Binance hacker wallet 0x2a82…2029

THORChain AVAX→BTC wash, attribution and odds · built 2026-11-03 19:04 UTC · not financial advice

Wallet

0x2a828d0b500d93abf98f135fa5d750634c062029

Arkham entity

Binance Hacker

Today's THOR swap

10,926 AVAX ≈ $93K

BTC out (done)

1.194 BTC

Oct 31 TRX→ETH legs

4 swaps + 10 refunds

Odds it's the hacker

~95%

Why it's the Binance hacker

1. Arkham tags it. Both 0x2a82…2029 and the Tron wallet that fed it, TB3viNboTwfjZ5ohzHjSBxwSRr6T6duU5b, sit under Arkham's Binance Hacker entity (hacker + suspicious tags, every chain).

2. THORChain memos hard-link them. On Oct 31, TB3vi… sent TRX into THORChain with memos =:e:0x2a828d…2029. Every swap and every refund paid ETH out to this wallet. That's a deterministic on-chain link, not a heuristic.

3. Public reporting. An Oct 31 exit-route thread lists "THORChain → ETH: ~184M, to 0x2a828d…2029" as one of the hacker's TRX exits.

4. Today's pattern is laundering-shaped. About 93K USDC was minted on Avalanche via Circle's bridge into two fresh wallets, swapped to AVAX, pushed into this wallet, and swapped to BTC on THOR within about 13 minutes. Gas came from small HitBTC and Bybit withdrawals. Lookalike "2a82…2029" addresses spamming it afterward are address-poisoning, ignore them.

Timeline (UTC)

Oct 29, 20:05–23:05

Binance hot wallets drained

multi-chain drain, ETH bags still mostly parked

Oct 31, 11:07–12:07

TB3vi… swaps TRX→ETH on THOR to 0x2a82…2029

4 fills + 10 refunds (price-limit / chain issues); ETH lands in 0x2a82 each time

Oct 31, 23:03

Exit-route thread names 0x2a82…2029

only public post naming the wallet so far

Nov 3, 18:27–18:33

Funder 0xb91d…76c9 set up

gas from HitBTC + Bybit hot wallets, ~93.2K USDC minted via Circle bridge

Nov 3, 18:36 / 18:39

6,066.2 + 4,860 AVAX into 0x2a82

from 0xb91d…76c9 and 0xcbe4…bb4d (fresh)

Nov 3, 18:40

10,926 AVAX → THOR, streaming to BTC

to bc1qa5n7qryprtttd65nm4tjyq4gkvnglf79t92dxr

Nov 3, before 19:03

Swap completed: 1.194 BTC paid out

THOR out tx 4BFDE892…15C9

Odds

QIs 0x2a82…2029 the Binance hacker?

Hacker-controlled

~95%

Arkham entity tag + THOR memos directly routing tagged TRX into it + laundering pattern

Hired launderer / OTC desk acting for them

~4%

still the hacker's funds, just a different hand on the keys

Unrelated / mislabel

~1%

would need both Arkham and the THOR memo trail to be wrong

Conclusions

It's them. Today's swap is a ~$93K test through an open lane (AVAX→BTC) while ETH stays halted on THOR. Nobody else has reported this swap on X yet. The real signal is the big ETH bags moving once ETH reopens.

Links: Arkham 0x2a82 · Arkham TB3vi · THOR swap today · THOR history · Snowtrace · BTC dest · Oct 31 thread