Pinned Tweet
Binance hack, case KT-13: every hop from the hacker wallet 0x5227…2f8c.
12,393 moves so far, each recorded on Kadena. Zoom in to read every wallet.
KadenaTrace: the public clock for stolen crypto.
trace.kadena.ws/case/KT-13
Binance, day 7: where the $6.3B stands, read from the chain.
• $2.71B frozen
• $2.7B still in the attacker's wallets
• $610M moved on
• $3.5M lost for good
What the lines don't cover is not yet traced.
Evidence: trace.kadena.ws/recovery/bin…
Binance: about $23.4M of the traced funds moved in the last 24 hours: $23.22M to new wallets, $164K to THORChain. About $1.33B still sits in traced wallets.
Evidence: trace.kadena.ws/case/KT-13
@binance @cz_binance @heyibinance @jerallaire @zachxbt @chainalysis
Observation, unconfirmed: $67.4M (72% of its balance) left OKX 225 on Ethereum in 7 min, mostly to wallets with no public label. Large transfers are often the owner's own; this does not establish a theft. Timestamped on Kadena: trace.kadena.ws/live/237
New case KT-13: 0x5227f6…2f8c on Ethereum, a wallet the Binance hack funds were sent to, registered on Kadena by KadenaTrace.
13411 movements recorded so far, $735.1M reached Swap, Uniswap, UniversalRouter and 55 more; about $281.7M sits in…
Evidence: trace.kadena.ws/case/KT-13
KT-13 update: 94.5 USDC moved from 0x97ccdb…5fd4 into Across (a bridge) on Ethereum (hop 4), attested on Kadena as move 13503.
New case KT-14: 0x5227f6…2f8c on Arbitrum, a wallet the Binance hack funds were sent to, registered on Kadena by KadenaTrace.
8 movements recorded so far, $1,530 reached Swap and StargatePoolNative; about $32.2M sits in 3 wallets.
Evidence: trace.kadena.ws/case/KT-14
Pattern in KT-18: 53 addresses each split their funds and sent part to THORChain between Oct 30 10:47 and Nov 4 01:31 UTC (124 transfers). The common path is observable; common ownership beyond these transactions is not established. @binance @THORChain
trace.kadena.ws/case/KT-18
Binance: about $24.42M of the traced funds moved in the last 24 hours: $24.41M to new wallets, $3K to Tether: USDT Stablecoin. About $1.36B still sits in traced wallets.
Evidence: trace.kadena.ws/case/KT-13
@binance @cz_binance @heyibinance @jerallaire @zachxbt @chainalysis
Correction: our earlier post (14:41 UTC) about KT-16 called a Binance hacker wallet the address funds were stolen from. We have removed it and updated the record. trace.kadena.ws/case/KT-16
Correction: our earlier post (02:47 UTC) about KT-14 called a wallet the Binance hack funds went to the address funds were stolen from. We have removed it and updated the record. trace.kadena.ws/case/KT-14
Correction: our earlier post (16:05 UTC) about KT-22 called the Binance hacker's Solana wallet the address funds were stolen from. We have removed it and updated the record. trace.kadena.ws/case/KT-22
KadenaTrace now has free guides for the moments that matter, each built on a real case we traced:
• the first hour after a theft
• tracing stolen crypto hop by hop
• exchange deposits vs freezes
• USDT on TRON and Tether freezes
• address poisoning
trace.kadena.ws/guides
2/ New: monthly reports. Every verified hack and theft of the month, linked to its trace on the site, plus the stablecoin freezes read straight from the issuers' contracts.
October's is up now, under Monthly reports.
The Binance hacker emptied his @XRP wallet today: about 233.5M XRP (~$294M) sent out in several payments, 03:52–04:00 UTC.
KadenaTrace recorded it and wrote it to Kadena at 03:57 UTC, a timestamp anyone can check:
denascan.com/transactions/bv…
trace.kadena.ws/recovery/bin…
Binance: about $92.53M of the traced funds moved in the last 24 hours: $92.49M to new wallets, $29K to UniversalRouter. About $1.36B still sits in traced wallets.
Evidence: trace.kadena.ws/case/KT-13
@binance @cz_binance @heyibinance @jerallaire @zachxbt @chainalysis
Pattern in KT-17: bc1q0m…2mnm on Bitcoin sent 5 outputs of 1,000 BTC each to 5 new addresses at 20:20 UTC. The split is observable on chain; it is consistent with fragmentation but does not identify the operator. trace.kadena.ws/case/KT-17







