Binance hacker wallet holds nearly 500 billion SHIB, starts swapping
An address tagged as a Binance exploiter received nearly 500 billion SHIB, about 0.05% of supply, and swapped roughly 96 billion within hours, on-chain data show.
MEMECOINSSECURITY & HACKSNEWS
Daniel Hartley
10/30/20261 min read
Nearly 500 billion Shiba Inu (SHIB) tokens, worth about $2.25 million, ended up in an address linked to this week's Binance hack, and part of the stash was swapped within hours, according to on-chain data reported by U.Today and TokenPost. The holding equals roughly 0.05% of SHIB's total supply.
The SHIB left a Binance hot wallet labeled Binance 14 at 20:24 UTC on Oct. 29, TokenPost reported, the same minute that CryptoQuant data mark as the start of the attack. Etherscan tags the receiving address as "Exploit" and "Heist," and monitoring tools label it Binance Hot Wallet Exploiter 2. The address also holds USDT, USDC and ETH swept from Binance-labeled wallets.
Swaps begin overnight
The attacker did not sit on the tokens for long. Between 01:26 and 01:27 UTC on Oct. 30, three decentralized-exchange swaps sold about 96.02 billion SHIB in batches of 35.24 billion, 40.86 billion and 19.92 billion, TokenPost reported. By 03:34 UTC, about 403.9 billion SHIB remained across wallets tracked in connection with the incident. The report did not say which token the SHIB was swapped into.
Shiba Inu community member Mazrael first flagged the transfer. He described the address as brand new and said it received the tokens through an EIP-7702 delegation and an operator sweep, with the setup funded through Tornado Cash, according to U.Today. Mazrael used the episode to urge holders toward self-custody.
For SHIB, the immediate risk is selling pressure as the remaining tokens are liquidated, though the amount is small relative to daily trading. The broader incident is far larger: Binance puts the total impact at about $6.3 billion, of which roughly $3 billion has been frozen on-chain, and says user losses will be covered by its SAFU fund and company resources. Blockchain analytics firm TRM Labs has attributed the attack to North Korea.
Source: U.Today, TokenPost, BH News, CryptoQuant