Binance Attacker Holds 519,104 ETH After Converting More Tokens Than It Stole as Ether

Frank Joaquin

Date: October 31, 2026

A block-by-block reconstruction through 23:50 UTC on 30 October counted 519,103.71 ETH across 42 wallets connected to the Binance exploiter cluster. Only 1.3863 ETH had left that wallet set after the drain, even though one feed briefly reported a transfer between cluster wallets as a new outbound move.

The composition is more informative than the dollar total. Approximately 200,600 ETH was taken directly from Binance wallets. Roughly 291,500 ETH arrived when the attacker sold other stolen tokens for Ether, and 19,762 ETH was borrowed from Aave against 60 million stolen USDT. More of the current Ether position was therefore acquired by converting other stolen assets than was originally stolen as ETH. OnChain Benchmark

The reconstruction also traced $16.3 million in USDC from Avalanche through Circle’s Cross-Chain Transfer Protocol to Ethereum. The new wallets exchanged the USDC for ETH within minutes. Circle later blacklisted two addresses, but both held Ether rather than USDC by then. A blacklist stopped future movement of the issuer’s token, not the native asset already received.

Arkham separately estimated about $2.7 billion of the overall theft frozen and 18,270.2 BTC still split across 19 addresses. Those Bitcoin outputs remained unmoved at its reporting cutoff. Dollar values vary with price, so the asset units and observation times are the more reliable record. info.arkm.com

This evidence does not show a sale of the Ether position or a completed laundering route. Transfers within an attributed cluster can reorganize custody without changing beneficial control. The chain proves balances and transactions; attribution and intent remain analytical judgments.

TOKEN RECON ASSESSMENT

The material update is that the attacker’s largest liquid position was built through conversion, then remained almost entirely stationary at the cutoff. That reduces the evidence for an immediate market dump while concentrating more than half a million Ether in a known cluster. A confirmed transfer to a mixer, bridge, exchange or negotiated recovery address would change the operational picture. Internal reshuffling would not.