Funds linked to the Binance exploit have continued moving through Ethereum and Tron, even as issuers and network authorities restrict other assets. Crypto University’s monitoring identified a 17,260 ETH transfer to a new recipient, a five-transfer split of 638.2 million TRX, and two unsuccessful attempts to move roughly 29,934 wBETH.
Binance, meanwhile, says it has reserved more than $6.34 billion of company funds to cover the incident, including $5 billion already held in the affected token assets. These are different parts of the response: attacker-linked wallet movements, frozen balances and company resources must be accounted for separately.
Published October 30, 2026. On-chain monitoring snapshot: 13:43 UTC / 17:43 Dubai. Binance’s official feed was checked again before publication. The movements below occurred earlier today; they are not all new in the latest monitoring hour.
This follows our initial report on the Binance incident and issuer responses. The new evidence shows how the trail has developed beyond the first receiving wallets.
A 17,260 ETH transfer opened another branch
At 05:15:47 UTC / 09:15:47 Dubai, the Ethereum address 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c, labelled “Binance Hot Wallet Exploiter 2” by Etherscan, sent 17,260 ETH to 0x03b0ee5d82990cff1bda48651ac3e436d1a020ea. A 0.1 ETH transfer to the same destination preceded it at 05:14:35 UTC.
The main transfer and preceding transfer were successful. The recipient still showed approximately 17,260.10 ETH in our latest address overview sample.
This creates another address to monitor. It does not establish an exchange deposit, a sale or a cash-out. The recipient’s operator is not independently identified; explorer labels describe attribution, not a proven human identity.
Three Ethereum wallets consolidated 14,529 ETH
Between 05:31:11 and 05:35:47 UTC / 09:31:11 and 09:35:47 Dubai, three tracked wallets sent approximately 14,529.471 ETH into 0x79e70d139fc05aa75f75611fdf2680e9952b544a. The successful transfers were approximately 11,560.824 ETH, 2,856.896 ETH and 111.751 ETH.
The destination’s latest observed balance was about 34,279.69 ETH. Consolidation can simplify subsequent movements, but these transactions do not establish the next destination or purpose. Counting each hop as fresh stolen money would inflate the incident total.
Tron: a 638.2 million TRX stash split across five recipients
The largest newly tracked batch in our Tron monitoring came from TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A. Between 10:15:21 and 10:20:18 UTC / 14:15:21 and 14:20:18 Dubai, it sent 638,200,900 TRX across five successful, confirmed transfers:
- 120 million TRX to
TAk1xJNWuBYvJHLsUiBFLeuK6xvpQUFYP5. - 120 million TRX to
TL2F4GhnaFVZBZPncHYjwfYZFW44NcfVwj. - 120 million TRX to
TCBAz7itvtX5CjBzVMPQdrbwQLN63ao1fk. - 120 million TRX to
TJajtPqDqUGh1Sr1j8ugHoSXBVpaFLLHKT. - 158.2009 million TRX to
TKkH2vH6kyi2QKcMbqym53WMuvdd1xvw6K.
The first recipient then sent its 120 million TRX onward at 10:20:48 UTC to TRBdWqHnDVSZCVGfgHdKFLQPirQcA2PRki, an address already present in the traced branch. The same lot must not be counted twice. The other four recipients showed no outgoing transactions in the latest normal-transaction samples reviewed.
The connection comes from a traced funding path, rather than independent proof of who owns every recipient. Continuing small transfers further downstream expand the monitoring workload, but do not automatically demonstrate a new laundering service or exchange destination.
Two wBETH transfer attempts failed
At 06:57:35 and 06:58:47 UTC / 10:57:35 and 10:58:47 Dubai, address 0x7f9dc988b46336ad536828fad50fa8fa1e5415e3 attempted to transfer approximately 29,934 wBETH back to the Ethereum hub.
Both transactions reverted, with no successful corresponding token-transfer logs. They attempted to move the same quantity; they do not represent two separate recovered balances. We have not independently established the precise revert cause, so these failures alone should not be described as proof of a newly imposed freeze.
Arbitrum’s intervention shows a different form of asset restriction
In a primary announcement, Arbitrum said its Security Council froze approximately 8,425 ETH and 74,559,805.2 ARB associated with the exploit. The linked Ethereum execution succeeded at 00:08:35 UTC / 04:08:35 Dubai and was finalized when checked.
The logs identify the override sender as 0x3e2bf1ac6bf0934bbba6456c341c2ecbced632d5 and destination as 0x0000000000000000000000000000000000000da0. Arbitrum says moving the restricted funds requires a DAO vote. The ETH payload is approximately 8,426 ETH, slightly above the announcement’s rounded 8,425 figure. We corroborated the L1 action and payload; independent L2 balance verification was unavailable.
This was an earlier intervention, not a new freeze in the latest monitoring hour. Nor does it mean the assets have been returned to Binance. It should not be added to the exchange’s aggregate freeze estimate without reconciling overlap.
Binance’s latest position: company coverage and withdrawals
At 10:55 UTC / 14:55 Dubai, Binance said it had reserved over $6.34 billion of company funds, with $5 billion already held in the exact affected token assets. It said purchases of the remaining assets were continuing through market and OTC channels, subject to liquidity and settlement constraints.
Binance explicitly excluded frozen or protected assets from those company-fund figures. It continued to report roughly $3 billion frozen and promised public reserves verification. These are company statements; our wallet monitoring does not independently verify the reserved treasury assets or completion of the purchases.
An 08:47 UTC update also said investigators found additional breach points beyond the initial laptop explanation. Deposits were unaffected, while withdrawals remained paused with a stated 45-hour resumption target measured from that announcement. That was an estimate, not confirmation that withdrawals had restarted. Later transfers among traced recipients should not be confused with fresh outflows from Binance.
The practical lesson: avoid depending on one venue
A withdrawal interruption can leave users unable to access funds when needed, even when an exchange promises full coverage. For people who need exchange access, spreading a limited working balance across independently operated venues can reduce dependence on a single company. Keeping suitable longer-term holdings in self-custody is another option, provided the owner can manage keys and backups securely.
OKX is one alternative worth evaluating for that diversification. It publishes proof-of-reserves reports and verification information, giving users disclosures to review alongside fees, withdrawal conditions and regional eligibility. For an eligible user whose exchange access is concentrated entirely on Binance, establishing a second venue can be a better arrangement for managing that concentration risk.
Readers who choose to explore it can use Crypto University’s OKX partner link. Affiliate disclosure: Crypto University may earn a commission if you use this link. OKX remains a custodial exchange with its own risks. Proof of reserves is a snapshot, not a guarantee against hacks or interruptions. Diversification reduces reliance on one venue; it does not eliminate custody risk. Binance balances subject to a withdrawal pause cannot simply be transferred out until access resumes.
What the monitoring can—and cannot—tell us
The latest check covered 30 Bitcoin addresses, 27 Ethereum recipient overviews and normal-transaction samples, hub normal/internal/ERC20 samples, and 15 Tron normal-transaction samples. No new material Bitcoin outgoing movement was verified within those samples. That is a bounded observation, not a claim that every affected wallet was inactive.
Arkham’s entity displayed 99 addresses in the latest check, up from 72. Its portfolio also changed. Without a reconciled membership list, those differences cannot be treated as fresh theft or new purchases. Complete multichain coverage and full recipient token/internal histories remain outstanding.
Methodology: direct Ethereum explorer records; confirmed TronGrid transaction and receipt data; Bitcoin explorer samples; original Binance announcements; and Arbitrum’s official report. Explorer attribution and company claims are identified separately from observed fund flows. The cover is a conceptual AI-generated editorial illustration.
