USD 6.3B left in an hour. The money is still on the map.
Basis of every line: onchain read from Ethereum by UnyKorn with the raw file named · reported by firms, issuers, the exchange or press · preliminary the exchange's unconfirmed finding · article the 29 Oct fund-flow article · explorer a public label list read in a browser, full addresses not yet imported.
Wallets we watch
Every address, read again every fifteen minutes
Balance, nonce and code for each watched address. A nonce that rises means the wallet sent something. A code starting with 0xef0100 means an EIP-7702 delegation is live. Pools with a nonce of zero have never sent a transaction.
| Wallet | Address | ETH | Change | Nonce | Delegation |
|---|
What took place, in order
From the first mixer deposit to the exits
All times UTC. The strip shows 29 October from the rehearsals to the revocation: grey ticks are rehearsals, the orange tick is the delegation, the shaded window is the 3h 49m Binance 14 ran the attacker's code, dark ticks are the calls inside it, green is the revocation.
How it happened
Six links, one signer that never said no
The 50-authorization clue, checked on chain. Transaction 0xad99…298b (block 26,300,753, 20:20:59) was sent by the operator wallet 0x7C86…5CA0. It carries 50 authorizations for Binance 14 with nonces 18,914,775 to 18,914,824, all for chain id 1, all pointing at 0x63e8…6fAe. Only nonce 18,914,809 was valid; the other 49 failed with invalid nonce. An authorization takes effect only if its nonce matches the wallet's current nonce, and a busy hot wallet's nonce moves constantly, so the attacker had the signer produce a spread of 50 to be sure one would hit. Every one of those 50 carries a valid Binance 14 signature.
Our read: why this was not a protocol bug. EIP-7702 ran code chosen by whoever held signing authority, which is what it is for. On the other nine chains and on Binance 16 the same access produced ordinary signed transfers with no delegation at all. The common factor across all ten chains is the signing pipeline. EIP-7702 only made the Ethereum side faster and longer-lasting, because a single signature became a standing permission.
Where the money went
One hub, nine pools, hundreds of staging wallets
Click a node. Animated edges are paths the money has already taken. The pattern: anything an issuer can freeze was converted to ETH as fast as liquidity allowed, and the ETH was parked.
The nine pools
| # | Address | ETH | Funded by | Watched |
|---|
Ethereum routes at the article's 23:24 snapshot
| Route | Asset in | Path | State |
|---|
What can be frozen, what cannot, what still stops it
Where it is going now
The exits, as of 1 November
How to fix it
Each link in the chain, and the control that breaks it
The signing-policy, execution and persistence rows alone would have contained most of the Ethereum loss.
Could it have been prevented?
The response so far
How we track it
Workers read, agents record, the ledger witnesses
Every component carries its honest state. Done means running and verified against the served response; a script that has never run is not done.
The next layer
GET /v1/health service, last snapshot time and block
GET /v1/snapshot latest reading of every watched address, with its SHA-256
GET /v1/alerts moved, drained, topped_up, delegated, revoked
GET /v1/watchlist the addresses being read
Where it stands, 1 November
| Item | Status | Basis |
|---|
Sources
Some outlets give slightly different times for the same event. On-chain timestamps are used where they exist. Exchange figures are company-reported. Raw chain reads: tracker/evidence/2026-11-01/ in the FlashRouter repository.
Operated by UnyKorn LLC (Wyoming). UnyKorn LLC is a technology and administration service provider. It is not a bank, broker-dealer, exchange, custodian, trustee, transfer agent, appraiser, auditor, investment adviser, money transmitter, or issuer of securities. Nothing on this site is an offer to sell or a solicitation to buy any security, loan, or financial product. This page tracks public blockchain data; it names wallets, not people.