Quick answer
Yes. About four hours before draining Binance 14, the attacker pointed a dummy wallet he controlled at the same drain contract, loaded it with 1.01 ETH and 2.54 USDT, and swept it. The setup was funded with about 1.4 ETH from Tornado Cash across three wallets. None of the setup wallets has moved since the hack.
The timeline
All times UTC. Where a step is checked against StalkChain wallet data, it says so.
| When | Stage | What happened |
|---|---|---|
| Oct 28, 07:39 and 08:53 | Funding | Setup wallet 0x7C86…5CA0 gets two ~0.098 ETH payments from the Tornado Cash 0.1 ETH pool (StalkChain data) |
| Oct 29, 08:23 | Funding | A third ~0.098 ETH payment from the same pool (StalkChain data) |
| Oct 29, 01:15–14:54 | Funding | Two more wallets get small amounts, which on-chain analysts trace to Tornado Cash |
| 14:19–14:24 | Dry run | Three test wallets holding a few dollars of USDT and USDC are swept, per on-chain analysis |
| ~16:00 | Weapon | The drain contract 0x63e8…6fAe is deployed from the setup wallet |
| 16:13–16:30 | Rehearsal | Dummy wallet 0x43AE…04BD gets 2.54 USDT and 1.01 ETH, is pointed at the drain contract and swept (StalkChain data) |
| 18:20 | Gas | 1.08 ETH sent to the setup wallet from 0xe4f9…74cd (StalkChain data) |
| 20:20 | Target | Binance 14 is pointed at the same drain contract with EIP-7702 |
| 20:24 | Drain | About $2.53B in 63 tokens leaves Binance 14 in one transaction |
Why a rehearsal matters
The real attack had one shot. Once Binance 14's delegation was on-chain, Binance's monitoring could react. A bug in the drain contract, a wrong token list or a gas miscalculation would have burned the opportunity.
So the attacker ran it end to end on a wallet he controlled: same contract, same EIP-7702 mechanism, same sweep function. He loaded the dummy with both ETH and a stablecoin, which tests the native-asset and token paths of the sweep. Then he swept it and checked the result.
This is the behavior of a professional team, not an opportunist. It also matches what investigators described in other big exchange hacks: setup wallets funded through a mixer, test transactions, then the real thing. For what that does and doesn't say about who did it, see was the Binance hack North Korea?.
The wallets
| Address | Role |
|---|---|
0x7C8601d4645b93cea45F71e118A729332e6B5CA0 | Setup wallet: deployed the drain contract and submitted the delegation |
0x63e842B054Bd624a465454D533C33F573e9c6fAe | Drain contract with the sweep function |
0x43AEdb9BAD6219677a2C8D6858321C16988404BD | Dummy wallet used for the rehearsal |
0xe4f9070e1316de2988fc6f869fead8fb99cc74cd | Funded the dummy wallet and sent gas to the setup wallet |
0xfd41da53d1175b29d40599a0e63545067f58f408 | Funded the dry run and sent USDT to the dummy |
Why investigators care about these wallets
The setup cost about 1.4 ETH. That's tiny next to the haul, but these wallets are the attacker's most personal footprint. They were set up by hand, before the attack, when he wasn't under pressure.
Since the hack, StalkChain data shows the setup wallet has received only spam: dust from address-poisoning bots. It hasn't sent anything. If any of these wallets ever touches an exchange, a known service or another of the attacker's addresses, that link could help identify him.
We track all of them in the live timeline. You can also watch them yourself: see how to track the Binance hacker's wallets.