On 29 October 2026 at 20:20 UTC, 11 withdrawals moved 18,270.2 BTC from one Binance hot wallet to an attacker-controlled address, which split it into 19 wallets inside the same block. Using only the Blockstream Explorer API (Enterprise tier), we rebuilt the full transaction graph, profiled 2,700 transactions of the victim wallet, and checked every output against the chain tip.
TRM Labs, CoinDesk and others reported the 18,270 BTC outflow and the split into 19 wallets. The chain data also shows:
Ten posts, ready for X. Each card is drawn at 1200 × 675, X's 16:9 image size.
Unspent outputs created by the split, checked at block . "Dust" counts unsolicited payments received since.
All from bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h to bc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm, block 973,732.
/tx/:txid/outspends until it was unspent./address/:addr/txs/chain (2,700 transactions, blocks 973,274–973,757). The pre-theft balance is reconstructed by walking those transactions back from today's balance./block/:hash/txs, to place the theft and the split in the block's fee ranking./waterfalls/v2/waterfalls?addresses=…) returns the history of all 19 wallets: 49 entries in about 1.1 s.3M219KR5vEneNb47ewrPfWyb5jQ2DjxRP6 is an inference: it holds about 174,000 BTC and sent the hot wallet 4,000 BTC the day before.enterprise.blockstream.info/api).