Investigations
Everything we've found and checked on-chain. We don't speculate about who did it, and we list our corrections too. Unproven claims are marked unsubstantiated at this time based on our on-chain analysis.
Binance hack (Oct 29, 2026): where the money sits
From our multichain trace, Oct 30 ~12:35 PM ET. Read-only checks via public explorers and RPCs. Only balances confirmed on-chain are counted. Prices are from that time.
| chain | still held | of which frozen | verify |
|---|---|---|---|
| Ethereum | ≈ $3,586M | ≈ $2,204M | 0x8532…43D4 · 0xc887…286a · 0x5440…c942 · 0x5227…2f8c |
| Tron | ≈ $580M | ≈ $379M | TG5i…zsGi · TCzB…7Y62 |
| Solana | ≈ $92M | 0 | Affz…EaU (970,554 SOL) |
| Bitcoin (attributed) | ≈ $1,416M | 0 | bc1q0mtc…2mnm |
| XRP | ≈ $290M | 0 | rK21…gzMx |
| Avalanche | ≈ $8M | unconfirmed | 0x5227…2f8c |
| Polygon | ≈ $4M | 0 | 0x5227…2f8c |
| Total we can verify | ≈ $5,977M | ≈ $2,583M |
- Ethereum: about 508.6K ETH sits across 7 holder wallets. As of our last check, the three biggest had made no outgoing transactions. Frozen: 1,380.5M USDT and 823M USDC.
- Tron: Tether blacklisted 312.7M USDT at TG5i…zsGi (verified live). About 601M TRX ($201M) is unfrozen across five fresh wallets. Another 65.99M USDT is frozen at TCzB…7Y62.
- Bitcoin: 18,270 BTC went to a brand-new address during the drain window. In the same block it was split into 1,000 BTC lots, and all of it is unspent. We rate it likely attacker-controlled with moderate-high confidence, consistent with public attributions.
- Traced Oct 30: XRP (233.5M XRP still held at rK21…gzMx), Avalanche (8.41M USDt held; ~2.26M AVAX moved, partly swapped), Polygon (46.6M POL held). Nothing found on BNB Chain, Base or Optimism. Ownership of the new addresses is unsubstantiated at this time based on our on-chain analysis. Not traced yet: NEAR (no starting account on-chain). Unresolved: ~1.6M AVAX path.
- Public estimates: Arkham $5.77B held, Binance ~$6.3B, Elliptic $6.43B.
Binance hack: main thread and live updates (Oct 29–30) verified
- First verified theft: 185M XRP at 4:05 PM ET Oct 29, from Binance's rDAE…JPxr to rK21…gzMx. SOL followed at 4:10 PM ET.
- At 4:20 PM ET, Binance 14 hot wallet 0x28C6…1d60 got an EIP-7702 delegation with 50 pre-signed authorizations, so later sweeps needed no new signatures. It was swept again at 5:44, 6:39 and 7:36–7:56 PM ET, almost 4 hours in.
- We followed it as a 12-post thread with 25 updates through the night, an on-chain recount on the morning of Oct 30 and a timeline card listing the open questions.
Thread start, Oct 29 5:34 PM ET ↗ · Wave-2 post, 9:54 PM ET ↗ · Recount, Oct 30 9:13 AM ET ↗ · Timeline + open questions, 10:03 AM ET ↗
Binance root cause vs. what the chain shows (Oct 30) verified
Binance's preliminary root cause says a DevOps engineer's laptop was likely compromised, which gave access to a service container that submitted withdrawals. Binance says it found no evidence of a private-key leak. That fits what we see on-chain: every outflow was validly signed, and the pre-signed EIP-7702 authorizations explain why the sweeps continued without new signatures. The full post-mortem isn't out yet. We don't speculate about who did it.
Tron: where the 300M USDT went (Oct 30) verified
- 300M USDT left TG5i…zsGi for TPBk…bKN4 on Oct 29: 100M at 4:45 PM ET and 200M at 4:56 PM ET.
- Only 10,000 USDT was supplied to JustLend, at 5:14 PM ET. About 229M went to contract TSUU…vZpx and 33M to a SunSwap V4 PoolManager (TVju…u1Br).
- 65.99M USDT sits blacklisted at TCzB…7Y62.
- The claimed 300M USDT lending-market supply and the claimed THORChain link to the September Bitget theft are both unsubstantiated at this time based on our on-chain analysis.
The other chains: XRP, Avalanche, Polygon (Oct 30) verified
- XRP: rK21…gzMx holds 233.46M XRP (~$290M) and has sent nothing out. Its ownership is unsubstantiated at this time based on our on-chain analysis.
- Avalanche: 0x5227…2f8c received ~2.26M AVAX and 8.41M USDt starting 4:33 PM ET Oct 29. The USDt is still there; a 5:40 PM ET transfer attempt failed, and whether it is frozen is unconfirmed. 1.81M AVAX went to 0x8035…c397 and was split onward; we haven't verified the route of ~1.6M AVAX. At 8:15 AM ET Oct 30, 444K AVAX went to 0x2ef0…f033 and was swapped through the ParaSwap/Velora router.
- Polygon: 0x5227…2f8c holds 46.6M POL (~$4.3M) and has never sent a transaction.
- BNB Chain, Base, Optimism: nothing found but dust. NEAR: not traced yet; we have no starting account on-chain.
PANGEA: we got rugged (Oct 26, −$30.01) our loss
Token 0x8fe5…2f63. A hidden function let an outside contract move or burn holders' tokens with no sell needed. An insider wallet moved tokens out first, and our sells revert to this day. Red flags we missed: unverified source code, a hardcoded outside contract with power over balances, and a large insider holding.
UDTF: we got rugged (Oct 24, −$10.01) our loss
Token 0x2b1f…7e2a. The creator moved 8.3% of supply out. Our guard caught it, but the pool was already empty by the time we tried to sell, so we wrote the tokens off as worthless.
AOP: we got rugged (Oct 24, −$10.02) our loss
Token 0x5d6c…cc44. The creator sent 20 ETH in the same transaction that created the token and took 1.62B AOP, 99.97% of the pool. Next came quick round-trip trades and dust airdropped to 50 wallets to pad the holder count. At 9:39 PM ET, 84 minutes after launch, the creator sold everything back into the pool for about 60 ETH. No liquidity was removed: this was a creator dump, not a liquidity pull.
SIFI: we got rugged (Oct 24, −$9.04) our loss
Token 0x076c…db1a. The token passed our entry checks, then its liquidity was pulled within about 25 minutes. That led us to add a watcher that catches liquidity being removed.
No public story posted.
Risky launches we flagged on X (watch posts) flagged
Our scanner flags these from on-chain checks. A flag means caution, not proof of a scam.
| time (ET) | token | address | why | X |
|---|---|---|---|---|
| Oct 27 7:10 PM | “4” | 0x970c…bf71 | test sell failed; unverified source; a regular wallet holds >10% | post ↗ |
| Oct 28 8:53 AM | TERABASE | 0xd443…ab07 | mintable; simulated round-trip sell failed | post ↗ |
| Oct 28 9:58 AM | USAD | 0xe80c…aabb | name launched as 4 contracts in 7 days; unknown v4 hook with a dynamic fee; no socials | post ↗ |
| Oct 28 10:53 AM | NODF (×3) | 0xac40…c9e2 | same ticker on 3 contracts (also 0xb24c…8ea9, 0xd433…609a); all pausable, 2 mintable | post ↗ |
| Oct 28 11:53 AM | TRENCHORS | 0xb200…b7fc | simulated round-trip sell returned 0%; unverified source; no socials | post ↗ |
| Oct 28 12:59 PM | ZIP | 0xfe92…cba3 | simulated round-trip sell returned 0%; pausable; anti-whale limit can be changed; owner not renounced | post ↗ |
| Oct 28 2:55 PM | TRUMPTRENCHES | 0xb200…97e2 | simulated round-trip sell returned 0%; unverified source; no socials | post ↗ |
| Oct 28 3:56 PM | CETUS | 0x1844…96ba | 12 buyers, 0 sellers in 30 min; no sell route; unknown v4 hook with a dynamic fee | post ↗ |
| Oct 28 5:57 PM | ADOF | 0xc848…69d3 | 11 buyers, 0 sellers; its v4 hook is shared with 4 other new tokens; ticker on 18 contracts in 7 days | post ↗ |
| Oct 28 6:53 PM | WOSE | 0x23d6…985c | pausable; owner not renounced; creator holds 16% | post ↗ |
| Oct 29 8:15 AM | GOOGLC | 0xc39f…4784 | owner mint in verified source; owner not renounced | post ↗ |
| Oct 29 10:14 AM | HARDFORK | 0x52f2…a82d | CRITICAL code scan: blacklist, pause, fee setter, LP backdoor; 0% of LP locked | post ↗ |
| Oct 29 2:15 PM | worth | 0x4145…5377 | bytecode references a blocklisted drainer address; 3 wallets make up 66% of 12h volume | post ↗ |
| Oct 30 8:11 AM | UFTD + 5 lookalikes | 0x1e29…8008 | 6 lookalike v4 pools (UODF/UESO/UDOF/UDTF/TUDF); 10–15 buyers and 0 sellers each | post ↗ |
| Oct 30 10:16 AM | ZIP | 0xb5c6…9795 | CRITICAL code scan: owner fee setter, hidden owner, LP backdoor | post ↗ |
| Oct 30 12:15 PM | UNI (“Uniswap” copycat) | 0x6b57…07bd | owner mint and arbitrary transfer; creator holds 100% | post ↗ |
| Oct 30 2:11 PM | QTC “Quantus” | 0x4e8c…204b | DexScreener showed ~$119M of liquidity, but the pool held 0.00019 WETH on-chain; owner mint | post ↗ |
| Oct 30 4:10 PM | BASEAI | 0xeaae…726f | 5 wallets make up 83% of 12h volume; name launched as 3 contracts in 7 days | post ↗ |
Scam-wallet ledger and nightly tally tracked
We keep a ledger of 766 wallets tied to rugs: funders, deployers and sweep wallets, each with transaction evidence. Our nightly tallies posted on X:
- Oct 28 12:31 AM ET: 7 reported (~$11,675), $0 frozen, 275 liquidity pulls in 24h.
- Oct 29 12:32 AM ET: 9 reported (~$18,129), $0 frozen, 284 liquidity pulls in 24h.
- Oct 30 12:25 AM ET: 9 reported (~$18,129), $0 frozen, 186 liquidity pulls in 24h.
Rug factories: serial deployer farms verified
Four funder clusters were behind about 60+ throwaway deployers, and they pulled liquidity within roughly 10–45 minutes of launch. They're now on our blocklist. Our 4-post thread was posted by hand on Oct 27, so we don't have a link to it here.
Patterns we warned about verified
- Owner blacklists: a passing test sell doesn't mean you can sell later. Oct 26 ↗
- Wash trading: clusters of linked wallets trading in circles. Oct 27 ↗
- Hidden owner mint: 2 of 144 new contracts we scanned. Oct 29 ↗
- A cloned scam contract template: 2 CRITICAL copies sharing the same source lines. Oct 30 ↗
Base launchpad pulse (weekly) sample
Which risk flags showed up, broken down by launchpad, across the tokens our bot scanned (1,422 in the Oct 29 edition). Rugged or lost liquidity: Doppler 56%, direct deploys 40%, Clanker 10%, Zora 1%. Mint or pause switches: Doppler 75%, Clanker 57%. These are automated flags on our own sample, not platform-wide numbers, and they can include false positives.
Binance multichain correction (Oct 30, 12:32 PM ET) correction
- We first called the rest of Binance's $6.3B figure unsubstantiated. After tracing more chains we can verify much of it: ~$5.61B at the time, ~$5.98B now.
- We first called the 18,270 BTC move unlinked. We now think it's likely the attacker's.
- We said the BTC moved "53 seconds before the drain." That's true only against the Ethereum leg (4:20:59 PM ET). The first theft was XRP at 4:05 PM ET, so BTC moved about 15 minutes into the drain.
Tron lending/THORChain claims (Oct 30, 1:24 PM ET) correction
Only 10,000 of the 300M USDT went to JustLend. The 300M lending-market claim and the THORChain/Bitget link are unsubstantiated at this time based on our on-chain analysis.
Root-cause addition (Oct 30, 3:06 PM ET) correction
We added Binance's preliminary root cause and showed how it lines up with the on-chain signing pattern.
AOP: creator dump, not a liquidity pull correction
Our early notes said AOP was a liquidity pull. The on-chain story we posted shows no liquidity was removed: the creator dumped the tokens.
Every post we made (x.com/ReginaldWatches)
Times are ET. Verify every address on its explorer. NFA 🦉