Event fileUpdated
The Binance hack, October 2026
Filed underTechnology › Cybersecurity › Hacks & Breaches › Crypto Exchange HacksCrypto TheftWithdrawals & Customer FundsState-Sponsored HackingPrivate Key & Wallet CompromiseAsset Freezes & RecoveryStablecoin FreezesBitcoinViral Claims
On 29 October 2026 an attacker emptied Binance's hot wallets on ten blockchains in about four hours. Binance puts the impact at around $6.3 billion; three blockchain analytics firms count $6.36 billion to $6.43 billion, the largest crypto theft on record at the value when taken. About $3 billion has been frozen. Binance says it will cover every loss. The analytics firms blame North Korea's TraderTraitor group; Binance and the US government have not confirmed who did it.
What to do: rely only on Binance's official channels for updates, and check a claim's verdict below before you share it.
Read 358 items: Binance 1 · X 56 · News 153 · Investigators and agencies 5 · Reddit 38 · YouTube 25 · TikTok 30 · Instagram 25 · Hacker News 25
Knowledge Graph FeedsSwipe through this story: what happened, the impact, the theories, every sourceOpen the feed →What Happened
The attacker deploys the contract it will use, four hours ahead
At 15:59 UTC on 29 October, the attacker deployed the "sweeper" contract used in the attack, which was rehearsed on another wallet around four hours before it was used against Binance.
EllipticFirst theft: 233 million XRP
Between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP to a single attacker address, leaving each wallet with only its minimum balance.
TRM LabsSolana and Optimism wallets follow
Binance wallets on Solana and Optimism followed shortly after 20:10 UTC.
TRM Labs18,270 bitcoin leave in one transfer; 50 pre-signed authorizations hit Ethereum
At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address, which began splitting the funds into round 1,000 BTC and 100 BTC pieces inside the same block.
TRM Labs$2.53 billion leaves Ethereum in a single transaction
Two-thirds of the Ethereum losses, $2.53 billion, left in a single transaction at 20:24 UTC.
EllipticBinance's co-founder: "It does look like a hack"
It does look like a hack on Binance.
CZ 🔶 BNBBinance's first statement
Our teams are aware of reports of a potential security issue and are actively investigating.
BinanceSecond wave: Avalanche and Polygon
About two and a half hours later, at 23:05 UTC, Binance wallets on Avalanche and Polygon followed.
TRM LabsFrozen total passes $2.5 billion
Binance said at 23:35 UTC that the verified total frozen had reached USD 2.54 billion.
TRM LabsLast sweep of new deposits
As new funds reached the Binance hot wallet, the operator swept them again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.
TRM LabsBinance puts the impact at around $6.3 billion
The estimated total impact sits at around $6.3B.
BinanceStolen funds meet funds from the Bitget hack
This indicates the same actor is likely behind both incidents.
ZachXBTCEO Richard Teng: "your money is safe"
Bottom line - your money is safe, and we're covering every loss.
Richard TengBinance finds "additional points of breach"; withdrawals in 45 hours
We are still on track towards the expected timeline to resume the withdrawal service in 45 hours.
Binance
The Impact
around $6.3B
Exact words in the source (1)
The estimated total impact sits at around $6.3B.
Binance · 30 Oct 2026
$6.36B to $6.43B
Valued at each asset's price at the moment it was taken.
Exact words in the source (3)
Valuing each transfer at the price of the asset at the moment it was taken, the total is approximately USD 6.36 billion.
TRM Labs · 30 Oct 2026On 29 October 2026, $6.43 billion in cryptoassets were stolen from Binance, the world's largest cryptoasset exchange, according to Elliptic's analysis.
Elliptic · 30 Oct 2026Across the affected blockchains, the unauthorized transfers totaled approximately $6.4 billion USD.
Chainalysis · 30 Oct 2026
about $2.8B to $3B
Exact words in the source (2)
about $2.4B to $3.3B
TRM values it at the time of theft; Elliptic at current prices.
Exact words in the source (2)
Binance says it covers every loss; checkable when its Proof of Reserves is out
Withdrawals paused; deposits working
Exact words in the source (1)
We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected.
Binance · 30 Oct 2026
Yes, at the value when taken: about 4x Bybit
Valued at today's prices, older Bitcoin thefts such as LuBian (2020) are larger.
Exact words in the source (2)
That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025.
TRM Labs · 30 Oct 2026Based on analysis of on-chain data, it appears that 127,426 BTC was stolen from LuBian in December 2020, worth $3.5 billion at the time and now worth approximately $14.5 billion.
Arkham · 15 Aug 2025
Bitcoin to a six-week low of $76,368
Exact words in the source (1)
Bitcoin hit a six-week low of $76,368 and ether fell more than 3% to a two-month low of $2,178 before markets stabilised.
finance.yahoo.com · 30 Oct 2026
Where the money went
- Ethereum$3.79B
- Bitcoin$1.47B
- Tron$628M
- XRP Ledger$296M
- Solana$96M
- Arbitrum, Optimism, Base$39M
- Avalanche$28M
- Polygon$10M
Total $6.36B by chain · TRM Labs
Frozen: $2.70B by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council.
The Details
A compromised engineer's laptop, then "additional points of breach"
No technical post-mortem yet.
Exact words in the source (3)
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.
Binance · 30 Oct 2026Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
Binance · 30 Oct 2026On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 pre-signed authorizations prepared in advance.
TRM Labs · 30 Oct 2026
No evidence of a key leak, says Binance
Exact words in the source (1)
We have found no evidence of any wallet private key leak.
Binance · 30 Oct 2026
North Korea's TraderTraitor, say the analytics firms; not confirmed by Binance or any government
Exact words in the source (4)
We make this judgment with high confidence.
TRM Labs · 30 Oct 2026Chainalysis attributes the hack to TraderTraitor, a North Korean cybercrime group.
Chainalysis · 30 Oct 2026Our investigation has not attributed responsibility to any individual.
Richard Teng · 30 Oct 2026The FBI is aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts and coordinate appropriate investigative steps
Nextgov/FCW · 30 Oct 2026
Abu Dhabi's regulator is "monitoring"; the FBI is "aware"
Exact words in the source (1)
Abu Dhabi's Financial Services Regulatory Authority, which issued Binance's main operating licence, said it was "engaging closely with Binance and monitoring the incident".
finance.yahoo.com · 30 Oct 2026
People in This Story
Binance
The exchange that was hit
Richard Teng
Binance CEO
Changpeng Zhao (CZ)
Binance co-founder and shareholder
Yi He
Binance co-founder
TraderTraitor
North Korean group the analytics firms blame
TRM Labs, Chainalysis, Elliptic
Blockchain analytics firms tracing the funds
ZachXBT
Independent on-chain investigator
Tether, Circle
Stablecoin issuers that froze stolen funds
FBI, US Secret Service
US agencies involved in the response
Abu Dhabi FSRA
Binance's main licensing regulator
Primary Documents
How It All Connects
Knowledge graph · 55 nodes · 103 links
Read the graph as text (49 relationships)
- News carries North Korea did it (52)
- YouTube carries North Korea did it (4)
- TikTok carries North Korea did it (5)
- Instagram carries North Korea did it (4)
- Reddit carries North Korea did it (7)
- Hacker News carries North Korea did it (5)
- News carries The biggest crypto hack ever (26)
- YouTube carries The biggest crypto hack ever (6)
- TikTok carries The biggest crypto hack ever (5)
- Instagram carries The biggest crypto hack ever (5)
- Reddit carries The biggest crypto hack ever (12)
- Hacker News carries The biggest crypto hack ever (3)
- News carries It was done in 20 minutes (12)
- YouTube carries It was done in 20 minutes (4)
- TikTok carries It was done in 20 minutes
- Instagram carries It was done in 20 minutes
- Reddit carries It was done in 20 minutes
- Hacker News carries It was done in 20 minutes
- News carries Binance halted trading (2)
- News carries One engineer's laptop let the hacker in
- Hacker News carries One engineer's laptop let the hacker in
- News carries $6.3 billion is gone (2)
- YouTube carries $6.3 billion is gone (3)
- Reddit carries $6.3 billion is gone
- Hacker News carries $6.3 billion is gone
- YouTube carries Cold wallets were hacked
- Binance is the source for Binance's own estimate
- TRM Labs, Chainalysis, Elliptic is the source for Counted on-chain
- Binance is the source for Frozen so far
- TRM Labs, Chainalysis, Elliptic is the source for Frozen so far
- TRM Labs, Chainalysis, Elliptic is the source for Still with the attacker, beyond any freeze
- Binance is the source for How it happened
- TRM Labs, Chainalysis, Elliptic is the source for How it happened
- Binance is the source for Private keys
- TRM Labs, Chainalysis, Elliptic is the source for Who did it
- Richard Teng is the source for Who did it
- Binance is the source for Customers' money
- TRM Labs, Chainalysis, Elliptic is the source for Customers' money
- Binance is the source for Withdrawals and deposits
- TRM Labs, Chainalysis, Elliptic is the source for Is it the biggest ever?
- TRM Labs, Chainalysis, Elliptic is the evidence for the verdict on North Korea did it
- TRM Labs, Chainalysis, Elliptic is the evidence for the verdict on The biggest crypto hack ever
- TRM Labs, Chainalysis, Elliptic is the evidence for the verdict on It was done in 20 minutes
- Binance is the evidence for the verdict on $6.3 billion is gone
- Binance is the evidence for the verdict on Binance halted trading
- Binance is the evidence for the verdict on One engineer's laptop let the hacker in
- Richard Teng is the evidence for the verdict on Binance confirmed North Korea did it
- Binance is the evidence for the verdict on Customers lost their money
- Binance is the evidence for the verdict on Binance's private keys were stolen
Theories and Claims: What Is True?
- Unconfirmed
“North Korea did it”
Three analytics firms say so, TRM with high confidence. No government has said so yet.
Found in 93 items: News 68, Reddit 7, YouTube 4, TikTok 5, Instagram 4, Hacker News 5
What people said, and the source
YouTubeInstead, it might have everything to do with the North Koreans and a laptop.
RedditNorth Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History.
Instagram · evolving.aiSecurity firms TRM Labs and Chainalysis have linked the attack to North Korea's TraderTraitor hacking group, also blamed for the $1.5 billion Bybit hack in 2025.
We make this judgment with high confidence.
TRM Labs · 30 Oct 2026
- True
“The biggest crypto hack ever”
True at the value when taken, about four times Bybit. Older Bitcoin thefts are bigger at today's prices.
Found in 62 items: News 31, Reddit 12, YouTube 6, TikTok 5, Instagram 5, Hacker News 3
What people said, and the source
YouTubeThe the largest cryptocurrency heist ever.
RedditNorth Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History.
YouTubeCrypto Rocked by Biggest Heist on Record.
That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025.
TRM Labs · 30 Oct 2026
- True
“It was done in 20 minutes”
The main transfers ran from 20:05 to 20:24 UTC; smaller sweeps went on until 23:56.
Found in 20 items: News 12, Reddit 1, YouTube 4, TikTok 1, Instagram 1, Hacker News 1
What people said, and the source
RedditThe $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes.
Instagram · evolving.aiBinance, the world's largest cryptocurrency exchange, has suffered the biggest crypto hack in history, with an estimated $6.3 billion stolen in roughly 20 minutes.
Two-thirds of the Ethereum losses, $2.53 billion, left in a single transaction at 20:24 UTC.
Elliptic · 30 Oct 2026
- Misleading
“$6.3 billion is gone”
$6.3 billion was taken, but about $3 billion is frozen and Binance says it covers every customer loss.
Found in 7 items: News 2, Reddit 1, YouTube 3, Hacker News 1
What people said, and the source
RedditBINANCE HACKED - $5.6B gone.
Hacker NewsBinance lost $6.3B without leaking a single private key.
NewsBinance Lost Over $6 Billion in Crypto Hack.
We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far.
Binance · 30 Oct 2026
- False
“Binance halted trading”
Binance paused withdrawals only; deposits kept working. Its statements never mention halting trading.
Found in 3 items: News 3
What people said, and the source
News · dw.comCryptocurrency exchange Binance suspends trading after suspected hack linked to North Korea.
We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected.
Binance · 30 Oct 2026
- Misleading
“One engineer's laptop let the hacker in”
Binance first pointed to a laptop, then said it found additional points of breach; its CEO said it was not a one-click attack.
Found in 2 items: News 1, Hacker News 1
What people said, and the source
Hacker NewsHackers stole $6.3B from Binance, likely NK and compromised dev's laptop.
Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
Binance · 30 Oct 2026
- False
“Cold wallets were hacked”
The thefts came from hot wallets, the ones kept online to pay withdrawals.
Found in 1 items: YouTube 1
What people said, and the source
YouTubeOkay, even cold wallets have been hacked.
The attackers targeted hot wallets, which exchanges keep connected to the internet to process withdrawals.
Cointelegraph · 30 Oct 2026
- False
“Binance confirmed North Korea did it”
Binance's CEO said its investigation has not attributed responsibility to anyone.
Not found in what we read
What people said, and the source
Our investigation has not attributed responsibility to any individual.
Richard Teng · 30 Oct 2026
- Unconfirmed
“Customers lost their money”
Binance says it covers every loss from its emergency fund and company money; its Proof of Reserves will show whether it can.
Not found in what we read
What people said, and the source
Binance will cover all losses from the SAFU fund and the company’s funds.
Binance · 30 Oct 2026
- Unconfirmed
“Binance's private keys were stolen”
Binance says it found no evidence of a key leak; the analytics firms say the attacker got Binance's own signing to approve the transfers.
Not found in what we read
What people said, and the source
We have found no evidence of any wallet private key leak.
Binance · 30 Oct 2026
What Happens Next
Withdrawals reopenexpected
Binance said 45 hours from 08:47 UTC on 30 October.
Binance aims to restore withdrawals by Sunday and publish a full proof of reserves by Monday, as the attacker keeps moving funds on Tron.
DecryptProof of Reserves reportexpected
Shows whether Binance holds every customer's assets after the theft.
It plans to publish a full proof of reserves report by Monday, with an initial view before then.
DecryptTechnical post-mortem
Binance's own account of how the attacker got in.
We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
BinanceAn official attribution
So far only private firms name North Korea.
The FBI is aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts and coordinate appropriate investigative steps
Nextgov/FCWThe unfrozen $2.4B to $3.3B
Whether the attacker can cash out the assets no issuer can freeze.
The attacker is swapping the rest into ETH and other assets that cannot be frozen, and has begun moving funds between blockchains.
Elliptic
Sources
The Binance Hack | Explained.
“Instead, it might have everything to do with the North Koreans and a laptop.”
143K views · transcript read
Top 10 most watched and read views, likes or points as each platform shows them
From Binance 23
Investigators and agencies 7
Spreading something false or misleading 12 · check the verdict before you share
News 125
YouTube 25
TikTok 30
Instagram 6
On X 4
Reddit 38
Hacker News 25
Saying "North Korea did it" 77 · verdict: unconfirmed
Saying "The biggest crypto hack ever" 57 · verdict: true
Saying "It was done in 20 minutes" 20 · verdict: true
Saying "$6.3 billion is gone" 7 · verdict: misleading
- News
- TikTok
- Hacker News
Data for AI Agents and Researchers
- Markdownthe whole page as text, for language models
- JSONfacts, quotes, claims, timeline and every source
- CSVone row per source
- RSSnew moments as they are added
How this page is made: every fact, moment and verdict carries the exact words of its source, checked word for word against the stored page before publishing. Official statements, investigator reports and news are read in full; posts, videos and threads come from X, YouTube, TikTok, Instagram, Reddit and Hacker News, with transcripts for the most-watched videos. Public posts are shown without their authors' names; videos play through each platform's own player. Cite as: The Binance hack, October 2026, Venkata Pagadala, https://venkatapagadala.com/notebook/events/binance-hack-2026