Monday, November 2, 2026

Binance Exploit Wallet Locks $3.5M in NEWT Contract

An neon-lit vault scene with NEWT token, glowing smart contract barrier, and chained altcoins, illustrating DeFi risk.

A wallet linked by onchain analysts to the recent Binance attacker has permanently stranded millions of dollars in tokens after sending them directly to Newton Protocol’s NEWT contract. According to Lookonchain, the transfer was apparently accidental and initially valued at approximately $3.32 million. Newton Foundation subsequently confirmed that roughly 8 million NEWT and 17 other tokens were sent to the contract, valuing the combined assets at about $3.5 million.

The recipient was the official NEWT contract at 0xd0ec028a3d21533fdd200838f39c85b03679285d, rather than a conventional wallet controlled by the attacker. The Foundation said the contract was not exploited or compromised during the transaction. The assets became inaccessible because the contract has no owner or administrator capable of transferring them back out. Administrative rights were renounced onchain in 2025 and its upgrade functionality was permanently disabled, according to the Foundation.

Immutable Contract Makes Recovery Impossible

That architecture prevents the Foundation from modifying the contract simply to correct the transfer. Newton said neither it nor another party has a mechanism to retrieve the deposited assets, leaving them permanently beyond the attacker’s control. Immutability is functioning as designed in this case, but the same restriction that prevents administrative intervention also eliminates a recovery route for mistakenly transferred assets. The tradeoff resembles broader questions around immutable blockchain contracts that remain consequential after deployment, although Newton itself was not exploited.

The locked assets should not be described technically as having been burned. A conventional token burn normally removes units from supply through a designated mechanism or inaccessible burn address, as occurs in programs such as TRON ecosystem token burns. Here, the tokens continue to exist at the NEWT contract address. What has been eliminated is practical control and market availability, not necessarily the reported total supply of each affected ERC-20 token.

The distinction is particularly relevant for the approximately 8 million NEWT involved. Newton’s own documentation establishes a fixed supply of 1 billion NEWT, with the token deployed as an ERC-20 on Ethereum. The project describes NEWT as the native utility token for Newton Protocol, supporting staking, transaction fees, agent-model services and future governance. The accidental transfer does not modify the contract’s fixed-supply rules; it simply leaves those particular tokens inaccessible inside the contract.

Wallet Attribution Remains an Onchain Assessment

Lookonchain described the sender as the Binance hacker, while Arkham labeled the associated address 0xA97b...8d10 as linked to the Binance attacker. That attribution should remain distinguished from identifying the human or organization controlling the wallet. Blockchain labels establish an analytical connection to tracked exploit flows, not the real-world identity of the person behind an address.

The episode also differs from cases where stolen assets are merely frozen and could potentially be recovered through governance, issuer controls or legal intervention. For example, assets frozen following the Nomic bridge exploit remained immobilized while recovery options were evaluated. Newton says these tokens face a stronger technical constraint: nobody retains administrative authority capable of moving them.

Newton Foundation said it has shared its findings with Binance and will continue assisting with the investigation. For the wider Binance incident, that leaves the $3.5 million transfer as a relatively small but unusual component of the attacker-linked fund movements. The confirmed outcome is not a new exploit against Newton Protocol, but an apparently erroneous transfer into an immutable contract that permanently removed the assets from the sender’s control.

Scroll to Top
Chain Report
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.