Binance incident: 130-plus altcoin swaps yield about $279 million
The short answer
Lookonchain monitoring cited by Odaily and PANews says the attacker associated with the Binance incident swapped more than 130 altcoins on EVM chains for 123,400 ETH and 1.69 million USDC. The reports value the ETH at $277.26 million, bringing the reported proceeds to about $279 million. Odaily published its report on November 1 at 15:10 SGT. These are reported swap proceeds within a stated chain scope; they do not establish a new total loss for Binance or an amount returned to customers (Odaily's report).
For readers following our Binance incident timeline, the new detail is how a basket of altcoins was converted into ETH and USDC. The practical question is whether a headline describes tokens leaving a wallet, assets received in a swap, or funds recovered. Keep those entries separate when reviewing your own balances and pending transfers (PANews' account of the swap proceeds).
Show less
The $279 million is an output figure
The dollar arithmetic is straightforward: $277.26 million attributed to the ETH component plus $1.69 million in USDC equals $278.95 million. Rounded to the nearest million dollars, that is $279 million. The rounding explains why a headline can use $279 million while the components add to $278.95 million. Both figures refer to the same reported conversion (PANews: The $279 million is an output figure).
That calculation says nothing by itself about the dollar value of the altcoins before they were sold. To calculate a trading loss, a researcher would need the input quantities, their valuation at a defined time, execution proceeds and relevant costs. The short reports provide an aggregate output and selected input examples. We therefore use “proceeds” for this number and leave the aggregate execution loss uncalculated. This distinction follows directly from the quantities the reports actually supply (ChainCatcher's breakdown).
The scope also matters. Odaily says the count covers EVM chains alone. A reader should not treat the 130-plus tokens as a complete inventory across every chain involved in the wider incident. The report does not provide a complete chain-by-chain ledger or an inventory of assets still held. Adding this subtotal to another incident headline could count the same funds again if that headline already includes their earlier transfer (Odaily: The $279 million is an output figure).
ETH accounts for almost all the reported dollar proceeds
Using the values in PANews, the ETH portion represents approximately 99.39% of the $278.95 million total: 277.26 divided by 278.95, multiplied by 100. The USDC component makes up approximately 0.61%. Those are our calculations from the reported values, rather than a separate wallet inspection. They show how strongly this particular proceeds figure depends on the dollar valuation assigned to ETH (PANews: ETH accounts for almost all the reported dollar proceeds).
Dividing $277.26 million by 123,400 ETH gives an implied valuation of approximately $2,246.84 per ETH. That is an arithmetic reference embedded in this report. It is not a fresh market quotation, a verified average fill price for every swap, or a price available to the reader. The source does not explain whether the dollar value uses one observation time or transaction-specific prices (PANews: ETH accounts for almost all the reported dollar proceeds).
The unit distinction helps when comparing subsequent reports. If a later article repeats the same ETH quantity with a different dollar value, the first check should be its valuation time and method. A different dollar figure alone would not prove another swap occurred. Conversely, a newly documented increase or decrease in ETH units would be a separate observation requiring its own transaction evidence. This is a reading method based on the report's separation of asset quantities and dollar values (Odaily: ETH accounts for almost all the reported dollar proceeds).
UNI, ENA and PEPE provide a partial breakdown
ChainCatcher gives three examples within the wider conversion. It reports about 7.0188 million UNI exchanged for 17,585 ETH; about 217 million ENA exchanged for 15,288 ETH; and about 7.77 trillion PEPE exchanged for 14,049 ETH. These are reported input and output quantities. They are not measurements of the subsequent price move in any of those tokens (ChainCatcher: UNI, ENA and PEPE provide a partial breakdown).
Adding the ETH outputs produces 46,922 ETH: 17,585 plus 15,288 plus 14,049. Compared with the aggregate 123,400 ETH, those three examples account for approximately 38.02% of the reported ETH proceeds. The remaining 76,478 ETH is the arithmetic difference. We cannot assign that remainder to particular tokens from the details in these reports. The examples explain a substantial part of the output without supplying the full token list (ChainCatcher: UNI, ENA and PEPE provide a partial breakdown).
A holder of UNI, ENA or PEPE should avoid reading an execution quantity as a price forecast. The breakdown does not say which liquidity pools handled each trade, how the orders were routed, when each execution occurred, or which other buyers and sellers traded at the same time. Claims that the reported transactions caused a particular percentage decline would require matching transaction and market evidence that these short reports do not include (ChainCatcher: UNI, ENA and PEPE provide a partial breakdown).
There is also no basis here for assuming that the three named tokens were the only positions sold, the first positions sold, or the largest positions by their original dollar values. The aggregate covers more than 130 altcoins; the breakdown names three. Their prominence in an article reflects the information available, rather than a verified ranking of the entire conversion (ChainCatcher: UNI, ENA and PEPE provide a partial breakdown).
Why a quoted token value can differ from execution proceeds
Uniswap's official v2 pricing documentation explains that pool reserve ratios and the constant product formula determine a swap's execution price. It distinguishes an exact input, where the amount sold is fixed, from an exact output, where the amount received is fixed. For your own swaps, check which side is fixed and what minimum receipt or maximum payment the preview specifies. This is pricing background, without establishing that these incident transactions used Uniswap v2 (Uniswap v2 pricing principles).
Three readable reports share one monitoring origin
Odaily, PANews and ChainCatcher each attribute these figures to Lookonchain. Seeing the numbers repeated across three publications helps identify the reported claim, but it does not create three independent on-chain investigations. Our attribution stays with Lookonchain as reported by those outlets. The original wallet labels and the complete transaction set have not been independently reconstructed in this article (Odaily: Three readable reports share one monitoring origin).
This sourcing detail affects what a follow-up can establish. Another report repeating 123,400 ETH would be another account of the same observation unless it supplies a different evidentiary basis. A transaction-level reconstruction with addresses, hashes and a defined cutoff could add evidence. An official statement could address a different question, such as customer liabilities or service status. Neither kind of confirmation should be inferred from the number of headlines repeating the initial tally (PANews: Three readable reports share one monitoring origin).
What to check in your own exchange account
Start with the transaction you actually need to resolve. If you are checking a pending withdrawal, record its asset, network, amount, destination and any transaction identifier displayed by your account. Compare those details with the status shown in the account and the exchange's official service channels. The 130-token report is about a reported attacker conversion; it does not establish the outcome of your individual withdrawal (Odaily's scope).
If you hold one of the named altcoins, separate account reconciliation from a trading decision. Check the number of units you own and any open orders before drawing conclusions from a dollar headline. Do not assume your balance changed simply because an attacker reportedly sold the same asset elsewhere. The source's input quantities describe the reported conversion, without identifying the reader's account or any order executed on their behalf (ChainCatcher's token quantities).
Treat a message offering “Binance compensation” as a claim to verify through the official account interface and official channels. Do not use an unsolicited message as the starting point for connecting a wallet or signing a transaction. This is a suggested precaution for readers tracking an incident; the swap reports do not establish a specific compensation programme, claim form, eligibility rule or payment deadline (PANews' incident report).
For any transfer you are considering, read the current deposit and withdrawal information for that exact asset and network inside the service you intend to use. This article makes no claim that a particular network is open or closed now. A proceeds tally cannot answer that operational question. Preserve the information already associated with a pending transfer so a later status update can be checked against the same transaction (Odaily's reported conversion).
For a pending withdrawal, use a short reconciliation sequence:
- Copy the asset, network, amount and destination from your existing account record.
- Save any transaction identifier and the status shown, together with your observation time.
- Check the same transaction through the service's official channels before treating a later headline as an update to your transfer.
These checks concern your own records. The reported 123,400 ETH proceeds cannot identify the status of an individual customer's withdrawal (Odaily's reported observation).
Quick answers
Does $279 million mean another $279 million was stolen?
The reports describe assets received after altcoins were swapped. They do not establish an additional theft of that amount. Determining whether proceeds overlap an earlier outflow estimate requires a common transaction set and accounting cutoff. We have not made that reconciliation, so the $279 million stays labelled as reported proceeds on EVM chains (Odaily: Questions the report leaves open).
Has the ETH been recovered or frozen?
The cited reports say the swaps yielded ETH and USDC. They do not provide a recovery record for that output. Receipt by an address, freezing, return to an exchange and a credit to a customer account are distinct events to verify. This article does not infer any of those later outcomes from the swap quantities (PANews: Questions the report leaves open).
What would make the next update useful?
The most useful follow-up would identify a new transaction, a changed quantity, a documented destination or a verified recovery tied to these proceeds. A complete list of the tokens and chains would also sharpen the scope. Until then, the specific new fact is the reported conversion of more than 130 altcoins into 123,400 ETH and 1.69 million USDC, with the three named examples supplying a partial breakdown (ChainCatcher: Questions the report leaves open).