DEV Community: ILIA KARPENKO

Was Binance Hacked? What the Onchain Data Shows (October 29, 2026)

ILIA KARPENKO — Thu, 29 Oct 2026 23:27:37 +0000

Updated: Oct 29, 2026, 23:20 UTC

An EIP-7702 delegation came first. 167,464 ETH left Binance 14 3 minutes and 24 seconds later.

Was Binance hacked? Binance has not confirmed a cause, but Etherscan labels the sender of the 167,464 ETH transfer "Binance Hot Wallet Exploiter," CZ wrote "It does look like a hack on Binance," and Binance wrote of a "potential security issue" with no amount. The steps below give each transaction with its time, source and screenshot, what is not known, and how you can check it yourself.

How Was Binance Hacked? What the EIP-7702 Delegation Shows

Binance has not confirmed a cause. Here is what the chain shows. All times are UTC.

Step 1. Funding, Oct 28 and Oct 29. The initiator, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0, received 0.1 ETH from the Tornado.Cash pool on Oct 28 at 07:39 and 08:53 UTC, and on Oct 29 at 08:23 UTC. Etherscan labels the address "Binance Hot Wallet Exploiter."

Source: Etherscan, initiator address, read 21:34-21:38 UTC, Oct 29, 2026.

Step 2. Contract created, 15:59:11 UTC. The initiator creates contract 0x63e842B054Bd624a465454D533C33F573e9c6fAe. Its source code is not verified on Etherscan. Transaction

Step 3. EIP-7702 delegation, 20:20:59 UTC. The initiator sends a transaction that Etherscan describes as "EIP-7702: Binance 14 Delegate to 0x63e842B0...73e9c6fAe." A delegation needs an authorization signed by the key of Binance 14. How that signature was obtained is not known. Transaction

Source: Etherscan transaction 0xad9926…298b, read 21:34-21:38 UTC, Oct 29, 2026. Transaction time: 20:20:59 UTC.

Step 4. 167,464.25 ETH out, 20:24:23 UTC. Three minutes and 24 seconds after step 3, Binance 14 sends 167,464.25 ETH and dozens of tokens to 0x5227…2f8c. Etherscan labels that address "Binance Hot Wallet Exploiter 2." Transaction

Source: Etherscan transaction 0x53bd38…e2f3, read 21:34-21:38 UTC, Oct 29, 2026.

Step 5. USDC out of Hot Wallet 34, 20:41:23 and 20:59:47 UTC. The initiator calls Binance 14 a second time. 780M USDC and 43M USDC leave "Binance: Hot Wallet 34" for 0x5227. The total is 823M USDC. Transaction

Source: Etherscan transaction 0xdc102d…7481, read Oct 29, 2026 (transfer time 20:41:23 UTC).

Step 6. Delegation on, 21:36 and 21:53 UTC. At 21:36 UTC the Etherscan page for Binance 14 shows "Delegated to 0x63e842B0...73e9c6fAe," and a 41.49 ETH deposit is pending. At 21:53 UTC the delegation was on when we checked.

Source: Etherscan address page for Binance 14, read at 21:36 UTC, Oct 29, 2026.

What the chain shows and what it does not. The chain shows the sequence and the times. It does not show how the key signature was obtained, who controls the initiator, or whether Binance has verified any of this. Etherscan labels name addresses. They do not name owners.

Full timeline (UTC)

All times are UTC on October 29, 2026, unless the row gives another date. Each row names its source.

Time (UTC)	What the chain or a source shows	Source
Oct 28, 07:39 and 08:53	Initiator 0x7C86…5CA0 is funded from the Tornado.Cash 0.1 ETH pool	Etherscan
Oct 29, 08:23	Same initiator, same pool, 0.1 ETH	Same page
15:59:11	Initiator creates contract 0x63e8…6fAe. Its source code is not verified on Etherscan	Transaction
20:20:59	EIP-7702 transaction from the initiator. Etherscan action: "Binance 14 Delegate to 0x63e842B0...73e9c6fAe"	Transaction
20:24:23	Binance 14 sends 167,464.25 ETH to 0x5227…2f8c, with dozens of tokens	Transaction
20:24:47	Binance 16 sends 55.7M USDT, 25.9M RLUSD and other tokens to 0x5227	Etherscan token transfers of 0x5227
20:30:11	500M USDT to 0x9749…C762. Within 30 minutes it splits into eight transfers	Etherscan token transfers
20:30:34	Arbitrum: Binance 54 sends 74,559,805.2 ARB to 0x5227	Arbiscan
20:33:23	200M USDT to 0x0Ddf…697e	Etherscan token transfers
20:38:47	195,460 ETH to an address labeled "Binance Hot Wallet Exploiter 8"	Transaction
20:41:23	780M USDC from "Binance: Hot Wallet 34" to 0x5227	Transaction
20:52:59	190M USDT from 0x0Ddf…697e to an address labeled "Binance Hot Wallet Exploiter 3"	Etherscan token transfers
20:59:47	43M USDC from Hot Wallet 34 to 0x5227. Total from Hot Wallet 34: 823M USDC	Etherscan token transfers
21:04:23	Second sweep from Binance 14: small amounts and 3.9M USDT	Etherscan token transfers
21:13:44	Whale Alert: an address with 823,000,000 USDC frozen	Whale Alert
21:15:23	CZ: "It does look like a hack on Binance."	CZ
21:22:59	88,541,065 RLUSD to 0x5C23…A00Fea4FC, forwarded at 21:25:59	Etherscan token transfers
21:29:09	Binance: "potential security issue"	Binance
21:31:37	Whale Alert: 174,999,872 USDT frozen at an address	Whale Alert
21:33	DeBank shows $2.34B for 0x5227 (it showed $2.42B at about 21:05)	DeBank
21:36	Binance 14 page shows "Delegated to 0x63e842B0...73e9c6fAe." A 41.49 ETH deposit is pending	Etherscan
21:36:30	Arbitrum: 0x5227 sends all 74,559,805.2 ARB to 0x3E2b…32d5	Arbiscan
21:38	Binance's post is edited. The new text adds an update promise and a scam warning	Binance
21:42:33	Watcher.Guru posts "Binance hacked with over $5.6 billion stolen," with a breakdown by asset	Watcher.Guru
21:53	Delegation active for Binance 14	Etherscan check, see step 6
22:15:56	A post on X says USD1 has frozen $27M associated with the Binance incident	Post on X
22:23:14	CZ: "Loss might be a bit higher than that, but will cover."	CZ
22:33:11	Binance: security checks; withdrawals paused until the security issue is fully resolved	Binance
From about 22:58	Binance 14 sends its tokens one per block to "Binance: Cold Wallet 20"	Etherscan, COVER transfer
23:03:47	8,405,741.58 SNX moved from 0x5227 to "Synthetix: protocolDAO"	Transaction
23:04	Binance 14 shows "Delegated to 0x63e842B0...73e9c6fAe"; ETH 0.94, tokens over $919K	Etherscan

How an EIP-7702 delegation works, in plain words

An Ethereum wallet is controlled by one private key. EIP-7702 lets that key sign an authorization that tells the wallet to run the code of a chosen contract. The wallet keeps its own balances. The contract's code is not copied into the wallet. It runs on the wallet's assets while the delegation is set.

The EIP-7702 specification says the account being delegated signs each authorization, and the sender of the transaction pays for it. A new authorization that points to the zero address clears the delegation. So the key has to sign a new authorization to remove it.

In this case, the Etherscan action at 20:20:59 UTC reads "EIP-7702: Binance 14 Delegate to 0x63e842B0...73e9c6fAe." The transaction sender is labeled "Binance Hot Wallet Exploiter." By the spec, the authorization needs a signature from the key of the delegated account. So the signature must come from Binance 14's key. How that signature was produced is not known.

Where the funds went

ETH, 20:24:23 UTC. See step 4 above. 167,464.25 ETH went from Binance 14 to 0x5227…2f8c. Etherscan labels that address "Binance Hot Wallet Exploiter 2." We give amounts in ETH and tokens. Sources give different USD values for the same ETH, so we leave USD out.
USDC, 20:41:23 and 20:59:47 UTC. See step 5 above. 780M USDC and 43M USDC went from "Binance: Hot Wallet 34" to 0x5227. The total is 823M USDC.
ETH, 20:38:47 UTC. 195,460 ETH went to the address labeled "Binance Hot Wallet Exploiter 8" (0x8532…43D4). Etherscan showed a balance of 195,460 ETH there at 21:31 UTC.

Source: Etherscan transaction 0x551d79…2c76, Oct 29, 2026 (transfer time 20:38:47 UTC).

USDT, 20:30:11 and 20:33:23 UTC. 500M USDT went to 0x9749…C762 and split into eight transfers within 30 minutes. 200M USDT went to 0x0Ddf…697e. At 20:47:47 about 10M USDT was swapped on Uniswap pools. At 20:52:59, 190M USDT went to the address labeled "Binance Hot Wallet Exploiter 3."
ARB on Arbitrum, 20:30:34 UTC. Binance 54 sent 74,559,805.2 ARB to 0x5227 in a plain transfer, with no delegation. At 21:36:30 UTC, 0x5227 sent all of it to 0x3E2b…32d5.

Source: Arbiscan, read 21:39 UTC, Oct 29, 2026.

Balances. At 21:33 UTC, DeBank showed $2.34B for 0x5227, including 975.07M USDT and 823M USDC. At 21:30 UTC, Etherscan listed $2.27B in tokens and 1,708.24 ETH for the same address.

Movements from 0x5227 are not all made by 0x5227. Check the sender of each transaction before you read it as the exploiter's action.

Freezes

USDC, 21:13:44 UTC. Whale Alert reported an address with 823,000,000 USDC frozen. The text names no address. The total matches the 823M USDC that Hot Wallet 34 sent to 0x5227. That match is ours.
Tether and Circle, 21:15:23 UTC. CZ thanked Tether (~$971m) and Circle (~$823m) for the freezes.
USDT, 21:31:37 UTC. Whale Alert reported 174,999,872 USDT frozen. The amount equals the 175M part of the 500M split from 0x9749…C762. That second match is ours.

Source: Whale Alert on X, post at 21:13:44 UTC, Oct 29, 2026.

Are Binance User Funds Safe? What Binance and CZ Said

At 21:15:23 UTC, CZ wrote:

User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.

Source: CZ on X, post at 21:15:23 UTC, Oct 29, 2026.

At 21:29:09 UTC, Binance wrote:

Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe.

At 21:38 UTC the post was edited. The new text adds: "we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams."

Source: Binance on X, post at 21:29:09 UTC, Oct 29, 2026 (screenshot taken after the 21:38 UTC edit).

Binance did not name a cause and gave no amount. CZ's post above uses the word "hack."

Did Binance Pause Withdrawals? What Binance Did Next

Withdrawals paused, 22:33 UTC. Binance wrote: "Our team is conducting security checks. Withdrawals will resume as soon as the security issue is fully resolved. User funds remain safe."

Cold-wallet transfers, from about 22:58 UTC. Binance 14 sends its tokens one per block to "Binance: Cold Wallet 20" (0xF977814e90dA44bFA03b6295A0616a897441aceC). USDT and WLFI transfers in that run revert. The destination is a Binance-labeled cold wallet. Who signs these transfers is not shown. Example: COVER transfer at 23:04:23 UTC.

Source: Etherscan, Binance 14 address page, read 23:04 UTC, Oct 29, 2026.

Source: Etherscan transaction 0x33b534…f1654, timestamp 23:04:23 UTC, Oct 29, 2026.

Delegation on, 23:04 UTC. Binance 14 shows "Delegated to 0x63e842B0...73e9c6fAe." Its ETH balance was 0.94 at 23:04 UTC, against 305.2 at 21:36 UTC. Its token holdings were over $919K.
USD1 froze $27M, 22:15:56 UTC. A post on X said USD1 "has taken proactive steps to freeze the $27 million in USD1 associated with the @binance hack." CZ replied "Thank you!" at 22:25:59 UTC.

Synthetix, 23:03:47 UTC. 8,405,741.58 SNX moved from 0x5227…2f8c to "Synthetix: protocolDAO" in a transaction sent by snax-governance.eth. The sender is on the issuer side. Transaction

What is not known

The signature. The delegation needs a signature from Binance 14's key. How that signature was produced, and by whom, is not known.
The contract. 0x63e842B0...73e9c6fAe is not verified on Etherscan. We do not know what its code does.
The 167,464.25 ETH transfer. The top of the Etherscan page shows "Error Occurred [execution reverted]" next to the To field, while the transaction status reads Success. On 2026-10-30 the Internal Txns tab listed the transfer without an error mark. We do not know why the page shows that note.
The total. No official figure exists. Media figures disagree: $2.5B (PANews), $2.77B (CryptoBriefing) and $2.8B (Coindoo). We did not check them.
Labels. An Etherscan label names an address. It does not say who controls the address.
Other chains. We did not check Avalanche, where DeBank shows $24M for the same address. We did not read Arkham, which sits behind Cloudflare.
Tron. Whale Alert reported 65,990,000 USDT frozen on Tron at 21:22:15 UTC. We did not check whether it links to this case.
Customer funds. Binance says user funds are safe. Onchain data does not show Binance's customer balances, so we cannot check that claim.

How Much Was Stolen From Binance? The $5.6B Claim

Watcher.Guru posted at 21:42:33 UTC: "Binance hacked with over $5.6 billion stolen." Its breakdown: $1.45B BTC, $875M ETH, $234M TRX, $50M XAUT, $1.57B USDT, $823M USDC, $75M WBETH, $88.5M RLUSD and $447.5M of other assets. The breakdown includes chains we did not check, such as BTC and Tron. Binance has not confirmed it.

Source: Watcher.Guru on X, post at 21:42:33 UTC, Oct 29, 2026.

Our figures are balances of one address on the chains Etherscan tracks, not a total. Etherscan showed $2.29B for 0x5227…2f8c at 22:26 UTC on October 29. Etherscan showed $2.21B (multichain portfolio) for the same address at 23:05 UTC. Neither figure is a total of stolen funds.

A post by 0xngmi, quoted in a CZ post at 22:23:14 UTC, estimated the loss at about $1B after the USDT and USDC freezes. The same post said Binance holds $144B in custody. CZ replied: "Loss might be a bit higher than that, but will cover."

Source: CZ on X, post at 22:23:14 UTC, Oct 29, 2026.

Binance has not published a total. Media figures disagree (see "What is not known"). Neither Binance nor CZ named a cause or a group in the posts we read (21:15 to 22:33 UTC). The sources we read name no country or group. Treat any attribution as unverified until an official source or a named investigator publishes evidence.

How to verify it yourself

These checks are free. You need a browser. On Etherscan, open the timestamp menu and select "+UTC." Write down the time you read each page. Balances and labels change.

The delegation. Open the EIP-7702 transaction. Read the "Transaction Action" line. Open the Authorizations tab to see the signed authorization.
The delegated wallet. Open Binance 14. Look for the "Delegated to" line. Check whether it shows the same address.
The sweep. Open the 167,464.25 ETH transaction. Compare the From and To labels. Open the Internal Txns tab and read the transfer line. Read the error note next to the To field.
The token flows. Open the token transfers of 0x5227. Sort by time and compare the token, the amount and the sender label of each row.
The initiator. Open the initiator address. Look for the Tornado.Cash deposits in its transaction list.
The contract. Open 0x63e842B0...73e9c6fAe. Check whether the Contract tab shows verified source code.
Arbitrum. Open the Arbiscan transaction. Check the 74,559,805.2 ARB transfers in and out of 0x5227.
The balance. Open the DeBank profile of 0x5227. Write down the value and the time you read it.
The rules. Read the EIP-7702 specification for the authorization format and the zero-address rule.

Compare every address letter by letter. The address 0x9749…C762 has look-alike variants. Fake tokens use look-alike letters from other alphabets. A label on a page is a label. It is not proof of who controls the address.

I post every update on this case in my Telegram channel: https://t.me/IliaAIToolsBot?start=devto-binance

Thread with live updates on X: https://x.com/GhostWaynee/status/2115923817721954336

AI Test Case Generator: Turn Requirements into TestRail-Ready Test Cases (Free Prompts)

ILIA KARPENKO — Sun, 25 Oct 2026 04:23:34 +0000

A new spec lands as a PDF on Monday. By Wednesday you have to hand over test cases in your team's TestRail format: their column names, their priority values, their ID scheme. You spend two days copying requirement text into rows, and the import fails anyway because one header reads Expected Result instead of Expected result.

So you paste the spec into ChatGPT or Claude and ask for test cases. You get rows of happy path, each with "Verify the feature works correctly" as the expected result, in columns nobody on your team uses.

Your prompt skipped the work a QA lead does before writing a single case. This guide gives you that work as five prompts you can paste into any AI chat today. No tool to install.

Step 1. Give the AI your format, not just the spec

Attach two files: the requirements, and a file with two or three test cases your team already wrote. The example teaches the AI more than any description of your format.

I'm attaching (1) the requirements for the Payments module and (2) three test
cases in my team's format.

Before anything else, describe the format of file 2: the exact column names in
order, the allowed values for Priority and Type, the ID scheme and the last ID
used, and the writing style of steps and expected results. Don't write any test
cases yet.

Check the answer. If it lists High / Medium / Low and your team uses Blocker / Critical / Major / Minor, correct it now. Every case inherits this.

Step 2. Ask for a plan and the gaps, not the cases

This step decides what gets tested at all.

Read the requirements for the refund flow. Don't write test cases yet.

Give me:
1. A coverage plan: the areas you'll cover, the test design technique for each,
   and an estimated number of cases.
2. A list of gaps in the spec, each with the section number and one concrete
   question for the analyst. Look for: requirements with no measurable outcome,
   sections that contradict each other or a worked example, error paths that are
   never described, terms used as conditions but never defined, and external
   services whose failure is not specified.

End by asking me to approve or change the plan.

A spec that says "refunds should be processed quickly" has no testable outcome. A limit of $50,000 in one section and a worked example of a successful $75,000 refund in another is a contradiction someone has to resolve before you can write the boundary cases. "Silent on the error path" is the most common gap: the success flow fills a page, and nobody wrote what happens when the payment provider times out.

Approve the plan, or cut it down. Then move on.

Step 3. Make the AI use real test design techniques

Without explicit techniques, generated suites drift to whatever the spec mentions first: ten variations of the happy path. Name the techniques in the prompt:

Plan approved. Write the test cases using:

- Equivalence partitioning: one case per group of inputs that behave the same.
- Boundary values on both sides of every edge. For a limit of 50,000 that means
  49,999, 50,000 and 50,001, not just the rejected value.
- A decision table wherever an outcome depends on several conditions: one case
  where all conditions pass, plus one case per condition failing on its own.
- State transitions: the allowed ones, and a case proving each forbidden one is
  rejected.
- Error guessing: empty and max-length input, double submit, session expiry
  mid-flow, network failure between request and response.

Use exactly the columns, values and ID scheme from step 1, continuing from the
last ID.

The "both sides of every edge" line matters. A suite with 50,000 and 50,001 but no 49,999 proves the limit rejects. It never proves the system accepts everything up to the limit, so an off-by-one that moved the limit down would pass.

Step 4. Review the cases against a quality bar

Ask the AI to grade its own output before you read it:

Review every case against these rules and fix the ones that fail:

1. Atomic: one behaviour per case. If the title needs "and", split it.
2. Independent: it sets up its own preconditions.
3. One deterministic expected result with values, e.g. "Balance decreases by
   $500 and the history shows a refund with status Completed". No "works
   correctly", no "either X or Y".
4. Concrete data in the steps: "Amount: 50,001", not "an amount over the limit".
5. Steps are actions; checks go in the expected result.
6. No two cases test the same partition.
7. Every requirement in scope has at least one case. List any that have none.

Rule 3 protects the tester who runs the case. A case whose expected result reads "the operation ends in created or pending" can't be marked pass or fail. A real fork in behaviour means two cases. An undecided spec is a gap for the list.

Step 5. Export a file TestRail can import

Ask for a CSV with your exact headers:

Export all cases as CSV. Use the headers from step 1, exactly as spelled, in the
same order. One row per case. Put each step on its own line inside the cell, not
as "<br>" or "\n" text. Quote every field.

Two things break imports: a header that differs by one character from your field mapping, and multi-line steps that arrive as literal <br> tags. Open the file in a spreadsheet and check both before you import it into TestRail, Qase, Zephyr or Xray.

Where the prompts start to hurt

The five prompts work. After a few sprints, these four things get old:

You re-describe your format every new chat, and the model forgets a column halfway through a long suite.
It writes cases before you approve the plan unless you stop it every time.
The gap list depends on how carefully you phrased step 2 that day.
The CSV still needs a manual pass for headers and line breaks.

That's why I packaged the workflow as Casely, a free, open-source skill for Claude Code, claude.ai, Cowork, the Claude desktop app and Codex. You attach the spec (or name a Jira issue or a Confluence page) and one example file, and say what you need:

"Here are the requirements for the Payments module and two example test cases my team writes. Give me test cases for the refund flow."

Casely runs the five steps above in one conversation and stops once, at the plan, for your OK. It copies your columns, priority values and ID scheme from the example file. It writes the cases with the techniques from step 3, then exports one .xlsx with your headers that TestRail imports in one pass, plus one Markdown file per case, or a UTF-8 CSV if your tracker wants one. Say yes once and it saves your team's style, so the next run needs no example file. When the spec describes an API, it also builds a Postman collection with every base URL, token and ID pulled out into variables, and no credentials in the file. When the spec names no endpoints, it asks for the API docs instead of inventing paths. In Claude Code, /casely:run then walks the UI cases in a browser, and /casely:bug turns a failure or a trace ID into a bug report in your team's format.

How do you know it finds the gaps?

The repo ships a benchmark: a fintech wallet spec with five planted defects (a vague "processed quickly", a $50,000 limit that contradicts a successful $75,000 example, a fee that is withheld but never sized, an undefined "verified status", and no behaviour for a payment provider outage), plus boundary rules, a state machine and a five-condition decision table. A 100-point rubric scores the run.

The first full run scored 85/100. It produced 33 cases continuing the team's ID scheme, matched all nine columns in order, and exported one workbook with no rejected case. It missed two of the five planted gaps. The rules that catch those two are now part of the skill. The spec, the example file and the rubric are in benchmark/, so you can score a run yourself.

Pick Opus for the plan phase if you can. Smaller models write acceptable cases from a plan they're handed, and miss the holes in the spec.

FAQ

Is there a free AI test case generator?
The prompts in this article are free with any AI chat. Casely is free and open-source under the MIT license; you pay only for the Claude or Codex plan you already use.

Can I import AI-generated test cases into TestRail?
Yes. Match the headers to your TestRail field mapping exactly and keep multi-line steps as real line breaks. Casely exports a file that already does both.

Does it work with requirements in other languages?
Casely writes the cases in the language of your example cases. A round-trip test checks that Arabic and Korean text, commas, quotes and line breaks survive the XLSX and CSV export cell for cell. A reader suggested the Korean case in the comments below.

What about scanned PDFs?
Text-based PDFs, DOCX and XLSX work well. An image-only scan may not extract cleanly, so export a text version when you can.

Add Casely to claude.ai, Cowork or the desktop app in one click from the Claude plugin directory. In Claude Code, paste this prompt:

Install the Casely plugin from https://github.com/JohnWayneeee/casely-qa-skill

Codex and manual setup are in the README.

More on how Casely came about: Your QA team was hired to find bugs. It spends two days a sprint formatting spreadsheets and Stop manually writing test cases.

If it saved you a day of formatting test cases, a ⭐ on the repo helps other QA engineers find it, and a coffee pays for the next release.

How to Remove Ads from Google TV (and Make It Faster): a Free ADB Guide

ILIA KARPENKO — Sun, 25 Oct 2026 04:09:55 +0000

No root. Every step can be undone. The full command list, the two traps that turn a TV into a black screen, and how to stop the TV from watching what you watch.

You turn the TV on to watch one thing. First you get a row of ads and "recommended for you". The menu lags a second behind the remote. Apps open slowly. You search for a fix and find forum threads with a list of adb commands, no explanation, and no way back if one of them kills your Wi-Fi.

This guide shows how to remove ads from the Google TV home screen, free memory and switch off screen tracking using ADB, step by step, with the undo command for each change. You need a computer and the TV on the same network.

Why your TV shows ads and slows down

Out of the box an Android TV or Google TV set runs a dozen vendor services in the background: telemetry, content stores, recommendation rows, a second cast receiver, a demo mode. The home screen itself is an ad surface. All of it shares 1–3 GB of RAM with the apps you open.

The picture and sound get the same treatment. Motion smoothing, noise reduction and "enhancers" are on by default. On one CHiQ set I tuned, the stock equaliser boosted 5 kHz by +41.

There is also a part you don't see. Most smart TVs run ACR, automatic content recognition. The TV samples what is on screen several times a second, films from an HDMI box or a console included, matches it against a database and sends the result for ad targeting. A 2024 UC Davis / UCL study measured Samsung sampling every 500 ms and LG every 10 ms. On Android TV and Google TV it is usually Samba TV (Sony, TCL, Philips and others) or the vendor's own service. Vendor apps can also hold the microphone and the camera.

That is a large part of why TVs keep getting cheaper: the money is in the viewing data. In December 2025 Texas sued Samsung, Sony, LG, Hisense and TCL over ACR. Step 6 switches it off and checks that it is really off.

The quick fix, and why it isn't enough

Google TV has an Apps-only mode (Settings → Accounts & Sign In → your account → Apps only mode). It hides most recommendations. The stock home screen stays, the vendor services keep running, and the lag stays with them.

An ad-blocking DNS (Settings → Network → Private DNS, for example dns.adguard-dns.com) blocks some ad requests on Android 9 and newer. It does not block YouTube ads.

To fix the cause you have to switch off the services themselves. That takes ADB.

Step 1. Turn on developer options and debugging

Open Settings → System → About (on older Android TV: Settings → Device Preferences → About).
Press OK on Build (or Android TV OS build) seven times. You'll see "You are now a developer".
Go back to Developer options. Turn on USB debugging, and Network debugging if it is listed.

On a computer, install Android SDK platform-tools, which contain adb.

Step 2. Connect over the network

Find the TV's IP address in Settings → Network. Then:

adb connect 192.168.1.50:5555

A prompt "Allow USB debugging?" appears on the TV. Tick Always allow from this computer and press OK. Without the tick, the prompt comes back every time you reconnect.

If the connection is refused, your TV may only offer Wireless debugging (common on Google TV 12+). Open it, choose Pair device with pairing code, then on the computer:

adb pair 192.168.1.50:<pairing-port>     # enter the code shown on the TV
adb connect 192.168.1.50:<port-shown-on-tv>
adb tcpip 5555

If nothing answers at all, not even your router, a VPN on the computer is capturing the local network. Exclude your home subnet from the tunnel.

Step 3. Save what you have before changing anything

adb shell pm list packages -s > packages-system.txt
adb shell pm list packages -3 > packages-3rdparty.txt
adb shell pm list packages -d > disabled-before.txt
adb shell "grep -E 'MemTotal|MemAvailable' /proc/meminfo"

Write down MemAvailable. You'll compare it at the end.

Now the first trap. Check which app owns your saved Wi-Fi network:

adb shell "dumpsys wifi | grep -o 'cname=[^ ]*'"

When you disable the app that saved a network, Android deletes that network. The TV drops off Wi-Fi, and your ADB session drops with it. Never disable the package this command names. On Google TV it is often the setup wizard, and that matters in step 7.

Step 4. Decide what to disable

Open packages-system.txt and sort the vendor packages into groups:

vendor telemetry and analytics;
vendor stores, recommendation rows and content providers;
background services you don't use: a second cast receiver, cleaners, demo modes, print;
preinstalled apps you never open.

When a package name says nothing, read it without starting it:

adb shell "dumpsys package <package> | grep -E 'versionName|sharedUser|permission\.'"

BIND_TV_INPUT means an input or remote service: keep it. Firebase or c2dm together with a boot receiver usually means push and telemetry.

Never disable these. Each one can stop the TV from booting, showing a picture or taking input:

Android core: android, com.android.systemui, com.android.shell, com.android.settings, com.android.tv.settings, the permission controller, the package installer, and com.android.providers.*.
What the TV needs to work: the TV app and HDMI/tuner input services, the input menu, com.android.bluetooth and the remote pairing service, the on-screen keyboard, Play Store, Play Services, the Android TV Remote service.
Any package with factory, fac or AT in its name. Don't disable them, and don't even open them. On some Haier and CVTE boards, opening one flips a factory flag: the Input key and HDMI-CEC stop working, and the next boot disables Play Services.
The Wi-Fi owner from step 3.

An original Mi TV Stick never booted again after a debloat list took six of the core packages. Check each package yourself instead of trusting a list.

Step 5. Disable in small batches

Disable, don't uninstall. disable-user is reversible. uninstall on a system package is much harder to undo.

adb shell pm disable-user --user 0 <package>

Do four or five packages at a time. After each batch, press Home on the TV and check that the picture, the remote and the network still work. If something breaks, you know which batch did it.

Check the result by listing, not by the exit code:

adb shell pm list packages -d

Some firmware (Fire OS and a few others) prints success and changes nothing, or refuses with SecurityException. If every package is refused, your TV doesn't allow this. Use the TV's own privacy toggles (step 6) and the DNS from above instead.

Undo one package:

adb shell pm enable <package>

Step 6. Stop the TV from watching you

Do this even if you only came for the clean home screen. It takes ten minutes.

Switch it off in the menu. Paths differ by model and year, so look around Settings:

Sony, Philips, TCL and other Android TV sets: Samba Interactive TV, Interactive TV or Viewing information → off. It sits under Settings → Privacy, Device Preferences or Initial setup.
Google TV and Android TV 12+: Settings → Privacy → Usage & Diagnostics → off. Settings → Privacy → Ads → Delete advertising ID (older builds: Opt out of Ads Personalization).
The vendor's own privacy screen: anything called viewing information, content recognition, user experience programme or personalised recommendations → off.
If you never talk to the TV, switch off "Hey Google" / hands-free voice. Some sets have a physical mic switch on the edge.

A switch is a promise, not proof. Check for yourself.

Find the tracking packages:

adb shell pm list packages | grep -iE "samba|acr|alphonso|inscape|gracenote|nielsen|interactive|viewing|ads|analytic|telemetry|bigdata"

This is a lead, not a verdict: ads also matches harmless names. Read each one with the dumpsys command from step 4, then disable the ones you are sure about the same way as in step 5, and play one video after it.

See who holds the microphone and the camera:

adb shell dumpsys package packages | grep -E "Package \[|RECORD_AUDIO: granted=true|CAMERA: granted=true" | grep -B1 "granted=true"
adb shell pm list features | grep -iE "microphone|camera"

The first command lists apps that may use the mic or the camera. The second shows whether the TV has them at all. Block both for every app you don't use them with. Keep the mic for the voice assistant if you press the mic button on the remote:

adb shell cmd appops set <package> RECORD_AUDIO ignore
adb shell cmd appops set <package> CAMERA ignore
adb shell cmd appops get <package> RECORD_AUDIO     # check: ignore

Undo:

adb shell cmd appops set <package> RECORD_AUDIO default
adb shell cmd appops set <package> CAMERA default

This survives a reboot. If the TV has a pop-up or clip-on camera, push it down or cover it too: software can't prove a camera is off, a shutter can.

The ad-blocking Private DNS from the start of this guide also cuts many tracking hosts that no package list catches.

Step 7. Replace the ad-filled home screen

Install a launcher first. Any Android TV launcher works for this step. Then try to make it the Home app:

adb shell cmd package set-home-activity <launcher.package>/<.MainActivity>

On most Google TV sets this prints Success and changes nothing. The stock launcher, com.google.android.apps.tv.launcherx, has Home priority 2. The setup wizard's RecoveryActivity has priority 1. A third-party launcher is capped at priority 0. The system picks the highest priority, whatever you set as preferred.

So you have to disable the stock launcher, and that hides the second trap. If you disable only launcherx, the setup wizard's RecoveryActivity takes over Home, tries to re-enable launcherx, fails, and loops on a black screen. You have to disable the wizard too, com.google.android.tungsten.setupwraith. The wizard often owns the Wi-Fi network from first setup. Do it in this order:

Run the Wi-Fi check from step 3. If it names setupwraith, go to Settings → Network, forget your network and join it again. The TV may get a new IP: reconnect ADB.
Run the check again. The owner should now be com.android.tv.settings or a system uid.
Disable both:

adb shell pm disable-user --user 0 com.google.android.tungsten.setupwraith
adb shell pm disable-user --user 0 com.google.android.apps.tv.launcherx

Press Home and check who holds the screen:

adb shell "dumpsys activity activities | grep mFocusedApp"

If you see a black screen at any point:

adb shell pm enable com.google.android.apps.tv.launcherx

Then press Home.

One cost to know about: on Google TV the stock launcher also handles the gear (dashboard) button on the remote. After the swap that button stops working, and no third-party app can take it over. The Input button keeps working.

Step 8. Make it faster

Halve the animations so menus respond quicker:

adb shell settings put global window_animation_scale 0.5
adb shell settings put global transition_animation_scale 0.5
adb shell settings put global animator_duration_scale 0.5

Stop background Wi-Fi and Bluetooth scanning, which a TV doesn't need:

adb shell settings put global wifi_scan_always_enabled 0
adb shell settings put global ble_scan_always_enabled 0

On Android 11 and newer, freeze cached apps so they use no CPU in the background (reboot to apply):

adb shell settings put global cached_apps_freezer enabled

Before you change a setting, read its old value with settings get global <key> and write it down. That is your undo.

Now measure MemAvailable again and compare it with step 3.

Step 9. Turn off the picture "enhancers"

Open the picture menu (on Google TV: Settings → Display & Sound → Picture) and switch off motion smoothing, noise reduction and dynamic contrast. Pick a Movie or Cinema mode with a warm colour temperature. Picture settings are usually per input, so repeat this for each HDMI port you use.

Step 10. Close the door behind you

Network debugging on port 5555 is plaintext and gives a shell to any authorised computer on your network. When you're done:

In Developer options, switch off USB debugging and network debugging.
Tap Revoke USB debugging authorisations.
Reboot the TV.

Why I stopped doing this by hand

I've done the steps above on several TVs. Five things kept slowing me down:

Vendor package names say nothing. Every brand calls its telemetry something different, and you have to read each one.
The Wi-Fi owner trap and the setup wizard loop give no warning. You learn about them from a black screen.
Factory packages differ by board, and one wrong tap can break the Input key for good.
The tracking switches are buried in different menus on every brand, and nothing tells you whether they actually worked.
To undo everything you need a log of every package and every setting you changed, with the old values.

So I wrote CleanTV, a free, open-source skill for Claude Code. You turn on debugging and say "Set up my TV". It does the steps in this article on your real TV:

You turn on debugging, say "Set up my TV" and answer 10–15 questions about how you use the TV.
Claude finds the TV on your network, picks the packages, runs every adb command, and checks each step with a screenshot from the TV.

It backs up the TV before the first change. It refuses core, factory and Wi-Fi owner packages. It finds the ACR and ad packages, walks you through the tracking switches with a screenshot check, and takes the microphone and the camera away from vendor apps. It disables the stock launcher and the wizard in the right order. It installs its own launcher: a pitch-black home screen with a dock of your apps, a clock and an HDMI inputs menu. It calibrates picture and sound for your room, and at the end it closes network debugging and checks that the port is shut. One command, restore.py, undoes all of it.

Measured on two TVs:

CHiQ, 2.8 GB RAM: free memory went from 1.42 GB to 1.77 GB.
Harper, 1.8 GB RAM: free memory went from 721 MB to 888 MB.
Home screen: ads and recommendations replaced by your apps on black.
Screen tracking: ACR off, microphone and camera locked for vendor apps.

It works on Android TV and Google TV: Xiaomi, TCL, Hisense, Sony, Philips, CHiQ/Changhong, Haier, Harper, Nvidia Shield and others. It doesn't work on Samsung Tizen, LG webOS or Fire TV.

If YouTube is throttled where you live

In some countries, Russia among them, the ISP slows YouTube down with deep packet inspection. Videos stall while everything else works.

CleanTV can install ByeByeDPI, an open-source app, on the TV itself. It runs locally as a VPN: no external server, no account. Only YouTube's traffic goes through it, every other app keeps the direct route. The CleanTV launcher starts the bypass when you open YouTube and stops it when you return Home.

To set it up by hand: install the APK for your TV's CPU (adb shell getprop ro.product.cpu.abi), set the DNS to Google (8.8.8.8), turn on the app whitelist with only com.google.android.youtube.tv, and run the built-in strategy test. The test takes 10–15 minutes; don't touch the remote while it runs.

FAQ

Can you remove ads from Google TV without root?
Yes. Everything in this guide works over ADB debugging, which you turn on in Developer options. No root, no unlocked bootloader.

Is it safe?
Disabling is reversible: pm enable <package> brings a package back. The risk is in what you disable. Stick to the never-disable list in step 4, work in small batches, and check the Wi-Fi owner first.

Will it remove YouTube ads?
No. This removes ads from the home screen and switches off vendor services. YouTube serves its own ads, and neither a launcher nor DNS can remove them.

Does my TV really watch what I watch?
If ACR is on, yes. It recognises the picture, also from HDMI, and reports it for ads. Step 6 switches it off, disables the tracking packages and locks the mic and camera.

I have a Samsung or LG. Can I at least turn the tracking off?
ADB won't help on Tizen or webOS, but the switches are in the menu. Samsung: Settings → Support → Terms & Privacy → Viewing Information Services off, and Interest-Based Advertisement off. LG: Settings → General → System → Additional Settings → Live Plus off, and in User Agreements untick Viewing Information and Interest-Based Recommendation. Paths change by model year.

Does it work on Fire TV?
No. Fire OS refuses pm disable-user, and Fire TV doesn't use the Google TV launcher.

Will a system update undo it?
Some firmware re-enables its own packages on every boot (TCL on Android 9 does this). After a reboot, compare pm list packages -d with your list.

If you'd rather not spend the evening on it, CleanTV is on GitHub. Install it in Claude Code and say "Set up my TV".

If it saved you that evening, a ⭐ on the repo helps other owners find it, and a coffee pays for the next module: remote buttons and Bluetooth remotes.