Quick answer
Paste the attacker's Ethereum addresses into a wallet tracker and watch for outflows. The six ETH holding wallets below hold about 470,900 ETH and haven't sent anything to a mixer, bridge or exchange yet. The signals that matter are a holding wallet splitting into many small ones, or ETH reaching THORChain, Chainflip or eXch. Ignore dust transfers and odd tokens: those are spam bots, not the attacker.
The wallets that matter most
Balances from StalkChain wallet data, 02:35 UTC on October 30.
ETH holding wallets
| Address | Holds | Where it came from |
|---|---|---|
0x8532fa14acaf483729c449b8458aeddb900543d4 | 197,460 ETH | Direct sweep from Binance 14 and 16 |
0xc887af690e0301cd4edbbce8f8d31b4ec65b286a | 137,602 ETH | USDT swaps and ENA sales |
0x897c80d1a9729e94460e2bd93178bd5215158df3 | 78,415 ETH | The Aave route, UNI and ONDO sales |
0x54401f80da97893a15d43566184635b6674bc942 | 32,954 ETH | RLUSD, AAVE, RSR, WLD and MORPHO sales |
0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c | 12,952 ETH + frozen stablecoins | The main receiver, still selling altcoins |
0xcf4ca2bdf21bc3a467a00b6afe72b833982723e0 | 11,561 ETH | LINK sales |
Other wallets
| Address | What it is |
|---|---|
0x7f9dc988b46336ad536828fad50fa8fa1e5415e3 | 29,934 WBETH (~$73M), never touched |
0xe7024ab80143b1ef843efe6a58368696cb87958d | 40.5M RLUSD, idle |
0x8d53903625b8e839b9df4bd28b0efb1cd6b8639a | The Aave position: $60M USDT collateral, 19,762 ETH debt |
0x7C8601d4645b93cea45F71e118A729332e6B5CA0 | Setup wallet, funded from Tornado Cash |
0x63e842B054Bd624a465454D533C33F573e9c6fAe | The drain contract |
0x28c6c06298d514db089934071355e5743bf21d60 | Binance 14, the drained hot wallet |
Bitcoin and Tron
On Bitcoin, the 18,270 BTC left bc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm and was split into 1,000 BTC lots. About 17,270 BTC sits in 18 addresses. On Tron, 638.2M TRX sits in TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A. Use a Bitcoin or Tron explorer for these. The full list of Bitcoin lots is in the live timeline.
How to track them
- Open each address in the StalkChain wallet tracker or a block explorer.
- Check the balance against the table above. A drop means something moved.
- Read the latest outgoing transfers. Note where each one went, how much, and when.
- Follow new addresses one hop. If a holding wallet sends to a new address, check that address's balance and its next move.
- Write down timestamps in UTC. It makes it much easier to line moves up with news and other analysts.
Which signals matter
Laundering has started if you see:
- A holding wallet splitting its ETH into many smaller wallets.
- ETH going to THORChain, Chainflip, eXch or a cross-chain bridge. After the Bybit hack, most stolen ETH went to BTC through THORChain within days.
- Any deposit to a centralized exchange. That's also a chance for the exchange to freeze it.
The attacker may have slipped if you see:
- Any outgoing move from the setup wallet
0x7C86…5CA0or the rehearsal wallets. See the rehearsal.
Pressure on a token's price if you see:
- The 29,934 WBETH moving or being unwrapped.
- The 638.2M TRX moving toward an exchange.
What to ignore
- Dust transfers. Bots send tiny amounts like 6.9e-17 ETH to every wallet in the news. That's address poisoning, not the attacker.
- Fake tokens. Spammers airdrop tokens with names like "USDT" or "ETH" from lookalike contracts. Check the token contract, not just the symbol.
- Lookalike addresses. Poisoning bots create addresses that share the first and last characters of real ones. Always compare the full address.
We check all of these wallets every hour and post what changed in the Binance hack live timeline.