Binance Hacker moves $4 million into three Binance deposit addresses as Arkham flags possible nested services and potential fund freezes.
Author: Akshay
November 2, 2026 – the Binance hacker deposited roughly $4 million into three Binance deposit addresses. Blockchain tracker Arkham Intelligence flagged the move. It says those addresses likely belong to nested services, not the hacker’s own account.
High Signal Summary For A Quick Glance
pleb
@puhleb
@arkham nested exchanges are basically borrowing your mate's card, and binance is about to ask the mate some awkward questions
Binance Hacker spotted depositing to Binance? The Binance hacker deposited $4M into 3 Binance Deposit addresses. These likely represent nested service(s), which are third-party exchanges that use Binance for liquidity provision and custody. https://t.co/0IenqrBmyq
12:13 PM·Nov 2, 2026
arfonzo
@arfonzo
@arkham Finder's fee and commissions innit @inversebrah
Binance Hacker spotted depositing to Binance? The Binance hacker deposited $4M into 3 Binance Deposit addresses. These likely represent nested service(s), which are third-party exchanges that use Binance for liquidity provision and custody. https://t.co/0IenqrBmyq
12:08 PM·Nov 2, 2026
Arbitrageur
@loan2own
@arkham Can’t Binance just freeze those assets?
Binance Hacker spotted depositing to Binance? The Binance hacker deposited $4M into 3 Binance Deposit addresses. These likely represent nested service(s), which are third-party exchanges that use Binance for liquidity provision and custody. https://t.co/0IenqrBmyq
11:29 AM·Nov 2, 2026
High attention and emotional sentiment detected.
The flow is small next to the record heist behind it. Still, it is one of the clearest signs yet. The attacker is now trying to launder and cash out stolen funds.
Arkham posted the alert at around 11:28 UTC. Its tracer showed funds moving from the Tron address TH1YKH9MUuJtDmeKPia4x9fZXAcPrMv8B. The money landed in labeled Binance deposit clusters.
The firm was careful with its wording. It said the three addresses “likely represent nested service(s).” Those are third-party exchanges that use Binance for liquidity and custody.
In other words, the Binance hacker did not necessarily deposit straight onto Binance. Instead, the funds more likely entered a smaller platform that runs on Binance in the background.
Exact transaction hashes sit inside Arkham’s entity dashboard. The firm labels the wallet “binance-hacker-2.” Its dashboard still tracked holdings worth billions across hundreds of addresses after the hack.
So far, Binance has not issued a public statement on these specific deposits. Secondary outlets such as Odaily and ChainCatcher simply restated Arkham’s claim and the nested-service caveat.
A nested service is a smaller crypto business that does not run its own custody or liquidity. Instead, it opens one or more accounts at a large host exchange like Binance.
Its customers deposit to the nested operator. That operator then routes the funds into the host’s deposit addresses for trading and liquidity. As a result, the host mostly sees a few busy accounts, not every end user.
This structure is a well-known money-laundering risk. According to analytics firm Elliptic, nested services often carry weak identity checks. Yet they still sit on top of a compliant exchange.
Therefore, illicit money can slip into reputable infrastructure while the true owner stays hidden. For the Binance hacker, that extra hop makes on-chain tracing to a final beneficiary harder.
The deposits trace back to the October 29, 2026 Binance exploit. It was the largest crypto heist on record. Attackers drained roughly $6.3 billion across multiple chains in under an hour.
Investigators point to a compromised DevOps engineer’s laptop as the entry point. On Ethereum, the attacker reportedly used EIP-7702. That let them delegate control of hot wallets such as Binance 14.
The drains moved fast. Arkham says $4.9 billion left in the first 14 minutes. A single transfer carried $2.53 billion.
Funds flowed across nine chains, with Ethereum hit hardest at about $3.8 billion. In total, the attacker took around 18,270 BTC plus roughly 167,000 ETH. You can trace the heaviest Ethereum sweeps on Etherscan.
Soon after, Tether and Circle froze close to $2.7 billion, mostly stablecoins. TRM Labs, Chainalysis, and the FBI later blamed North Korea’s TraderTraitor group. That group is linked to Lazarus.
Binance suffered an estimated $6.3 billion hack on October 29, 2026, attributed to North Korea’s TraderTraitor group. Following billions in asset freezes and Binance’s commitment to cover user losses, Arkham reported approximately $4 million flowing into three Binance deposit addresses linked to the hacker entity on November 2. The purpose and freeze status of these deposits remain publicly unconfirmed.
Attackers attributed by TRM Labs, Chainalysis, Elliptic, and later the FBI to North Korea’s TraderTraitor group drain Binance hot wallets across approximately 9–10 blockchain networks. Binance estimates the losses at around $6.3 billion, compared with Arkham’s initial estimate of $6.01 billion and TRM’s estimate of $6.36 billion. Most funds move within the first 14–20 minutes, including an Ethereum transaction worth approximately $2.53 billion. The reported attack vector involves a compromised DevOps engineer’s laptop and EIP-7702 delegation. Binance pauses withdrawals and pledges to cover all losses through company funds and SAFU.
Stablecoin issuers, primarily Tether and Circle, freeze approximately $2.7–3 billion in assets. The attacker splits around 18,270 BTC across 19 wallets, many holding exactly 1,000 BTC, which remain largely static initially. Laundering patterns emerge, including thousands of rapid transfers, particularly on Tron, discounted stablecoin-to-ETH swaps, and limited use of bridges and mixers. Preparation reportedly included small Tornado Cash withdrawals. Arkham labels the tracked addresses as the Binance Hacker entity. Binance reports approximately $3 billion frozen and sets aside around $6.34 billion to cover losses, representing roughly 90% coverage at this stage.
Further on-chain movements occur from the Arkham-labeled hacker entity, including large ETH transfers. Binance raises its reported loss coverage toward 95% and begins phased withdrawal resumption on November 1, initially supporting BTC and major networks. Reported user net outflows range from approximately $3.6 billion to $4.9 billion, depending on the snapshot. The FBI formally attributes the attack to TraderTraitor and notes conversion toward ETH alongside expectations of further laundering. No large-scale conversion of the remaining movable assets, particularly BTC, into fiat is confirmed by the end of October.
Arkham reports that the Binance Hacker entity deposited approximately $4 million into three Binance deposit addresses. The analytics firm says these addresses likely belong to nested services, meaning third-party exchanges that use Binance for liquidity provision and custody. Related flows include activity from Tron address TH1YKH9MUuJtDmeKPia4x9fZXAcPrMv8B. The transfers are viewed as a potential cash-out or laundering step through intermediary infrastructure, rather than evidence of a direct personal deposit by the attacker into Binance.
No specific public statement from Binance or its executives has addressed these deposits or confirmed a freeze of the related nested-service accounts. Recovery efforts and phased withdrawals continue, with Binance maintaining that user funds are covered. Any freeze would depend on Binance’s internal monitoring, law-enforcement coordination, or alerts from blockchain analytics firms. The status of the three deposit addresses remains publicly unconfirmed.
Binance paused withdrawals and said user funds were safe. In its Security Incident Update #2, Binance pledged to “absorb the financial impact of these stolen funds, not our users.”
According to Reuters, Binance set aside about $6.34 billion to cover losses. The funds came from company reserves, SAFU, and treasury. CEO Richard Teng said most drained tokens had been replaced, and phased withdrawals resumed around November 1.
Meanwhile, the attacker still controlled billions in movable Bitcoin and Ether. The November 2 nested-service deposit suggests the Binance hacker has now started testing exit routes.
The $4 million deposit itself barely moved prices. The original hack was a different story.
Bitcoin dipped toward the mid-$70,000s in some reports as the news spread. BNB fell harder as a proxy for exchange risk, sliding to around $680. By November 1 and 2, BNB had recovered to roughly $705 to $712.
That modest rebound tracked the phased withdrawal reopening and Binance’s coverage pledge. For now, traders appear to read the November 2 flow as a tracing update, not a market event.
The open question is whether Binance can act on these flows. Even with a nested layer in between, the host exchange can still freeze or investigate the underlying account once alerted.
Several unknowns remain. It is unclear whether Binance has frozen the accounts. The nested services may also stay unidentified, and secondary freezes are not confirmed.
Analysts also caution that Arkham’s labeling is the basis for the claim. Final confirmation that these exact funds came from the October 29 drains has not been published.
Expect more tracing updates as Arkham and other firms follow the money. The next signal to watch is whether the Binance hacker cashes out through these addresses or retreats after the exposure.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
Binance Hacker Sends $4M to Nested Services, Arkham Says
Solana Validator Kernel Bug Sparks Urgent Patch Warning
Binance Hacker Gate Deposit Frozen After $250K Transfer
Trezor Safe 5 Implant Reported in CryaptoBilis Wallet
Binance Hacker Sends $4M to Nested Services, Arkham Says
Solana Validator Kernel Bug Sparks Urgent Patch Warning
Binance Hacker Gate Deposit Frozen After $250K Transfer
Trezor Safe 5 Implant Reported in CryaptoBilis Wallet
