Each group was scored on the hack’s sequence: fixed-fee splits of one piece size, merges that also split, change falling by exactly the fee, a final fee-rate sweep, and round pieces still unspent today.
- Check the method. As a test, the hack itself scored highest of all 928,985 groups.
- Follow the money. For each lead we walked backwards and forwards through wallets built the same way, listed every outside wallet they dealt with, looked for the nearest exchange within five hops, and tested the funding for mixer patterns.
- Check the network. We looked at where each transaction entered the Bitcoin network. The network section covers the hack.
The fingerprint, lead by lead
Every trait of the hack, set against the five closest leads. Lead 1 is the only one that matches on every structural row.
| Trait | Hack, 29 Oct | Lead 1, 16 Sep | Lead 2, 6–7 Aug | Lead 3, 8 Aug | Lead 4, 31 Jul | Lead 5, 30 Jun |
|---|---|---|---|---|---|---|
| Core or Electrum-style settings | Yes | Yes | Yes | Yes | Yes | Yes |
| Fixed fee, 300 + 200 per input | 17 of 19 steps | 11 of 14 steps | 11 steps | One block of 8 steps; most others a flat 300 sats | 24 of 24 steps | 2 of 4 steps |
| Burst in one block | 18 transactions in block 973,732 | 13 transactions in block 967,306 | Spread over 26 blocks | Spread over 55 blocks | 5 blocks | 4 transactions in one block |
| Merge that also splits a piece | 3 | 1, joining two starting coins | 5 | None at the fixed fee | None | None at the fixed fee |
| Change falls by exactly the fee | Yes | Yes | Yes | In most steps | Yes | Yes |
| Fee-rate sweep at the end | Chain leftovers, 3 inputs, about 3.3 sat/vB; plus 5 untouched withdrawals at the same rate | Chain leftovers, 5 inputs, 3.21 sat/vB | 1 input, about 3.2 sat/vB | 4 inputs, 1.8 sat/vB | None | 1 input, 3.20 sat/vB |
| Round pieces still unspent | 17 of 17, 1,000 BTC each | 12 of 12, 8.8 BTC in all | 16 of 18, 0.05 BTC each | 33 of 35, 38 BTC | 23 of 23, 0.9 BTC each | 3 of 3, 0.1 BTC each |
| One transaction at a time | About every 20 s | Every 11 to 37 s, over 4 minutes | Not available | Not available | Not available | Not available |
| Where the money came from | Binance’s hot wallet: the theft | Gathered in 2020, about 29% through mixer chips; held three years, staged 14 months; no direct exchange contact; small amounts from probable Huobi and Binance wallets two and three hops back | Small withdrawals from regulated retail exchanges and mining payouts; one funder built parallel paths from December 2024; staged 14 months | 41 BTC with no mixer; no exchange within five hops | One 21.5 BTC coin; 0.30 BTC from a probable Kraken wallet two hops back | 0.36 BTC; no service within five hops |
Lead 6, three 0.1 BTC pieces on 2 August funded by Binance withdrawals, is in the leads table but left out here for width.
Lead 1: the 16 September run
Thirteen transactions confirmed together in block 967,306 at 18:06 UTC on 16 September 2026, and a fourteenth, the sweep, followed in block 967,307 four minutes later. They reached the network one at a time between 17:36 and 17:40 UTC. Open Lead 1 as a Flow graph (public, annotated)
What the run did
- Started from six coins created on 26 July 2025: three of 2.5 BTC, and coins of 1, 0.528 and 0.5 BTC.
- Split off twelve round pieces: five of exactly 1 BTC and seven between 0.4 and 0.9 BTC. Eleven of the fourteen steps paid the hack’s fixed fee.
- Merged two of its starting coins in one transaction that also split off a 1 BTC piece, paying 700 sats, as the hack’s merges did.
- Let each leftover change fall by exactly the fee.
- Gathered the five leftovers into bc1qg8f2wa…z5l2md at 3.21 sat/vB, as the hack gathered its chain leftovers into H3 at about 3.3.
- Left all twelve pieces (8.8 BTC) and the sweep (0.73 BTC) unspent.
How it compares with an ordinary wallet
The nine staging transactions on 26 July 2025 already paid round fees of 200, 300 or 400 sats, set by hand rather than by a fee rate, but not yet the hack’s 300 + 200 per input rule. That rule appears only on the day of the run, and the final sweep switches to a fee rate, as in the hack. The wallet that held the coin before staging paid ordinary fee rates.
Scale aside, the main differences are the length of the chains (the hack peeled up to seven times in a row; Lead 1 at most three) and the piece size (1,000 BTC against 1 BTC).
Where Lead 1’s money came from
- Mar to May 2020Gathered. A 39-address legacy wallet, 12fpBWjcWc…Dus3Xu, collected 10.70 BTC from 40 payments.
- Apr to May 2020Mixer chips. Five of the payers, who paid in about 3.1 BTC (29%), had mixer “chips” within three hops. Chips are fixed amounts such as 0.032, 0.064, 0.128 and 0.256 BTC, each cut from a batch of 30 identical outputs. Two bundles, 1.8 BTC between them, were swept straight in: 7 chips through bc1q07nnk2…ef6lhh on 16 May, and 10 chips worth 1.426 BTC from 14d8Q1Km4X…EPABTb on 24 May. This is the pattern ChipMixer used before U.S. and German authorities shut it down in March 2023.
- 23 Sep 2023Moved after three years. The whole 10.696 BTC left the legacy wallet in one payment, into a native SegWit wallet with the hack’s wallet settings.
- Oct 2023 to Jul 2025Held. The coin passed through five wallets. Three small payments left on the way (0.32, 0.15 and 0.2 BTC), and a fourth (0.5 BTC) on the staging day. They are covered below.
- 26 Jul 2025
blocks 907,284 to 907,286Staged. Cut into round starting coins of 2.5, 1 and 0.5 BTC, then left untouched for 14 months. - 16 Sep 2026
blocks 967,306 and 967,307The run. Six weeks before the hack.
Two small amounts reached the legacy wallet from exchanges in April 2020: 0.0575 BTC from a large wallet that Flow’s community labels name as probably Huobi, two hops back, and 0.037 BTC from Binance, three hops back. Neither exchange dealt with Lead 1’s wallets directly. The mixer is inferred from the chip pattern; no label in Flow names it. The U.S. Justice Department has said North Korean hackers laundered stolen funds through ChipMixer, but the service also had thousands of unrelated users, so its use here fits a careful operator without saying who that operator is.
Where the fingerprint ends: four payments out
While the coin was held and staged, four payments left Lead 1’s wallets. The wallets that received them move money with different settings from Lead 1’s, so they most likely belong to people Lead 1’s operator paid, and the fingerprint stops with them. We followed each payment coin by coin for up to twelve hops, sharing each transaction’s value out in proportion to its inputs.
| Date | Amount | Paid from | What happened next | Exchanges reached |
|---|---|---|---|---|
| 21 Dec 2024 | 0.318 BTC | Hold wallet | Moved on by the receiver on 14 Jan 2025. About half is still unspent, seven or more hops on | Cash App: 0.006 BTC (2%), four hops |
| 26 Jan 2025 | 0.150 BTC | Hold wallet | Moved on by the receiver on 27 Jan 2025. About half is still unspent, five or more hops on; about a fifth reaches large unnamed services | Bybit: 0.004 BTC (2.5%), six hops. Kraken: 0.003 BTC (2.3%), ten hops |
| 27 Feb 2025 | 0.200 BTC | Hold wallet, then one more wallet with Lead 1’s settings | Gathered the same day with 11 other payments into a 12-address wallet. Nearly all of it entered CoinJoin mixing on 22 May 2025, five hops on | None |
| 26 Jul 2025 | 0.500 BTC | Staging wallet | Moved on by the receiver on 29 Jul 2025. About 60% entered CoinJoin mixing the same day, three hops on | None |
Only small parts of the first two payments reach regulated exchanges, but an exchange can identify its customer, and that customer may know who paid them. The two later payments went largely into CoinJoin mixing. Three of the four receivers (21 December, 26 January and 26 July) move money with the same unusual wallet settings, and two of them are linked on-chain: part of the 21 December payment, seven transactions on, reached the address that had received the 26 January payment the day before. They may be one counterparty paid several times. Flow’s wallet-level route search also connects that address to a small service that deposits at Coinbase, but the route carries a different coin, so Coinbase is not counted as reached. Binance does not appear downstream of any payment; it appears only upstream, as the 0.037 BTC from April 2020. Exchange names come from Flow labels. The receivers of these payments, and the services and exchanges they used, are not suspected of any wrongdoing. The full transaction IDs are listed in the appendix.
Lead 2 in brief
Run A and Run B, 6 and 7 August. Two identical runs, in blocks 961,348 and 961,350, each turned three starting coins into four 0.05 BTC pieces with 500 and 700-sat fees. Three more branches used the same fees, for 11 fixed-fee steps and 18 pieces of 0.05 BTC, 16 of them still unspent. One funder built two parallel paths from December 2024 and staged the starting coins in May 2025, 14 months before the runs.
About 35 to 40% of Lead 2’s money came from small withdrawals at regulated retail exchanges that verify their customers, the shortest route to an identity of any lead. The exchange names are kept off this page and are available to those exchanges and to law enforcement on request. No transaction links Lead 2 to the hack’s wallets.
All leads
Ranked by how closely each run matches the hack’s structure. None has a confirmed link to the hack. Transaction IDs are shortened here; Lead 1’s are listed in full in the appendix. The automated score puts Lead 2 slightly ahead because it has more merges; Lead 1 ranks first because it is the only run that matches the hack on every structural trait in the comparison table.
| Lead | Date | Blocks | What happened | Pieces unspent | Starting address | Match |
|---|---|---|---|---|---|---|
| 1 | 16 Sep | 967,306 967,307 | Thirteen transactions in one block, eleven with the hack’s fixed fees, then a five-input sweep of the leftovers at 3.21 sat/vB. Funded from 2020 coins, partly via mixer chips | 12 of 12 | bc1qe7yrj3…gw4u8f tx 318b69be… bc1qsh65ju…99k9zn tx 88b95c53… | Strong |
| 2 | 6–7 Aug | 961,337 to 961,362 | Run A and Run B plus three branches: 0.05 BTC pieces, 500 and 700-sat fees, merges, fee-rate sweeps of the change | 16 of 18 | bc1qt8ryks…wzvl2p tx 9f6bbde2… bc1qm3l0al…4a0c78 tx 2b5d2463… | Strong |
| 3 | 8 Aug | 961,594 to 961,648 | 35 round pieces, mostly 1 BTC, split mostly at a flat 300 sats a step, with one block of eight splits at the hack’s fixed fees (961,641); a four-input sweep | 33 of 35 | bc1qsnp6up…28lepd tx 86b9787d… bc1qdpsdej…36fm3t tx a2c9324e… | Medium |
| 4 | 31 Jul | 960,403 to 960,408 | 21.5 BTC split into 23 pieces of 0.9 BTC across five blocks, no merges, some address reuse | 23 of 23 | bc1q8wg8np…8hcr64 tx 2cdb004e… | Medium |
| 5 | 30 Jun | 956,105 | Three 0.1 BTC splits, two at the fixed fee and the first a two-input split at a fee rate, then a sweep of 352 sats at 3.20 sat/vB, the same fee and rate as Run A’s sweep, all in one block | 3 of 3 | bc1qn547um…6qqg5w tx a37535ac… | Weak |
| 6 | 2 Aug | 960,755 960,756 | Three 0.1 BTC pieces split over two blocks, two of them to the same address; funded by four withdrawals from B1, the Binance wallet the hack later drained. B1 pays many Binance customers, so this ties Lead 6 to Binance, not to the hack | 3 of 3 | bc1qrjl9t2…0n8dvk tx 6339d299… | Weak |
Smaller matches, not ranked: two-step fixed-fee tests on 7 and 17 May (0.02 BTC), 17 June (0.01 BTC), 31 July and 28 August (1 BTC each); a second small 0.1 BTC group in the same blocks as Lead 6; a 0.1 BTC chain on 1 to 24 August that mixed fixed fees and fee rates; and a 1 BTC chain from June to September. The eighth is a wallet holding about 4.5 BTC that ran fixed-fee splits and a merge on 30 October, the day after the hack, and kept its 1 BTC and 0.8 BTC pieces. It came after the theft and after the first press coverage of the peel chain, so it cannot be a rehearsal. A 0.01 BTC chain split by hand from May to September kept too few of its pieces to make the list.
When the leads happened
The leads run from 30 June to 16 September. The closest, Lead 1, is six weeks before the hack; most of the others cluster in late July and early August. Lead 1 is the only lead that can be compared with the hack on the network. Hover a marker for details.
Pattern of life: when the operator works
UTC+0 to UTC+3 fits best: from the UK and western Europe to eastern Europe, Turkey and the Gulf. That’s the only band where every recorded event falls in waking hours. Korea and China (UTC+8/+9) put Lead 1’s run at about 2 a.m. and the hack at about 4–5 a.m. The Americas put the 2023–2025 hold moves at about 3–5 a.m.
Times are UTC. For Lead 1’s run and the hack, they’re when the transactions entered the network; the others are block times, so they were sent up to an hour earlier.
| Event | Day | UTC | UK +0/+1 | UTC+3 | Korea +9 | US East −4/−5 |
|---|---|---|---|---|---|---|
| L1 coin moves (2020 wallet) | Sat 23 Sep 2023 | 09:24 | 10:24 | 12:24 | 18:24 | 05:24 |
| L1 hold | Sat 21 Oct 2023 | 08:41 | 09:41 | 11:41 | 17:41 | 04:41 |
| L1 payment | Sat 21 Dec 2024 | 09:04 | 09:04 | 12:04 | 18:04 | 04:04 |
| L1 payment | Sun 26 Jan 2025 | 07:54 | 07:54 | 10:54 | 16:54 | 02:54 |
| L1 payment | Thu 27 Feb 2025 | 14:46–15:24 | 14:46 | 17:46 | 23:46 | 09:46 |
| L1 staging | Sat 26 Jul 2025 | 14:30–15:06 | 15:30 | 17:30 | 23:30–00:06 | 10:30 |
| L1 run | Wed 16 Sep 2026 | 17:36–17:40 | 18:36 | 20:36 | 02:36 | 13:36 |
| Hack | Thu 29 Oct 2026 | 20:03–20:36 | 20:03 | 23:03 | 05:03 | 16:03 |
Other things the times suggest
- Weekends. Five of the six hold and staging sessions were on a Saturday or Sunday morning or early afternoon UTC. That looks like side activity done in someone’s own time, not office work.
- Within the best-fitting band: weekend mornings for wallet housekeeping, the Lead 1 run on a Wednesday evening, and the hack late on a Thursday evening.
- In Korea or China, the weekend moves land at 5–6 p.m., which fits a normal day, but the run at 2:36 a.m. and the hack at 5 a.m. fit only night work.
Caveats
- Few events. These are eight sessions, and only two have exact send times.
- Scheduling. A scheduled script can run while its operator sleeps. The hack’s timing may also have been set by when the attackers had access to Binance, not by when the operator was awake.
- No proven link. This assumes Lead 1 and the hack are the same person, which nothing on-chain proves. On their own, the hack’s times fit anywhere from UTC−5 to UTC+3 for someone awake.
The network view
The hack, as the network saw it
How unusual is the Chicago-area node?
Where a transaction enters the Bitcoin network is usually one or two hops from the sender, not the sender itself.
The Chicago-area node is a busy, long-running public node on a Comcast Business line. Each of these readings is low confidence. The most likely reading is that the hacker’s node was directly connected to it.
The other five entry points are on OVH, Hetzner and a shared retail address pool in Cyprus. They mostly pass on the same busy wallets as each other and behave like ordinary well-connected nodes.
Of the leads, only Lead 1 can be compared with the hack on the network. One of its fourteen transactions entered through the Chicago-area node, in line with that node’s ordinary share of traffic that hour (about 8%). Seven of the fourteen entered through a single Hetzner node in Helsinki that carried 0.3% of traffic that hour. That is the same single-entry pattern as the hack, but through a node that carried none of the hack’s transactions. So the network route does not yet confirm or rule out any lead.
Ruled out
- Two 0.001 BTC chains on 7 and 28 Sep. They matched the fee rule, and the first even matched the 20-second pacing. Seven of their eight pieces went into one large unnamed service with 113,000 addresses, and the eighth was spent too.Start at bc1qdrjf8v…2w6q86 and bc1qw5pdgc…xkw03x; the service is bc1qmtdrkv…3rz9qp
- 0.2 and 0.28 BTC chains in Aug to Oct. These look like repeating payouts, and all of their pieces have been spent.For example, those starting at bc1q6zkakw…8w4uxv on 14 Aug, bc1qmz2gfa…aj4g72 on 28 Aug and bc1q2tdqce…wpq5ad on 20 Oct
- A 5 BTC chain on 30 Oct. It came the day after the hack, but it was funded from a wallet with no link found to H1 through H5, and its pieces have moved.Starts at bc1qd8g5m0…sh2rdr; funded from bc1q66zzcx…m6eurj
- 20-second pacing alone. Many unrelated chains broadcast at a similar rhythm, so pacing cannot single anyone out.
What would confirm a lead
- Any spend that combines a piece from H3, H4 or H5 with a piece from Lead 1 or Lead 2, or sends both to the same new wallet.
- Lead 1’s twelve pieces and sweep moving at the same time as the hack’s seventeen pieces, or through the same route.
- The hack’s coins reaching a service where a lead’s operator holds an account. That service can check for the same customer.
- Cash App, Bybit and Kraken identifying the customers who received parts of Lead 1’s payments of 21 December 2024 and 26 January 2025, so they can be asked who paid them.
- The other 35 payments into Lead 1’s 2020 wallet tracing to a source shared with the hack or its known infrastructure.
Limits of this search
- It covers native SegWit transactions with up to ten inputs and four outputs. A rehearsal on another address type or in bigger batches would be missed.
- It covers 28 April to 31 October 2026. Lead 1’s money was being prepared from 2020 and Lead 2’s from December 2024, so earlier activity by either operator lies outside the window.
- Structural matches show the same tooling, not the same person. Anyone scripting Electrum, Bitcoin Core or a similar wallet with fixed fees will look alike, and a script can be shared within a team.
- The mixer is identified from the shape of its transactions, not from a label. Funding traces stop at five hops. Exchange names are Flow’s labels as of 31 October 2026; some are community labels, marked here as probable.
- Where a transaction enters the network is usually one or two hops from the sender. Only Lead 1 can be compared with the hack on the network.
How to read this report
Every finding can be checked
Each one is tied to public on-chain data, with the transactions listed so anyone can verify them.
Confidence is stated
Where we link activity to a person or group, we say how confident we are and why. Those links are our assessment, not a finding of guilt.
AppendixWallets in this report
Each wallet named in this report, with its main addresses. Select to expand.
The hack and the leads are separate sets of wallets. No transaction between the hacker’s wallets H1 to H5 and any lead wallet has been found. Addresses are shortened, and each one opens in Flow.
The hack, 29 Oct 2026
| Label | Wallet | Role |
|---|---|---|
| B1 | bc1qm34lsc…j77s3h | Binance wallet. Made the 11 withdrawals, 18,270.2 BTC, in block 973,732. |
| H1 | bc1q0mtc2f…hl2mnm | Hack wallet. Received the 11 withdrawals and split them. |
| H2 | bc1qrsrh56…cwue5e | Merge wallet, three addresses. It collected the change of the three merges. |
| H3 | bc1qrg025e…hn6zyt | 832.5 BTC leftover, swept out of H2 at a fee rate. Unspent. |
| H4 | bc1qxg0l4p…y7s9ra | 437.7 BTC leftover: the five smallest withdrawals, swept together in block 973,738. Unspent. |
| H5 | 17 addressesbc1q0ts8ga…mkmfv3bc1qjwdw6v…mxnz7w bc1qdfhmlr…3g88gw bc1qz8hdwv…gxupdp bc1q63qrfr…atsjxp bc1qs3aej5…577s56 bc1qs6xnmh…l87w3v bc1qm8v88m…crs2l8 bc1q42flha…5wlsyx bc1q2wvz0k…veznn6 bc1qalwnl7…69tca8 bc1qf5cyvv…l8a35u bc1qm2j6v3…9wjaat bc1qxrxujw…hs968s bc1qg3nrzp…6n3t53 bc1qepc70u…hs4lag bc1qnq6jj9…0k8t3s | The seventeen 1,000 BTC pieces, one per fresh address. All unspent. |
Lead 1, the 16 Sep 2026 run
| Label | Wallet | Role |
|---|---|---|
| Origin | 12fpBWjcWc…Dus3Xu | 39-address legacy wallet. Collected 10.70 BTC, Mar to May 2020. |
| Chips | 14d8Q1Km4X…EPABTb 1MFcm6oA5G…JMLQ3w bc1q07nnk2…ef6lhh | Mixer chip bundles of 10 and 7 chips, May 2020, and the wallet that passed the second bundle on. |
| Hold | Carried the 10.7 BTC coin, Sep 2023 to Jul 2025. | |
| Staging | Cut the coin into round starting coins, 26 Jul 2025. | |
| Run | The 16 Sep 2026 splits and merges, blocks 967,306 and 967,307. | |
| Pieces | 12 addresses, 8.8 BTCbc1q26z8jt…9d6rtl 1 BTCbc1q6dgg26…9wvck9 1 BTC bc1qwcjlfa…x0pt38 1 BTC bc1qzx9wv9…4xe84w 1 BTC bc1qnyyamq…24avl7 1 BTC bc1q7cklhw…mqaahh 0.9 BTC bc1quga7nc…3m9ust 0.7 BTC bc1q22upwa…jzcdg2 0.5 BTC bc1qrnxr2d…4adycr 0.47 BTC bc1qqljgpd…tf9ade 0.43 BTC bc1q9udg7q…a53z9c 0.4 BTC bc1qrlt7tr…yy8eza 0.4 BTC | All unspent. |
| Sweep | bc1qg8f2wa…z5l2md | 0.728 BTC from the five-input sweep. Unspent. |
Lead 2, the 6 Aug 2026 runs
| Label | Wallet | Role |
|---|---|---|
| Funder | bc1q58n3n7…gteyf5 | Built both funding paths, Dec 2024. |
| Source A | bc1q62z4np…cl5kay | Funded 24 Mar 2025. On 22 May 2025 it paid for all three of Run A’s starting coins. |
| Source B | bc1qd50x7u…9km3eu | Funded 24 Mar 2025. On 22 May 2025 it paid for two of Run B’s starting coins. |
| Source C | bc1qstaexz…7wqghy | On 22 May 2025 it paid for Run B’s third starting coin, 0.05 BTC. |
| Run A | Block 961,348, 8 walletsStarting coinsbc1qj6kp8m…hg59ppbc1qt8ryks…wzvl2p bc1qzp46rs…rvq9u30.05 BTC pieces, unspentbc1qg4sd2z…2wkkga bc1qej8569…xfsqhl bc1q3sndfk…g32afw bc1qk0w3jh…rzh872Change swept tobc1qf2772j…d6paht | Three starting coins split into four 0.05 BTC pieces. |
| Run B | Blocks 961,350 and 961,351, 8 walletsStarting coinsbc1qm3l0al…4a0c78bc1qfz59dv…kmy863 bc1qtudx52…9plpmd0.05 BTC pieces, unspentbc1qmlxwrv…7t93lv bc1qjr77gp…e9yk9y bc1q4uzcwa…n5hv7g bc1qpvk44e…sp309pChange swept tobc1q7gwmmc…0qg87l | The same split, 15 minutes later. |
Leads 3 to 6, starting wallets
| Lead 3 | bc1qsnp6up…28lepd bc1qdpsdej…36fm3t | The fixed-fee block of the 8 Aug chains. |
| Lead 4 | bc1q8wg8np…8hcr64 | 21.52 BTC split into 0.9 BTC pieces, 31 Jul. |
| Lead 5 | bc1qn547um…6qqg5w | 0.36 BTC split into 0.1 BTC pieces, 30 Jun. |
| Lead 6 | bc1qrjl9t2…0n8dvk | 0.50 BTC split into 0.1 BTC pieces, 2 Aug. |
Lead 1’s transactions in full
Every transaction sent from Lead 1’s own wallets since the 2020 wallet moved, in block order: the move into the hold wallets, the hold (with three of the four payments out), the onward 0.2 BTC step, the nine staging transactions (with the fourth payment) and the fourteen of the run. Times are block times. The receivers of the payments, and the services and exchanges they used, are not suspected of any wrongdoing.
| Date · block | Step | Transaction ID |
|---|---|---|
| 23 Sep 2023 09:24 UTC · 808,963 | The 2020 wallet sends all 10.696 BTC to the first hold wallet | 2164b4f49dc17a9cc7325ea002fb873d5750f64be372620f5e942511390de449 |
| 21 Oct 2023 08:41 UTC · 813,157 | Hold: passed to the next hold wallet | e0356cbf43ed4671d2e310b5430d8fb75f8f43dcd6acd19f16f1aa62ae7cb8ef |
| 21 Dec 2024 09:04 UTC · 875,711 | Hold, with payment out: 0.318 BTC | d773862522117a2f6b1777321d54795bf4b646fd62c50ba20aace556e43cd2be |
| 26 Jan 2025 07:54 UTC · 880,875 | Hold, with payment out: 0.150 BTC | 702bdf4c8cda3920d461e0c7a1fd4183f24aaf9b8fcc292e1161100a3a80fcf8 |
| 27 Feb 2025 14:46 UTC · 885,567 | Hold, with 0.2 BTC to one more wallet with Lead 1’s settings | 11e05a149a871c74e29fa160324d363b9093bfecc060466d1638b5eeb69aeed0 |
| 27 Feb 2025 15:24 UTC · 885,570 | That wallet passes the 0.2 BTC on: payment out | 1d434998b38a8f1e85c8c9acf7fe405927ade6c88bc1762256f0954bc22fd09d |
| 26 Jul 2025 14:30 UTC · 907,284 | Staging: the last hold wallet starts the cut | 928194c5c340f638eb3e5a0f44545ab24946aede094d739ed28329c4b2ee129b |
| 26 Jul 2025 14:30 UTC · 907,284 | Staging: round starting coins | f7dda0311aebb8587e06129ce17b4decb67bf534878d950bc322141896a31231 |
| 26 Jul 2025 14:30 UTC · 907,284 | Staging: round starting coins | 584140620a45197c5933726d596568884b4809d88f3ec319f35e9c753385408a |
| 26 Jul 2025 14:30 UTC · 907,284 | Staging: round starting coins | 491858ed2517a7c6b27eb6b4d3195f4b3dba0130be5cc7e70f181f0bc80ef4ee |
| 26 Jul 2025 14:30 UTC · 907,284 | Staging: round starting coins | 6440c6bdaef626f782bb18cd1efa24565932d362d5bbfe00e8dc265844410ee5 |
| 26 Jul 2025 14:30 UTC · 907,284 | Staging: round starting coins | 058759460338d636d6947905ba16ab7a3d713c4b1aac03b041d8eb372a27f114 |
| 26 Jul 2025 14:47 UTC · 907,285 | Staging: round starting coins | 9c4efe438e0f04f955c47192ffe49bebf868c2f578a6a28d06028c2671ef6023 |
| 26 Jul 2025 14:47 UTC · 907,285 | Staging: round starting coins | 7aedf63dd61e8de5dc39dc06c9827a7f36a4d972109dfd60aa64e4f2b0f37a42 |
| 26 Jul 2025 15:06 UTC · 907,286 | Staging, with payment out: 0.500 BTC | 90a9dcc0cbeb5e91d4e30b11aabc74251faec6efa9d1afd40b200e8de8915233 |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: fixed-fee split, one round piece | c364df50a026e9dcae8d2e40b99e6097de7078df5ab8659731046dc412979a9a |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: split paying 520 sats (3.69 sat/vB), one round piece | 51f714af8e23c366040568b87be1fa9f252705284493dc44ce34fec0a549a149 |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: fixed-fee split, one round piece | f2e20d1799e5ea8e0f2e9831e77e9686cb3636a7db7f4d57a53a6616b264446f |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: fixed-fee split, one round piece | 318b69beeae2e7be1c8594bd7a6562bbea1bbcb93c895f68c097839e780142bd |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: fixed-fee split, one round piece | 45eec34c7ef63e87e9b8ccb752097e2a786f03e20500536af444076d89d5026e |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: fixed-fee split, one round piece | 88b95c534810b8df560c2925eaed8a28b53bacde1e0f1344586da828abe22f4e |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: fixed-fee split, one round piece | 58ea1df6f299b0f8bc0bd9f2670bdc7277c047aa7c5d5f48c61bcf3451130c59 |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: fixed-fee split, one round piece | 976b137ff0038ea2e6c2166fc658030c8782666b2a2d26018db12c652ff3e0e6 |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: fixed-fee split, one round piece | d66f4937d7d230cd8cdfc5448f9353981032e9f1e93f9948d411f4a419fbdc0d |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: fixed-fee split, one round piece | ed5070569515a3f95389213f10a659a05adca1f3642bf9138c0979c6b62d3991 |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: fixed-fee split, one round piece | 78624b877334483ca76a464f5e3c17129f254633575a38f90f5b9066c34aed6b |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: the fixed-fee merge (700 sats) | 778119cd71c3fc97e77e07776ad31723c42d841e368f625f43f710a054424f08 |
| 16 Sep 2026 18:06 UTC · 967,306 | The run: step paying 452 sats, with the 1,528-sat output | 6063ec30a10b89c281fcc140374aaddc4df0e04b187eaa736f202e25dacee47c |
| 16 Sep 2026 18:10 UTC · 967,307 | The run: fee-rate sweep of the leftovers (3.21 sat/vB) | 7796a3a6c5e754189d3a2337d3f5fccc680ed9f691255eefc69289cf2dd50fc0 |
About BlockTrace
BlockTrace provides digital asset monitoring and incident response for exchanges, custodians, protocols, funds and any business that holds digital assets, working as an extension of their security teams. Its work covers readiness, monitoring, incident response, and fund tracing and reports, on Bitcoin, Ethereum and EVM chains, Solana and Tron. Every message is triaged around the clock, and urgent incidents reach a person at any hour.
BlockTrace published this report free of charge, with no commercial arrangement with Binance or anyone else, and built it with Flow by FollowTheSats.
Wallets in this report are described by how their transactions were built and where their money came from. Nothing here identifies a person, and no lead wallet has been linked on-chain to the hack wallets H1 through H5.
blocktrace.comServicesHow we workActive incidentIndividual reportsIf you’ve been hackedContact form