Knowledge Graph Feeds
The Binance hack, October 2026
On 29 October 2026 an attacker emptied Binance's hot wallets on ten blockchains in about four hours. Binance puts the impact at around $6.3 billion; three blockchain analytics firms count $6.36 billion to $6.43 billion, the largest crypto theft on record at the value when taken. About $3 billion has been frozen. Binance says it will cover every loss. The analytics firms blame North Korea's TraderTraitor group; Binance and the US government have not confirmed who did it.
What happened
- 2026-10-29 15:59 UTC: The attacker deploys the contract it will use, four hours ahead
- 2026-10-29 20:05 UTC: First theft: 233 million XRP
- 2026-10-29 20:10 UTC: Solana and Optimism wallets follow
- 2026-10-29 20:20 UTC: 18,270 bitcoin leave in one transfer; 50 pre-signed authorizations hit Ethereum
- 2026-10-29 20:24 UTC: $2.53 billion leaves Ethereum in a single transaction
- 2026-10-29 21:15 UTC: Binance's co-founder: "It does look like a hack"
- 2026-10-29 21:29 UTC: Binance's first statement
- 2026-10-29 23:05 UTC: Second wave: Avalanche and Polygon
- 2026-10-29 23:35 UTC: Frozen total passes $2.5 billion
- 2026-10-29 23:56 UTC: Last sweep of new deposits
- 2026-10-30 02:23 UTC: Binance puts the impact at around $6.3 billion
- 2026-10-30 04:51 UTC: Stolen funds meet funds from the Bitget hack
- 2026-10-30 07:37 UTC: CEO Richard Teng: "your money is safe"
- 2026-10-30 08:47 UTC: Binance finds "additional points of breach"; withdrawals in 45 hours
Theories and claims
- North Korea did it: unconfirmed. Three analytics firms say so, TRM with high confidence. No government has said so yet.
- The biggest crypto hack ever: true. True at the value when taken, about four times Bybit. Older Bitcoin thefts are bigger at today's prices.
- It was done in 20 minutes: true. The main transfers ran from 20:05 to 20:24 UTC; smaller sweeps went on until 23:56.
- $6.3 billion is gone: misleading. $6.3 billion was taken, but about $3 billion is frozen and Binance says it covers every customer loss.
- Binance halted trading: false. Binance paused withdrawals only; deposits kept working. Its statements never mention halting trading.
- One engineer's laptop let the hacker in: misleading. Binance first pointed to a laptop, then said it found additional points of breach; its CEO said it was not a one-click attack.
- Cold wallets were hacked: false. The thefts came from hot wallets, the ones kept online to pay withdrawals.
- Binance confirmed North Korea did it: false. Binance's CEO said its investigation has not attributed responsibility to anyone.
- Customers lost their money: unconfirmed. Binance says it covers every loss from its emergency fund and company money; its Proof of Reserves will show whether it can.
- Binance's private keys were stolen: unconfirmed. Binance says it found no evidence of a key leak; the analytics firms say the attacker got Binance's own signing to approve the transfers.
