Binance hack: FBI names North Korea’s TraderTraitor, $3.24 billion still in linked wallets, first bitcoin mixing, DefiLlama outflows above $6 billion

Update, 2 November 2026, 12:12 UTC: Elliptic reports the first mixing of the stolen funds, about 28 BTC through 18 coinjoins by 06:02 UTC on Monday, says the XRP, the NEAR and about half of the SOL have now moved, and counts about $3.24 billion still in linked addresses. DefiLlama’s wallet data show more than $6 billion leaving Binance over 24 hours, by CoinDesk‘s reading, and above $7 billion by Cointelegraph‘s, a different measure from Binance’s own $3.64 billion net for the first 9.5 hours. Gate says on X that it froze two accounts related to the attacker, and TokenPost reports that US dollar withdrawals are back, as does a headline in The Defiant, with no rails or limits given. Binance’s date for the full proof of reserves is still Tuesday 3 November, the date it gave on Saturday, and our 12:07 UTC check showed 14 of 991 coins open, with USDT on Tron now off.

The Binance hack of Thursday 29 October is the largest crypto theft on record, by TRM Labs’ count. Binance estimates the total impact at about $6.3 billion, and the blockchain analytics firm TRM Labs counts $6.36 billion taken from Binance hot wallets on ten blockchains, most of it in about 20 minutes from 20:05 UTC. Binance says about $3 billion has been frozen on-chain with partners and that it has reserved more than $6.34 billion of company funds to cover the losses. On Sunday it said it had covered about 95% of the stolen amount, a figure not independently verified, and it reopened withdrawals in phases from Sunday morning: BTC first, at 06:02 UTC by its status data, then all 15 first-phase networks by 12:36 UTC, by its own account. It counts $4.649 billion withdrawn against $1.01 billion deposited up to 15:30 UTC, a net outflow of about $3.64 billion. Counts built on DefiLlama’s wallet data run above $6 billion over 24 hours, a different measure. The FBI has since named North Korea’s TraderTraitor as the attacker.

Those are the figures Binance and TRM give. What is still missing is the explanation. Binance first pointed to a compromised engineer’s laptop, then said on Friday that it had found further points of breach, and Teng has since described an attacker that erased its traces. Binance repeated in its Friday evening update that it has found no evidence of a wallet private key leak, while private-key management is among the things under review. TRM’s reading of the chain goes further: wallets on different networks, with different key types and signing schemes, all produced valid signatures within about half an hour. The main body rests on data published up to about 17:45 UTC on 30 October, with later facts added at the time of the latest stamp; the story is still moving.

Binance withdrawals: all 15 phase-one networks back by 12:36 UTC, phase two undated

Binance was “preparing to resume phase one of withdrawals” between 06:00 and 09:00 UTC on Sunday 1 November, it wrote in Recovery Update #4, which its announcement page dates 04:08 UTC. Reuters gives the same window, and Cryptoticker lists the same 15 networks. The wording matters: the assets become available “progressively”, each network after its own security and readiness checks, so 09:00 UTC was not a promise that all 15 would be open by then. Binance says it ranked them by the past week’s user demand. Deposits stay open, it says.

Other coins stay closed until later phases, for which Binance gives no date. US dollar withdrawals are the one reported addition: TokenPost wrote on Monday that they are back, and a headline in The Defiant says the same, though only that headline and its summary loaded for us. TokenPost gives no time, rails or limits, mentions no other currency and cites no Binance announcement, and we could not read Binance’s own wording. For the crypto networks, Binance warns of delays during the first hours: “If a withdrawal for a network or tokens listed above doesn’t go through, you can try again after a short while.” Availability for a given coin is shown on the withdrawal page and on the network status page.

Our first check ended at 06:03 UTC. We polled the public data behind Binance’s network status page from before the window opened. Every network of all 990 coins listed showed withdrawals off until BTC on the Bitcoin network switched on, first seen at 06:02 UTC. At 06:03 UTC it was still the only one: ether, USDT, USDC, BNB, SOL and XRP stayed off, and Cryptoticker had found Bitcoin and Ethereum off at 04:45 UTC. That is a status flag, not proof of money moving. At that hour we found no outlet reporting a completed withdrawal, and no Binance post saying phase one had begun.

By 12:36 UTC all 15 networks of the first phase had reopened, Binance said in a withdrawal update reported by Bitcoin.com News and The Block. We read that update through those two outlets: it went out on X, which we did not open, and the newest item on Binance’s announcement page at 17:40 UTC was still Recovery Update #4. The morning counts were steps on the way. TokenPost had seven networks at 10:28 UTC, CoinDesk named the largest assets in a note marked 10:54 UTC, and nobody gives an opening time for each of the 15. CoinDesk’s summary spoke of bitcoin plus assets on 15 other blockchains, a count Binance’s own list does not support.

We repeated our check at 17:40 UTC, on the same public data. Each of the 15 networks had at least one coin open, which fits the 12:36 UTC statement on networks. Only 15 of the 990 coins listed had withdrawals on, all of them from the table above, and two lines of that table were still off: USDT on Polygon and on Avalanche C-Chain. That sits badly with Binance’s wording, “all 15 networks and assets”, and we do not know whether those two lines reopened and closed again or never opened. The Block, reading the status page at 16:22 UTC, had withdrawals suspended for 531 of 552 coins, a different base from our 990 that we cannot explain. A status flag still does not prove that a given withdrawal went through. Our read at 12:07 UTC on Monday gave 14 of the 991 coins listed, on 29 coin-and-network lines, against 30 at 11:48 UTC, with at least one coin open on each of the 15 networks. The coin missing from Sunday’s 15 is POL, now off on Polygon and on Ethereum. USDT on Polygon and on Avalanche C-Chain is still off, and USDT on Tron, a line of that table, now shows off as well. We found no explanation for any of these.

Cardano, Chainlink, Hyperliquid, Litecoin and NEAR were still being tested on Sunday, The Block reported; at 17:40 UTC ADA, LINK, HYPE, LTC and NEAR showed withdrawals off on all their networks, as they still did at 12:07 UTC on Monday. Withdrawals now run from newly generated wallets added to the proof-of-reserves list, the same report says. Phase two has no timetable. Yi He said wallets for other coins are still going through repeated security audits, and that the next ones will be ranked by market capitalisation, funds held and customer use, crypto.news reports. The same outlet has co-CEO Richard Teng repeating the 95% figure on Sunday and Binance expecting the full proof by Tuesday 3 November; both remain Binance’s own statements.

Binance net outflows: $4.65 billion withdrawn, $3.64 billion net in nine and a half hours

Binance has now given its own count, in a post on X reported by Bitcoin.com News and The Block. Between 06:00 and 15:30 UTC on Sunday, $4.649 billion left and $1.01 billion came in, a net outflow of about $3.64 billion. Binance sets that against $171 billion of assets under management, from its 28 October proof-of-reserves data, which gives 2.1%; that base predates the hack. Withdrawals peaked at $733 million in the interval from 08:00 UTC and deposits at $187 million at 08:30 UTC, and withdrawals beat deposits in every 30-minute interval, Bitcoin.com News says. Binance describes withdrawal volumes as “stabilising as expected”. These are the company’s figures, and no outside party has verified them.

Outside counts measure something else. DefiLlama showed about $4.05 billion of net outflows over 24 hours at 16:37 UTC, on $131.1 billion of tracked assets, The Block reports. That window opens before the restart, and the asset base is smaller than Binance’s $171 billion, so the two should not be merged. The same data had OKX taking in about $316.8 million at that hour. Monday’s readings are in the next section.

The morning’s figures, $1.02 billion on CoinMarketCap’s chart per ChainCatcher and about $1.26 billion over 24 hours per TokenPost, were secondary data with no shared window, and Sunday’s count supersedes them as a measure of the reopening. Net outflow is what left minus what came in, not total withdrawals, and none of these reports says whose coins moved. We have still not confirmed a withdrawal by a named customer.

Binance outflows by provider: three measures that do not add up to one number

There is no single outflow figure, because each provider measures a different thing. Binance counts its own withdrawals and deposits, over nine and a half hours. DefiLlama reads public wallets linked to the exchange, and that data can include transfers between wallets Binance controls, CoinDesk warns, so it is not a count of customer withdrawals. Whale Factor, cited by Bitcoin.com News, is a third count, and that article does not give its method.

The DefiLlama readings are one measure seen at different moments, not four separate counts, and they do not line up neatly: Cryptoast’s higher figure came first. The $16 billion in a Bitcoin.com News headline belongs in none of these rows. It is a fall in tracked assets, not an outflow: DefiLlama’s Binance total went from about $144.9 billion on 29 October to about $128.31 billion early on 2 November, a drop that takes in the roughly $6.3 billion stolen and lower crypto prices, and the article’s own numbers range from $15.7 billion to about $16.5 billion. On Monday DefiLlama tracked about $129 billion (CoinDesk) or about $127.9 billion (Cointelegraph), against the $171 billion Binance reports. That gap explains the percentages too: CoinDesk’s 3.6% sets DefiLlama’s outflow against Binance’s $171 billion, while Cryptoast’s roughly 5% uses DefiLlama’s $129 billion.

Rivals took in far less than left. On DefiLlama data OKX gained about $445 million (Cointelegraph), about $450 million (CoinDesk) or more than $495 million (Cryptoast), and Bybit $112 million (Cointelegraph) or about $134 million (CoinDesk). CoinDesk notes that such aggregates do not show how much came from Binance customers. Whale Factor has the next ten exchanges gaining about $368 million. Changpeng Zhao wrote on X that 98% chose to stay, Bitcoin.com News reports, a figure we could not check.

Binance says 95% of the stolen assets are covered: what it claims and what can be checked

Binance said on Sunday that it has covered about 95% of the impacted amount, up from about 90% on Saturday and about 80% on Friday. The figure is in Recovery Update #4, and Reuters carries it too. We have now read Binance’s three updates on its announcement pages, which earlier stamps of this article could not do; the 90% came in Recovery Update #3, published at 14:24 UTC on Saturday. What is left, Binance says, is tokens outside the top ten, less liquid and slower to buy at the required scale, which it keeps buying on the market and over the counter. It puts no dollar figure on the 95%; by our arithmetic it would be about $6 billion of the $6.3 billion. We found no independent verification of it.

Three sources pay for this, by Binance’s account: corporate treasury, part of SAFU (the Secure Asset Fund for Users) and part of the futures insurance fund, a spokesperson told Cointelegraph, with no amount for any of them. “Binance will absorb the financial impact of the stolen funds, not users,” the spokesperson said. CoinDesk describes the use of SAFU as a partial deployment expected over the next 24 hours, and reports that Binance has committed to bringing the fund back to about $1 billion. The insurance fund stays above its required level, Binance says, according to Cointelegraph, Cryptonomist and TokenPost; Cointelegraph notes that the minimum was not disclosed.

One thing can be read without Binance. A transaction in block 973,984, at 14:51:41 UTC on Saturday, sent 7,499 BTC from one address to a single other address; 1 BTC had gone the same way six minutes earlier. We read both on mempool.space and on Blockstream. The sending address is the one that reproductions of Binance’s February post give for SAFU, and Cryptonomist calls it Binance’s disclosed SAFU address; we did not open that post. Whale Alert valued the 7,499 BTC at about $581 million, ChainCatcher reported, and Binance then said the “SAFU fund transfer is complete”, according to Cryptonomist; TokenPost and TechFlow report the same. Cryptonomist and TokenPost present the transfer as part of the effort to replace the stolen assets; the words Cryptonomist quotes from Binance say only that it is complete. At our check at about 17:50 UTC, the receiving address held 7,500 BTC and had sent nothing, and the sending address held about 7,500 BTC, half of the 15,000 BTC it held before. The ledger shows the move, not its purpose. Binance’s Update #3 says part of SAFU is being used to buy the remaining assets, but it has not said who controls the receiving address, or how much of the 7,499 BTC went to that.

The new snapshot is dated midnight UTC on 31 October, CoinDesk reports, and shows coverage of 100% or more for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. It is Binance’s own document and not the full proof, which would let users check that their balances are included. “The full zero-knowledge proof takes approximately 40 to 50 hours to generate due to the computational workload,” Binance said, as quoted by Cointelegraph. By our reading, a snapshot taken at midnight cannot show on its own a figure Binance gave later on Saturday. CertiK told Cointelegraph on Friday that it needed more information to verify the $5 billion of replacement coins, and we found no outside check since. Binance now says the ten balances are “fully backed 100%”, which remains its own statement.

The full proof is dated Tuesday 3 November, the date Binance gave on Saturday, and nothing we read on Monday announces a further delay. Binance’s Update #2 promised results by Monday 2 November, and Teng promised a full proof by Monday, in the Cointelegraph live blog at 14:34 UTC. The snapshot then came early, but Update #3 on Saturday says the proof that lets users check their own balances is “estimated to be by Tuesday, 2026-11-03 (UTC)”. So the full proof slipped by a day against Teng’s Friday date, and the change dates from Saturday, not Sunday. Cryptoticker and an earlier Bitcoin.com News piece give Tuesday; Cryptonomist still wrote Monday on 1 November, citing Teng. Recovery Update #4, as we read it on Sunday morning, gives no new date. On Sunday Bitcoin.com News tied an updated report expected on 2 November to that fourth update, The Block projected the report for Monday, and Blockonomi expected the zero-knowledge proof on 3 November. On Monday Bitcoin.com News gave Tuesday 3 November (UTC), citing Update #3, and repeated Binance’s explanation that the proof takes about 40 to 50 hours to compute. Cointelegraph still wrote on Monday that an updated proof-of-reserves report was expected that day. As of about 12:10 UTC we had seen no report of such a publication, and we could not read Binance’s announcement pages. We keep Tuesday for the full proof. Either way, the 31 October snapshot predates Sunday’s withdrawals.

On withdrawals, Saturday’s update said only that Binance remained on track for Sunday. Sunday’s gave the window set out above, which begins half an hour after the 05:30 UTC CryptoNews had worked out from Friday’s update. Teng had said withdrawals would stay paused until they passed rigorous testing, Cryptonomist reports.

What Binance has confirmed about the hack

Binance chose X as its channel. Its posts, quoted by Bitcoin.com News late on 29 October (11:08 PM EDT, 03:08 UTC on 30 October) and by Cointelegraph, put the estimated total impact at around $6.3 billion, with about $3 billion frozen on-chain so far. An earlier Binance figure, cited in TRM’s timeline, was $2.54 billion of verified frozen funds at 23:35 UTC on 29 October. The two numbers do not contradict each other: the freeze count rose during the night.

On the cause, Binance’s wording is careful. Its initial investigation “suggests that the security incident may involve a compromised DevOps engineer’s laptop”, which let an attacker reach a service container and submit unauthorized withdrawal transactions. The exchange added: “We have found no evidence of any wallet private key leak.” It describes the investigation as ongoing.

That first account has since moved. In a later update on 30 October, Binance said its “subsequent investigation has uncovered additional points of breach”, Decrypt reported; at that stage it had not said what they were, CryptoSlate noted, and Teng gave more detail later in the day. Co-CEO Richard Teng wrote that the attacker’s access began with a laptop but that “this was not a single ‘one-click’ action”, FinanceFeeds reported, and Cointelegraph quotes him describing “a more complex attack process”. “So far, we have found no evidence of any wallet private key leak,” he wrote at that stage.

The company says it has revoked the authorization of the affected addresses and contacted law enforcement and blockchain intelligence partners. It also promised an updated proof of reserves after remediation, followed by a detailed technical post-mortem once the facts are verified. A snapshot is out and Binance estimates the full proof by Tuesday 3 November; the post-mortem still has no date, and Binance said on Sunday only that it will follow once the investigation is complete. Law enforcement has since spoken. Reuters first reported, citing a person familiar with the situation, that Binance is working with the FBI and the US Secret Service, according to ChainCatcher and PANews. Cointelegraph’s live blog logged the same kind of claim at 13:11 UTC, from one unnamed source familiar with the matter, about recovering some of the stolen funds. We treat these as one unnamed-source claim, not two confirmations. Reuters has since quoted both agencies, in a story carried by The Business Standard. The FBI said it was “aware of the incident” and engaged with “relevant public and private partners”. The Secret Service said its investigators “are working around the clock with our private-sector partners, including Circle, to identify, freeze, trace and recover funds stolen from Binance on Thursday”. Neither statement, as quoted, named a suspect; the FBI did so on Saturday evening, as the section on North Korea sets out. Binance’s own statements, as quoted, mention only law enforcement and name no agency, and we found no Justice Department statement. Binance has not named the attackers.

Changpeng Zhao, the founder, who no longer runs the company but remains its majority shareholder according to Fox Business, wrote on X: “User funds are safe! It does look like a hack on Binance.” He thanked Tether and Circle for freezing funds quickly, Fox reported, and Coinpaper said he expected affected users to be made whole. “It hurts, but we will survive,” he added, as quoted by Bitcoin.com News. Reuters reported that Binance.US said it was not affected.

Teng’s video: traces erased, approval controls skipped, sequence still unknown

Richard Teng gave a fuller account in a video on X on Friday, CoinDesk reported; Cointelegraph’s live blog logged it at 14:34 UTC. “This was a complex attack,” he said. The attacker used a “self-destruct mechanism” to destroy its tools and traces, and took control of a hot wallet through an EIP-7702 delegation that “did not pass through our normal approval controls”, in the words Cointelegraph gives. Investigators found breach points beyond the suspected laptop but have not established the full sequence of events, CoinDesk says. We could not open the video, so his words here come from those outlets.

Binance is now reviewing cloud systems, employee devices, private-key management and transaction-signing procedures. Teng did not say, in the reports we read, how the delegation came to be signed or how the other nine chains were reached. Those reports do not quote him on private keys; Binance’s written update of Friday evening does repeat that line.

Binance’s Update #2: 34 hours to withdrawals, a 12-hour snapshot, still no evidence of a leaked key

Binance’s second formal update went up on X at about 19:33 UTC on Friday, signed by Yi He and Richard Teng. We could not open the post on X when we first wrote this, so what follows comes from Reuters, as carried by The Business Standard, Bitcoin.com News and a BlockchainReporter article republished by CryptoNews, and we have since read the same update on Binance’s site, which is dated 19:33 UTC. Binance now places the hot-wallet compromise at about 20:05 UTC on 29 October, which matches the first transfers in TRM‘s log.

On withdrawals, the target is a restart “within approximately 34 hours”, in phases, once security checks, remediation and validation of the affected systems are done. CryptoNews counts that as about 05:30 UTC on Sunday 1 November. TokenPost says the restart will go token by token. Deposits and unaffected services stay open, Bitcoin.com News reports.

The update also breaks down the reserve. On Friday the $5 billion Binance already held was in the affected assets, which Bitcoin.com News lists as USDC, USDT, BTC, ETH and BNB, and about $1.3 billion was still being bought on the market and over the counter, CryptoNews says. The “80%” in many headlines comes in several wordings: Bitcoin.com News writes about 80% of losses on those assets, TechFlow about 80% of the affected amount, and CryptoNews gets 79.4% from $5 billion out of $6.3 billion. Binance itself writes “approximately 80%” in its Saturday update. On Saturday Binance named its sources (corporate treasury, part of SAFU, part of the futures insurance fund), but not the amount from each.

The snapshot came first. Reuters reported an initial proof-of-reserves snapshot within 12 hours of the update, with results expected by Monday 2 November. CryptoNews places it at about 07:30 UTC on Saturday, and a ChainCatcher notice says before 15:33 on Saturday, which by our reading is the same moment in UTC+8. The snapshot Binance published on Saturday is dated midnight UTC on 31 October, CoinDesk reports. Binance describes the exercise as “an updated view of platform asset holdings and the corresponding backing of user balances”, as quoted by CryptoNews, which stresses that it is not a security audit.

On the cause, the update repeats that the “subsequent investigation has uncovered additional points of breach”, without listing them in the reports we read, and that Binance has found “no evidence that wallet private keys were leaked”. Further technical findings are due within about 48 hours of the update, which by our count is about 19:33 UTC on Sunday, subject to the needs of the investigation. A detailed post-mortem follows, with no date. Hypernative, quoted by Bitcoin.com News, points the same way as TRM and Blockaid: compromised signing access, valid signatures from Binance-controlled keys, and EIP-7702 used to run attacker code through a Binance wallet.

$6.34 billion set aside: what Binance said on Friday

Binance said on Friday, in a post on X according to Crypto Briefing, that it has reserved “more than $6.34 billion in company funds” for the losses. Reuters, in a story carried by Devdiscourse, reported the figure, and Cointelegraph’s live blog logged it at 10:55 UTC. We could not open Binance’s post ourselves, so the wording here comes from those reports.

About $5 billion of the reserve was already held in the affected tokens on Friday, about 80% of the loss; Binance put the share at about 90% on Saturday and about 95% on Sunday. The rest, less liquid tokens by its account, is being bought on the market and over the counter, and Binance warned on Friday that this may take longer for thinly traded tokens and because OTC deals need time to settle, according to TechFlow. Saturday’s reports point to ENA and RSR (see the next section); we found no Binance statement naming either. The roughly $3 billion frozen is not part of the reserve: those assets are still being recovered and verified.

Co-CEO Yi He explained the buying. Binance wants to match the stolen altcoins through OTC and exchange purchases to complete its proof of reserves, according to Cointelegraph and ChainCatcher, which adds that she said SAFU and Binance’s other holdings include large amounts of BTC and ETH. She promised another update once the purchases are done. A Binance spokesperson told Cointelegraph, in an entry logged at 12:41 UTC, that the $5 billion in matching tokens is “held in the exchange’s custody”, but declined to share wallet addresses for security reasons and did not say when the assets were acquired. We found no outside check of the reserve: CertiK told Cointelegraph on Friday that it needed more information to verify the $5 billion.

ENA and RSR: what Lookonchain and Reserve report, and what we could not confirm

Lookonchain counted 128.63 million ENA, about $24 million, moving from Ethena-labelled wallets to Binance over eight hours on Saturday, Bitcoin.com News reported at 09:30 UTC. The same article cites Arkham data: batches of about 25.25 million ENA left an address labelled “Ethena: Coinbase Prime Custody” and ended at a Binance deposit address. At about 12:00 UTC Etherscan showed that address, tagged as a Binance deposit, holding about 128.63 million ENA. That confirms the balance. It does not say who owned the tokens before, or why they moved.

The analyst EmberCN, cited by Bitcoin.com News, puts the ENA taken on 29 October at 217.5 million, so the transfer equals about 59% of it. That compares amounts, not coins: the attacker had already sold its ENA for about $33.93 million, the same article says. We found no comment from Binance or Ethena, and we do not know whether the tokens moved as a sale, a loan or something else.

Reserve’s team offered a second case. It says Binance confirmed it will repurchase 3.38 billion RSR, the amount taken in the attack, worth about $4.6 million at the $0.00137 Bitcoin.com News gave at 09:30 UTC. “In the case of RSR we believe Binance will acquire on the open market through a professional market maker,” the team wrote, as quoted by that outlet, and it inferred that the purchase would be finished by Monday’s reserve report. This is Reserve’s account; we found no Binance statement on it.

CoinDesk wrote on Saturday only that Binance was “buying the remaining assets through markets and privately negotiated trades”, and named neither token. What follows is Coindaro’s own reading, not that of CoinDesk or any other source cited here: purchases like these, if that is what the ENA transfer was, replenish what Binance holds against customer balances. They do not recover the stolen coins. Binance’s Saturday statement, as CoinDesk and Cointelegraph report it, speaks of replenishing too.

The question of Saturday morning is settled: a snapshot exists, as the section on Binance’s statement sets out. The reports of that statement we read speak only of less liquid tokens and name neither ENA nor RSR. Bitcoin.com News had reported no snapshot at 08:30 UTC.

Withdrawals paused: from Yi He’s 48 hours to Binance’s 34

Most of the overnight times come from one outlet, FinanceFeeds, which compiled Binance’s posts on X. By its account, Binance said at 00:13 UTC and again at 02:25 UTC on 30 October that deposits and withdrawals were suspended. At 04:17 UTC, co-founder and co-CEO Yi He posted a service update: “We expect to begin resume withdrawal services in the next 48 hours.” Deposits, she wrote, were unaffected and operating as normal. Counted from her post, 48 hours runs to about 04:17 UTC on Sunday 1 November.

Binance’s main account repeated the 48-hour window at 04:36 UTC, FinanceFeeds reported, saying withdrawals remained paused while the team completed a security revamp of the withdrawal service and related addresses, and that deposits ran normally. Nobody at Binance has explained why the deposit status changed between 02:25 and 04:17 UTC.

When withdrawals first stopped is less clear. FinanceFeeds puts the halt at 22:15 UTC on 29 October, about two hours after the first transfers; we found that time nowhere else. A live log by The Defiant, republished by CryptoNews, has Binance saying at 6:33 PM New York time (22:33 UTC) that withdrawals would resume once the security issue was fully resolved, and suspending trading on Binance Alpha at 23:06 UTC.

Binance’s later update, quoted by Decrypt, CryptoSlate and FinanceFeeds, said withdrawals were on track to resume in “45 hours”. The exact time of that post is unclear: FinanceFeeds had it by 08:59 UTC, and the entries around it in Cointelegraph’s log carry 07:37 and 08:37 UTC. That gave a target early on Sunday 1 November, between about 04:40 and 05:40 UTC. The low end is almost exactly the 48-hour window repeated at 04:36 UTC, so this may be the same deadline counted down rather than a new promise; Binance has not said.

Teng’s statement added a third count. Cointelegraph logged a target of within 40 hours at 14:34 UTC, TokenPost gives Sunday 1 November, and CoinDesk said withdrawals would stay suspended while Binance rebuilt and tested its infrastructure. PANews reported that the service would not reopen until it passed strict tests. So Sunday was a target with a condition, not a promise.

By our arithmetic, and assuming the statement went out near its logged time, 40 hours from 14:34 UTC lands at about 06:34 UTC on Sunday, a little over two hours after the end of Yi He’s window. If that assumption holds, the 48, 45 and 40 hours look like one deadline counted down, with a small slip, not three promises. The reports we read give no time for the video. Binance’s Update #2 then gave a fourth count, about 34 hours from about 19:33 UTC, which CryptoNews works out as about 05:30 UTC on Sunday. That is an hour earlier than our 06:34 and inside the range of the 45-hour post, so the counts still point to one deadline early on Sunday. On Sunday, in Recovery Update #4, Binance replaced those counts with a window: 06:00 to 09:00 UTC for the start of phase one. Withdrawals were still suspended on Friday when CoinDesk published at 16:31 UTC, and the update, as reported, says deposits and unaffected services stay open.

Binance hack timeline, hour by hour (UTC)

TRM Labs published the most complete reconstruction at 02:10 UTC on 30 October, with on-chain data up to 00:30 UTC. The table below follows it, completed by CoinDesk, Decrypt, FinanceFeeds and, for Friday, Cointelegraph where noted.

TRM also logged later sweeps from the drained Ethereum wallet at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC. The last came three and a half hours after the first, so the attacker kept control of that address well into the night.

How $6.3 billion left in about 20 minutes

Ethereum is where the method is visible. The attacker used EIP-7702, a feature added with the Pectra upgrade that lets an ordinary account delegate its behaviour to a smart contract. According to Blockaid, quoted by Cointelegraph, and to TRM, the attacker had prepared 50 signed authorizations, one for each of 50 consecutive nonces of the Binance 14 hot wallet, and bundled them in one transaction at 20:20 UTC. Only one had to match the wallet’s current nonce. One did.

The wallet was then delegated to an unverified “sweeper” contract that only the attacker’s operator address could trigger, Blockaid said. It emptied the wallet of ETH and dozens of tokens in minutes. That contract had been deployed a few hours earlier by an address funded through Tornado Cash, according to Blockaid’s analysis reported by Cryptoast.

The other nine chains did not need any of this. On bitcoin, Tron, Solana, the XRP Ledger and the rest, funds left through ordinary, validly signed transfers, TRM says. CoinDesk found that each of the 11 bitcoin transactions looked like a normal Binance withdrawal, signed by Binance-controlled addresses; in one of them, change even returned to Binance. A hot wallet is built to sign withdrawals quickly, and that is what these wallets did.

This is the point where the two accounts diverge. A delegation under EIP-7702 has to be signed by the hot wallet’s own key, and so does a bitcoin or Tron transfer. If no private key leaked, as Binance said on Friday and repeated that evening, someone or something still produced those signatures on ten networks. TRM’s answer is that the attacker most likely gained the ability to make Binance’s hot-wallet signing system sign transactions across chains. The batch of 50 pre-signed authorizations suggests, in TRM’s words, that access may have been time-limited, or that signatures had to be requested through a system.

Ido Ben-Natan, Blockaid’s co-founder and chief executive, described it to Cointelegraph as key misuse rather than theft, “a compromise of signing infrastructure”. “We don’t think a key was leaked,” he said, adding that more than one device could have been compromised. That reading fits Binance’s early statement but goes beyond it. Binance has still not said who or what signs its withdrawals, or how a laptop reached that system.

Amounts per chain and asset, according to TRM

TRM values each transfer at the price of the moment it happened. On that basis the total is about $6.36 billion; at prices on the morning of 30 October it is about $6.23 billion, because crypto fell overnight.

CoinDesk values the same 18,270 BTC at about $1.4 billion at early Friday prices, against TRM’s $1.47 billion: the gap is the price move between the theft and the morning. CoinDesk also estimates that roughly 204,500 ETH was taken from Binance, about 5.6% of its ETH reserves.

Who gives which figure

Numbers in a story this size move by the hour, and several outlets counted at different times. None of the gaps below is a dispute about the facts; most are a question of when the count was made, or of what was included.

Ripple is the one gap that matters. Yi He thanked Ripple, according to Decrypt, for “promptly freezing approximately 200 million”, and Reuters reported that Ripple froze about $200 million. TRM, which writes that Yi He credited Ripple with stopping about $200 million from moving, confirms only 40.5 million RLUSD frozen on-chain: by its count the attacker took 88.5 million RLUSD in all and sold about 48 million through exchanges before the 22:01 freeze. Neither Ripple nor Binance has published a breakdown that reconciles the two figures.

Frozen is not recovered: Tether, Circle, and the bitcoin nobody can freeze

The stablecoin issuers moved fast. Tether froze 971.1 million USDT at 21:01 UTC, Circle froze 823 million USDC at 21:04, both within an hour of the first transfers. Tether’s freeze grew afterwards across Ethereum, Tron, Avalanche and Polygon. Ripple and World Liberty Financial followed later in the evening, and the Arbitrum Security Council used its emergency powers just after midnight. Decrypt reported that Aave froze its V3 markets on Ethereum mainnet and that Kamino paused SOL and BTC borrowing; Decrypt found no flaw in Uniswap or Aave themselves, which the attacker used as exit routes. Cointelegraph logged at 13:57 UTC that Aave said new deposits and borrowing had resumed across all its V3 and V4 markets, shortly after LlamaRisk set out a staged unfreeze on Aave’s forum at 13:49 UTC. In our own on-chain check at 17:56 UTC, the eight main V3 reserves we read on Ethereum were no longer frozen, with USDC and USDT still at zero loan-to-value; we did not check V4 or other networks. First Digital says the stolen FDUSD has been frozen too, Bitcoin Magazine reports, without an amount.

Tether had already shown its blacklist the day before, when it froze 32 Tron addresses holding about $27 million for reasons it did not give, as we reported in our piece on Tether’s Tron freeze. Frozen tokens are not returned tokens, though. Bitcoin.com News put it plainly: the funds are restricted, not recovered. Getting them back to Binance takes a decision by each issuer, and none has announced one.

The attacker also moved part of the dollars out of reach before the freeze landed. TRM says about 325 million USDT was sold to market makers and solvers for about 122,300 ETH, a discount of more than 10%, and that a second wallet supplied 60 million USDT to Aave and borrowed about 19,760 ETH against it. Decrypt reports 36 million RLUSD swapped for 15,439 ETH.

Then there is bitcoin, which has no issuer and no freeze button. According to CoinDesk, the 18,270 BTC left in 11 transactions, all in block 973,732, to a single address, and were split within minutes into 19 wallets: 17 of exactly 1,000 BTC, one of 832.5 BTC and one of 437.7 BTC. As of 04:23 UTC on Friday, none of them had moved; they were only receiving dust deposits worth a dollar or two. CoinDesk recalls that after the $1.5 billion Bybit theft of February 2025, the attackers took about ten days to convert the stolen ether into bitcoin. The FBI’s attribution of that theft to TraderTraitor came five days after it; for Binance it took about two.

Decrypt counted about 253,000 ETH, worth around $570 million, sitting unmoved in two wallets at 22:07 UTC on 29 October. TRM’s figure for everything still in the attacker’s hands, on data up to 00:30 UTC on Friday, is about $2.4 billion, which on its own exceeds the whole Bybit theft of February 2025; Elliptic’s later estimate is higher.

Where the money went on Friday: Chainalysis, the altcoin sales and the few off switches

Chainalysis’s own post, published on 30 October, puts the transfers at about $6.4 billion. It says funds began leaving around 4:20 p.m. Eastern Time on 29 October (20:20 UTC) and that freezes started by 5:14 p.m. (21:14 UTC). Both times are later than TRM‘s log, which has the first XRP transfers at 20:05 UTC and Tether’s freeze at 21:01 UTC, and neither firm explains the gap. The attacker first moved $500 million of stablecoins, swapped $325 million of them into $285 million of ETH over nearly 20 minutes, then sent the other $175 million to stopover wallets. Many laundering addresses first receive exactly 1 TRX, then more funds, then forward them, a pattern Chainalysis reads as programmatic.

Its frozen total is about $2.8 billion, against about $3 billion from Binance and more than $2.83 billion from ZachXBT, as reported by Journal du Coin. Nobody has reconciled the three. “The investigation remains ongoing and we expect the stolen funds to continue moving in the coming days,” Chainalysis wrote.

Bitcoin and ether are what the attacker is keeping. Bitquery, cited by Cointelegraph, traced 18,270 BTC to 19 addresses, 199 BTC more than the 18,071 BTC Coinbase reported for its own account at 30 September, customer coins excluded. That is a treasury comparison and nothing more. CoinDesk offered another on Saturday: the haul tops Tesla’s 11,509 BTC, is about 2.3 times El Salvador’s roughly 7,820 BTC and sits 442 BTC short of SpaceX’s 18,712 BTC, with the Tesla and SpaceX figures dated 30 September. Bitquery also traced 508,621 ETH, up from the 200,630 ETH first taken, because stolen stablecoins and tokens were swapped into ether. TRM’s earlier count was more than 420,000 ETH; the two were made at different hours and we cannot reconcile them. Cointelegraph writes nine blockchains where TRM counts ten and Elliptic 11, with NEAR on its list; we keep TRM’s itemised list.

The altcoins are going. Lookonchain, cited by Bitcoin.com News at 10:30 UTC, counted about $158 million of them swapped into 70,480 ETH, led by UNI ($39.63 million), ENA ($33.93 million), PEPE ($31.66 million), LINK ($26.05 million) and AAVE ($14.27 million). One analyst said 7,018,792 UNI went in 51 minutes, the last swap at a price 21% worse than the first. The stolen ENA, UNI, PEPE and AAVE reportedly equal 7% to 15% of Binance’s reported holdings of each, which is the kind of hole its purchases have to fill. On Saturday Lookonchain counted 128.63 million ENA moving the other way, into a Binance deposit address; the section on ENA and RSR gives the details and the limits.

FUN shows how little a thin market pays. According to CoinDesk, the attacker’s wallet sold 134.1 million FUN for 111.5 ETH, roughly $250,000, between about 23:31 UTC on Thursday and 04:17 UTC on Friday, in a Uniswap pool holding about $16,000. CoinDesk gives a fall of more than 90% in that pool, a headline on The Defiant says 95%, and CoinGecko showed 68% across all markets over 24 hours, so these are different measures. The wallet still holds 580.8 million FUN, and FUNToken asked centralized exchanges to disable deposits for now.

Part of the money crossed THORChain. ZachXBT reported that funds from the Binance and Bitget hacks passed through it before being combined at one Ethereum address, Cointelegraph says. That fits the mixing Chainalysis describes, although its post does not name THORChain, and on Friday we found no THORChain statement or volume figure; Elliptic has since counted about $31 million and SomaXBT, a different tracker with a different cut-off, about $44 million, as set out below. After the Bitget hack, the protocol said it has no way to block individual swaps. RUNE rose more than 13% on Friday to $0.67, by Cointelegraph’s reading of TradingView; Coindaro’s 11:40 UTC snapshot showed a rise of 8.04% over 24 hours, a different window.

Two freezes came from governance, not from a stablecoin issuer. In its own post, the Arbitrum Security Council gives 8,425 ETH and 74,559,805.2 ARB, one ETH fewer than TRM’s count. At 00:08 UTC it briefly upgraded the Inbox contract on Ethereum to add a function able to impersonate the exploit address, sent two cross-chain transactions moving the funds to a holding address, then restored the original contract. “No other user’s funds or applications were affected,” it says. Only an ArbitrumDAO vote can move the money now, and we found none scheduled. Journal du Coin notes that the Council needs nine of its twelve members for such an action.

Synthetix said on X, as reported by PANews, that its protocolDAO recovered about 8.4 million SNX, worth about $1.5 million, holds it in a Safe multisig and will return it when Binance asks. We could not open the post, and how the tokens were recovered is not clear from what we read. We found no fresh figure from Ripple or World Liberty Financial as of about 17:45 UTC.

Elliptic’s count: about $3.24 billion still in linked addresses on Monday

Elliptic’s account of the theft, last updated at 23:55 UTC on 31 October, is the fullest public tracing we have read since TRM‘s. At that update it estimated that the attacker controlled about $3.21 billion of assets that no issuer can freeze, spread across dozens of addresses and including 519,104 ETH (about $1.16 billion), 18,270 BTC (about $1.41 billion), 233 million XRP and around 475 million TRX. Its count on Friday was about $3.23 billion, with around 575 million TRX. The XRP, SOL and NEAR, worth about $437 million, had not moved at that update; they have since. Its Monday page, last updated at 07:30 UTC, puts the amount still in addresses linked to the theft at about $3.24 billion, mostly ETH and BTC, and we did not find new ETH or TRX totals there. Both figures are higher than TRM’s $2.4 billion, which rests on data up to 00:30 UTC. Cointelegraph Magazine earlier cited about $3.33 billion from Elliptic, so the number moves with prices and counts.

Elliptic has verified $2.85 billion frozen or seized, 44% of the theft and 94% of it stablecoins, almost entirely on Ethereum and Tron. A chart on the page dates its freeze data to about 04:30 UTC on 31 October. Binance’s own figure stays about $3 billion. Elliptic’s blocklist now runs past 1,000 addresses.

Stablecoins were the attacker’s weak spot. They made up $3.46 billion of the theft, and only about $786 million was turned into ETH and TRX before the freezes landed. On Ethereum, 434 million USDT went into 160,451 ETH through Uniswap, 1inch and market makers’ request-for-quote systems, at 12% to 26% worse than market, a price that suggests speed mattered more than value. This is a wider count than TRM’s 325 million USDT for about 122,300 ETH. On Tron, 234 million USDT was swapped for 638 million TRX on SunSwap.

That TRX was the money on the move on Friday. On the morning of 30 October it was split across five new addresses. Four had not moved. The fifth was sending small amounts through swaps and bridges, mostly into ETH, and the pace more than doubled that evening; by Elliptic’s count on that page, between $38 million and $67 million had left the addresses it traces. Elliptic’s Monday count, set out below, is far higher. Decrypt, citing Arkham, saw one Tron wallet send about 5.19 million TRX, about $1.73 million, to 12 addresses on Friday.

The altcoin sales came in waves. About 150 other tokens were sold for ETH on decentralised exchanges until about 06:36 UTC on 30 October, Elliptic says. Between 11:38 and 12:29 UTC the same day, all the stolen AVAX was sold for USDC, bridged to Ethereum over Circle’s CCTP and swapped for 7,242.8 ETH. The 18,270 BTC had reached no service at the time of the page’s update, and Elliptic’s Monday page says they have not moved since 29 October.

One position was still open at Elliptic’s update. The second wallet’s Aave loan, 19,762 ETH against 59.9 million USDT, stands as Elliptic describes it: “The loan is still open and close to the point of liquidation.” Cointelegraph Magazine gives LlamaRisk’s figures of about $59.9 million of collateral against about $43.8 million of debt, and reports Aave saying the position stays overcollateralised and does not put suppliers at risk. Marc Zeller of the Aave Chan Initiative called it “criminal but overcollateralized in the eyes of the protocol”.

What comes next, Elliptic expects from the Bybit laundering: layering through many wallets, bridges, mixers and swap services, then attempts to cash out through OTC brokers and exchanges. Chainalysis’s Jonathan Levin told CNBC on Friday that he saw no sign of mixers yet. “As you get further and further away, the amount of seizure opportunities go down,” he said. That was Friday: Elliptic has since recorded the first coinjoins, as the next section sets out. CNBC notes that hackers increasingly use Chinese money-laundering networks, which buy stolen crypto over the counter for a large fee, and that Ari Redbord of TRM Labs sees a “continued cat and mouse game”.

First bitcoin mixing: coinjoins, moving XRP and SOL, $242 million through Tron, and the freeze Gate reports

Elliptic’s new page, dated Monday 2 November, last updated at 07:30 UTC and with an on-chain cut-off of 08:45 UTC, reports the first mixing of the proceeds. Bitcoin derived from the Tron funds entered coinjoins from 05:55 UTC on Sunday, using WabiSabi, the protocol behind Wasabi Wallet and similar wallets. By 06:02 UTC on Monday about 28 BTC, about $2.2 million, had gone through 18 coinjoins of 101 to 491 inputs each. That is small next to the 18,270 BTC in the 19 wallets, which Elliptic says have not moved since 29 October: these coins came from the Tron money, not from those wallets. Elliptic is the only primary source for this so far.

The coins that sat still last week are moving. NEAR went to new accounts from 07:00 UTC on Sunday, and has not moved since. About half of the SOL went to a new address from 09:38 UTC on Sunday, and on Monday some of it was swapped to USDC and back and passed through a lending vault. All 233 million XRP went to six new addresses between 02:12 and 04:00 UTC on Monday, Elliptic says. Bitcoin.com News gives five wallets of about 40 million XRP and one of 33.46 million, about $293 million at about $1.26 in its 07:30 UTC report, and none had sent funds on by 04:37 UTC.

Elliptic counts about 12,000 wallets on 11 chains and more than 40,000 transactions in under four days, with about $16 million sent to addresses that also hold proceeds of September’s Bitget exploit. “The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions,” it writes.

Tron now has two counts, and they should be read side by side. Elliptic says one wallet sent 684.6 million TRX to hundreds of new addresses, about 7,700 in the end, between 02:19 UTC on 30 October and 05:33 UTC on 1 November, and that at least $147 million was bridged out of Tron, almost all of it paid out as ETH. The Block reported on Sunday a higher number from SomaXBT, an on-chain analyst: about $242 million laundered in two days, of which about $194 million left Tron through bridges and swap services, about $26 million stayed on Tron and about $22 million went on fees, slippage and price moves. The figures have different definitions and cut-offs, and Elliptic’s is a minimum. The $242 million is SomaXBT’s estimate, not The Block’s own: the outlet matched SomaXBT’s numbers for one Relay address on Etherscan. Bitcoin.com News gives the same sum to unnamed analysts and links a post by WuBlockchain.

SomaXBT’s named routes are Relay ($48 million), THORChain ($44 million), Chainflip ($32.1 million) and Symbiosis ($16 million), about $140 million together, plus $41.7 million through Bitget Wallet with the destination unresolved, so the itemised routes fall short of $194 million. None of this is a cash-out: “A negligible amount has likely been cashed out so far,” Elliptic writes. Symbiosis admitted gaps in its screening, The Block reports: “We’re closing them as we go.” Relay says it screens addresses with third-party risk data and an internal blocklist. THORChain’s Chad Barraford said node operators “have zero information that isn’t already public” and has not said whether they will block the addresses on the FBI’s list, which has 608 Ethereum addresses, 19 Bitcoin addresses, one Solana address and no Tron address.

Gate says it has acted. Lookonchain reported that the hacker deposited $250,000 into Gate over 12 hours, Bitcoin.com News said at 07:30 UTC, adding that Gate had not commented. Gate had in fact posted on X early on Monday, at about 03:33 UTC by our reading of the post’s identifier. It said it had identified and frozen two accounts related to the attacker, that the information had entered due diligence and that it will cooperate with law enforcement and later investigations, as ChainCatcher and PANews relay it. Gate did not say who holds the accounts or how much was frozen, or tie the freeze to that $250,000, and Elliptic’s page does not mention Gate.

Laundering on autopilot: Elliptic times the Tron wallet, and a PROM sale fetches $71

A second Elliptic page, dated 31 October and titled “The Binance hack is laundering on autopilot”, looks at how the money on Tron moves. By 08:11 UTC that day the main distribution wallet had sent funds every hour for 31 hours, with a longest pause of 46 minutes and no overnight break. “The timing looks programmed,” Elliptic writes: transfers almost never come less than about 30 seconds apart, and the roughly 200 receiving wallets usually pass the funds on within about two minutes. One swap amount into THORChain appears 19 times. When a bridge refused deposits, the funds went out again from new wallets.

At its live update of 22:41 UTC on 31 October, Elliptic counted about $196 million sent from that wallet to around 200 others, with top-ups in batches of about $40 million and a pace of $7 million to $11 million an hour overnight. It traces $31 million to THORChain, $5.3 million to SunSwap, $1.8 million to Bitget Swap and $0.4 million to USDT0. The THORChain sum is the same as at 08:11 UTC, when the page described about 100 swaps every two hours, and Elliptic does not say why. Elliptic does not link these figures to the $38 million to $67 million on its main page.

The PROM story rests on one source. Lookonchain links to the hacker a wallet that sold 908,793 PROM, nominally worth about $5 million, on a near-empty Uniswap V2 pool for 0.0316 ETH, about $71, Cryptonomist reported on Sunday. The article gives no address or transaction hash, we did not find Lookonchain’s original post, and we could not check the sale on-chain, so the link to the hacker is Lookonchain’s alone. As described, the $5 million was a marked value that the pool could never pay.

What the rushed trades cost: Bitquery’s $119 million estimate, and a route to Solana

CryptoSlate reported on Sunday, citing a Bitquery investigation dated 30 October, that the attackers lost about $119 million by swapping stolen crypto at bad prices between 20:30 UTC on 29 October and 01:00 UTC on 30 October. This is a price-impact estimate against market prices, not cash removed from the stolen total, and we have not checked it. We did not find Bitquery’s own report.

By CryptoSlate’s breakdown, about $71.5 million was overpaid for ETH on Ethereum, about $22.4 million was overpaid swapping USDT for TRX on Tron, and about $24.8 million was given up selling UNI, PEPE and ENA below market. Buying pushed Uniswap’s main WETH/USDT pool as much as 38% above the broader market, it says. Trading firms and bots kept about $60 million after costs, and about $29.5 million went to Ethereum block builders and validators. The Tron line looks like the swap Elliptic records as 234 million USDT for 638 million TRX; that link is our reading.

The second new thread is thinner. The Defiant says in a headline that launderers “Reach Solana After Draining $500 Million on Tron”, citing Chainalysis. Only the headline and sub-headline loaded for us; the sub-headline says the Tron operation “spanned more than 1,000 addresses and over 3,000 deposits” before funds spread across chains. So we have no amount, time or address for Solana, and Chainalysis’s blog post, as we read it, mentions none of this.

That $500 million is not the $500 million of stablecoins the Chainalysis post describes on Ethereum. It is also well above the roughly $196 million Elliptic traced from the main Tron wallet at 22:41 UTC on Saturday, and nobody has reconciled the two. The Defiant’s visible text does not say whether the stolen 970,500 SOL are involved; Elliptic said on Saturday that they had not moved, and on Monday that about half had, from 09:38 UTC on Sunday.

Binance’s explanation and TRM’s reading, side by side

Both versions are attributed, and neither is proven. Binance first said the incident “may involve” one compromised laptop, a service container and unauthorized withdrawals, with no evidence of a key leak. That was a preliminary finding, phrased as a possibility, and Teng now says investigators found breach points beyond the laptop, that the attacker erased its traces and that the EIP-7702 delegation skipped normal approval controls. He has not given the full sequence.

TRM says Binance “has yet to publish a root cause”. It notes that early signs pointed to phished authorizations on Ethereum, but that this does not explain the other chains. Its own assessment is that the attacker could direct Binance’s hot-wallet signing system across chains. The two are compatible if the container the laptop reached could request signatures. Binance has not said whether it could, and Teng’s line on approval controls does not settle it: a delegation that skipped those controls still needed a valid signature. Outside researchers disagree as well: Bitcoin.com News reports that some argue for a possible compromise of a “Binance 16” signing key, while researcher 0xQuit wrote: “It seems likely that they [the attacker] didn’t have the private keys.”

The timing also matters. TRM’s log of sweeps running until 23:56 UTC shows the drained Ethereum address stayed under the attacker’s control for hours after the first transfers, and a second wave hit Avalanche and Polygon wallets at 23:05 UTC, three hours after the first.

North Korea: the FBI names TraderTraitor, after TRM and Chainalysis; Binance names no one

The FBI said on X at 22:36 UTC on Saturday 31 October, securities.io reports, that North Korea was responsible for the theft of more than $6 billion from Binance, and it calls the activity TraderTraitor. With the US Secret Service and IRS Criminal Investigation it urges private firms, THORNode and RPC node operators among them, to “block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets”, as quoted by CoinDesk, which counts over 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address on the list. The FBI expects “further laundering”, Reuters reports. The FBI’s own page refused our connection, so all of this comes from those outlets.

TRM attributes the attack “with high confidence” to TraderTraitor, which it calls North Korea’s premier hacking unit, citing on-chain and off-chain intelligence. It points to the pattern it saw in the Bybit and KelpDAO (April 2026) hacks: an operator wallet funded through Tornado Cash, staging well ahead of time, signatures collected in advance and fired in one burst. TRM notes that the FBI named the same group for the Bybit hack in February 2025, and that the laundering this time relies more on large swaps and lending than on bridges.

Binance has not named the attacker, and Teng wrote: “Our investigation has not attributed responsibility to any individual.” That was on Friday, and Binance’s two later updates name no one either. Before Saturday’s statement the FBI had told Reuters only that it was aware of the incident. President Donald Trump, asked on Friday whether North Korean hackers were behind it, said he did not know; on Saturday he said “we’re learning about it” and that his administration would “talk to North Korea about it”, CoinDesk reports. Blockaid’s chief executive said the operation resembles ones linked to North Korea but that attribution is unconfirmed. Chainalysis has since reached the same view: its investigators assess the hack “to be the work of North Korean cybercrime group TraderTraitor”, citing on-chain behaviour and stolen funds mixing with money from last month’s Bitget exploit. Chainalysis co-founder Jonathan Levin, as reported by Cointelegraph, said the group was likely responsible. ZachXBT tied the attack to the same Bitget exploit: “This indicates the same actor is likely behind both incidents.” Until Saturday these were the assessments of private firms and an independent investigator; the FBI statement is the first government attribution we have read. Reuters adds that North Korea denies using state-linked cyber units for financial theft, and that its mission in Geneva and its embassy in China did not respond to requests for comment. The US Treasury sanctioned a North Korean IT worker network two days earlier, which we covered in our report on the OFAC action; nothing so far links that network to this theft.

Elliptic was more cautious than TRM or Chainalysis until the FBI spoke. Its page, updated at 23:55 UTC on Saturday, records the attribution and says it had assessed TraderTraitor as the likely perpetrator. It points to the coordination of an attack across 11 blockchains in around three hours, to services shared with those laundering funds from three earlier TraderTraitor thefts, and to methods that resemble Bybit. Chainalysis expects the laundering to spread: “thousands of addresses” already and “tens of thousands” in the coming weeks, it told CoinDesk, well beyond the list the FBI published.

Can Binance cover the gap? What its reserves show

Binance has now given a number. Its reserve of more than $6.34 billion is about the size of its own $6.3 billion estimate of the damage, and it does not count the roughly $3 billion frozen. That replaces the morning’s arithmetic, in which FinanceFeeds took the frozen funds off the total and left about $3.3 billion to cover. CoinDesk said on Friday that SAFU held around $1 billion in bitcoin; half of the 15,000 BTC at the address given for the fund left it on Saturday. Binance has since named SAFU, corporate treasury and the futures insurance fund as sources, without the amount from each, and has not said what happens to frozen tokens if they come back.

CoinDesk’s reading of Binance’s reserve data adds a second question. The Binance 14 wallet appears in the 1 October proof of reserves. On that date Binance held exactly enough ETH to cover customer balances (100%) and 108.26% of USDC. If the stolen ETH is not recovered, CoinDesk estimates ETH backing falls to near 94%, and USDC and some altcoins may drop below 100%. That is CoinDesk’s calculation, not Binance’s; Binance did not immediately respond to CoinDesk. By Binance’s account, the token purchases are meant to close that gap. Its 31 October snapshot shows 100% or more for ETH, USDC and eight other assets, CoinDesk reports; those are Binance’s own figures, not independently verified, and we found no comparison by CoinDesk with its Friday estimate.

Teng’s video statement bears on the same point. He said the attack targeted Binance’s own hot wallet, not customer funds, according to CoinDesk, and TokenPost reports him saying that most customer funds sit in cold wallets and move to hot wallets only on withdrawal requests. CoinDesk, for its part, found Binance 14 in the 1 October proof of reserves, among the assets backing customer balances. We found no Binance reply to that reading and take no side between the two; the full proof, which Binance estimates by Tuesday 3 November, should give more.

A different account of the money came from Binance’s leaders on X, in a row with Elon Musk that we found only in Decrypt. Musk replied with a grimacing emoji to a post estimating Binance’s loss at about $1 billion given the frozen funds; Decrypt read it as a nod to FTX, but Musk wrote no words. Changpeng Zhao answered: “Elon, have a lot of respect for you, but bad time to troll. Please stop.” He added that Binance’s SPCX shares, from its $500 million investment in the Twitter takeover, are “worth more than a billion”. That is his own valuation, unverified: Decrypt gives no price source and we could not check it. Yi He said the year’s revenue covers the losses, so the shares need not be sold yet, and Decrypt reports that Zhao then clarified he had never suggested selling them. None of this is an outside check of the $6.34 billion reserve.

Prices fell overnight. Around 05:55 UTC on 30 October, BTC traded near $78,600, ETH near $2,246 and BNB near $717, down 5.1% over 24 hours, according to Coindaro’s market snapshot. CoinDesk reported, citing people familiar with the matter, that institutional investors were pulling funds from centralized exchanges to rebalance; the total is not known. Around 17:45 UTC, Coindaro’s snapshot had BTC around $77,190 (down 4.37% over 24 hours), ETH around $2,242 (down 3.95%), BNB around $702 (down 5.76%) and SOL around $94.39 (down 6.44%). Bitcoin Magazine counts about $1.5 billion of liquidations, mostly longs, with $468 million in BTC and $358 million in ETH; a CoinDesk headline gives $1.57 billion, and we cannot say which counter is closer. Standard Chartered’s Geoffrey Kendrick said, via Bitcoin Magazine, that the fall “may have some way to go”, and expects a new base once assets are unfrozen. That is his opinion.

Bigger than Bybit: the record crypto hacks compared

TRM puts the Binance theft at roughly four times Bybit’s. For Binance itself, the previous large loss dates from 2019, when it first used the “funds are SAFU” line.

Two differences stand out. Bybit kept withdrawals open after its hack; Binance closed them. In 2019 Binance’s withdrawals stayed shut for about a week. The 18,270 BTC taken this time is more than 2.5 times the 7,000 BTC of 2019, CoinDesk notes. Our explainer on where crypto hacks really happen shows why: blockchains themselves rarely break, the companies and keys around them do.

France and Italy: Binance had already stopped crypto services on 1 July

For European readers, the context differs. Without a MiCA authorisation, Binance’s French entity stopped offering crypto-asset services in France from 1 July 2026 and took no new clients, Euronews reported on 25 June, adding that similar notices went to users in other EU markets. MoneyVox listed the options left to French users: move their coins to a licensed platform, keep them in self-custody, or sell them for euros. For Italy, Teleborsa reported the same day that new orders and deposits would stop on 1 July while withdrawals would stay possible. Binance withdrew its MiCA application in Greece before the 30 June deadline and said it would apply in another EU state.

A French or Italian user who still had a balance on Binance therefore had it on a platform without MiCA authorisation in the EU, and the hack hits the global Binance platform. We found no statement on the incident from France’s AMF, Italy’s Consob or OAM, or the Banca d’Italia as of about 17:45 UTC on 30 October. Normal tax rules on crypto disposals apply in both countries; no hack-specific rule has been announced. TokenPost’s report of restored US dollar withdrawals does not mention the euro.

What Binance users should do now

According to Binance, user funds are safe and it will cover all losses, with more than $6.34 billion set aside. That is Binance’s commitment, not an outside guarantee, and it is the only one on the table. A few practical steps follow from the facts, without any view on trading.

• Check Binance’s official channels on deposits before sending new funds: its Sunday update says they stay open, but its messages on deposits changed between 02:25 and 04:17 UTC on 30 October.
• Expect fake “compensation” and “withdrawal unlock” messages: a platform with more than 335 million registered users, as Reuters reports, is a large target. Use only binance.com and Binance’s verified accounts, and never give a seed phrase or pay a “verification” fee.
• Treat unsolicited recovery offers with suspicion: Chainalysis warns that scammers are impersonating it, including with fund-recovery offers, Bitcoin Magazine reports.
• Check the withdrawal page or the network status page for your coin and network before acting on any report that withdrawals are open: at our 12:07 UTC check on Monday only 14 of 991 coins had them on, USDT on Tron showed off, and a first attempt may fail. Reports that US dollar withdrawals are back give no rails or limits, so check what your own account shows. The next date is the full proof of reserves, which Binance estimates by Tuesday 3 November.
• Remember that coins left on an exchange are a claim on that company. Keeping keys yourself, or splitting holdings across providers, are the usual precautions.

Our Binance review will be updated once the post-mortem is out.

What is still unknown, and the dates to watch

The root cause is not established. The laptop is now only part of the picture: Teng says investigators found breach points beyond it, and Binance now states the mechanism on Ethereum, an EIP-7702 delegation that skipped normal approval controls. What it has not explained is how that authorization was produced, or how valid signatures appeared on ten chains. Investigators have not established the full sequence, and by Teng’s account the attacker destroyed its tools and traces. Binance promised further technical findings within about 48 hours of its Friday evening update, about 19:33 UTC on Sunday by our count; none of the reports we read on Monday mentions them, and we could not read Binance’s announcement pages. The post-mortem that follows still has no date.

The final loss is also unknown. It depends on whether the issuers return frozen tokens, and on what happens to the 18,270 BTC and the ether still in the attacker’s hands (more than 420,000 ETH for TRM, 508,621 ETH for Bitquery, 519,104 ETH for Elliptic on Saturday). Whether customer assets are fully backed is still Binance’s word: its snapshot says so for ten assets, and the full proof should give figures to set beside Teng’s statement that customer funds were not hit and CoinDesk’s reading of the 1 October list. Whether Binance Wallet or Binance Pay were affected has not been stated anywhere we read. Abu Dhabi’s Financial Services Regulatory Authority, which issued Binance’s main operating licence, told Reuters it was “engaging closely with Binance and monitoring the incident”. We found no comment from a European regulator as of about 17:45 UTC on Friday. A CoinDesk comparison published on Monday gives the wider reason a theft like this is hard to contain: banks can recall some transfers, while confirmed blockchain transactions generally cannot be reversed. “Crypto doesn’t get hacked more than banks. It just can’t hide it, and it can’t undo it,” Abdul Rafay Gadit, co-founder of ZIG Finance, told the outlet.

The next checkpoints are the networks and coins still under test, and any date for phase two; the further technical findings, due about 19:33 UTC on Sunday by our count and absent from the reports we read; the full zero-knowledge proof, which Binance estimates by Tuesday 3 November; the RSR purchase, which Reserve expected to be finished by Monday; the last 5% of the tokens and Yi He’s promised update once the purchases are complete; the return of SAFU to about $1 billion, and what becomes of the 7,500 BTC at the receiving address; any outside check of Binance’s figures; any word from Binance or Ethena on the ENA transfer; the Aave loan; the first coins to reach a service from the 19 bitcoin wallets, which had not moved at Elliptic’s 08:45 UTC cut-off on Monday; where the XRP in the six new addresses goes; any further exchange freezes after the one Gate reports; and whether firms on the FBI’s list of addressees act on its request.

Earlier updates to this article

Kept as published: each one reflects what we knew at its stamp.

Update, 1 November 2026, 17:52 UTC: All 15 networks of phase one had reopened by 12:36 UTC, Binance says, and between 06:00 and 15:30 UTC on Sunday it counted $4.649 billion of withdrawals against $1.01 billion of deposits, a net outflow of about $3.64 billion, as reported by Bitcoin.com News and The Block. Our own check of Binance’s status data at 17:40 UTC shows those 15 networks on, for 15 of the 990 coins listed. CryptoSlate, citing Bitquery, puts the cost of the hackers’ rushed swaps at about $119 million, a price-impact estimate we have not checked, and The Defiant, citing Chainalysis, reports that the launderers have reached Solana. Bitcoin.com News and The Block also give Monday 2 November for an updated reserves report, against Tuesday 3 November for the full proof in Binance’s Saturday update.

Update, 1 November 2026, 11:57 UTC: Binance has reopened withdrawals in part. TokenPost counted seven of the 15 phase-one networks at 10:28 UTC, each with some assets open (Bitcoin, Ethereum, BNB Smart Chain, XRP Ledger, Base, Dogecoin and Optimism), and CoinDesk names bitcoin, ether, USDT, USDC, BNB and XRP. Money is leaving, on secondary data that do not agree: ChainCatcher cites $1.02 billion of net outflows on CoinMarketCap’s chart, period unstated, while TokenPost, naming no provider, gives about $1.26 billion over 24 hours, a window that opens before the first network did; we have not confirmed a named customer withdrawal. Elliptic says the laundering of the stolen funds on Tron runs like a timer, and Lookonchain alone links a wallet to a sale of about $5 million of PROM that fetched about $71.

Update, 1 November 2026, 06:03 UTC: The FBI said on Saturday evening that North Korea was responsible for the theft, naming TraderTraitor, according to CoinDesk and Reuters. In Recovery Update #4, published at 04:08 UTC on Sunday, Binance said phase one of withdrawals would start between 06:00 and 09:00 UTC on 15 networks, and that it has covered about 95% of the stolen amount. Binance’s public network status data first showed BTC withdrawals on, on the Bitcoin network, at 06:02 UTC; at 06:03 UTC that was the only coin and network on, and we have not confirmed a completed customer withdrawal. Binance’s date for the full proof of reserves is Tuesday 3 November, set in its Saturday update; Sunday’s update adds no new date.

Update, 31 October 2026, 17:58 UTC: Binance says it has replaced about 90% of the stolen assets, up from about 80% on Friday, using corporate treasury, part of its SAFU fund and part of its futures insurance fund, CoinDesk and Cointelegraph report from its latest statement on X, which we could not open. It also published a reserves snapshot taken at midnight UTC on 31 October and says withdrawals remain on track for Sunday 1 November. The public ledger shows 7,499 BTC leaving the address given for its SAFU fund at 14:51 UTC, without showing why. Everything else here is Binance’s own account, not independently verified.

Update, 31 October 2026, 12:06 UTC: Lookonchain counted 128.63 million ENA, about $24 million, moving from Ethena-labelled wallets to a Binance deposit address over eight hours on Saturday, Bitcoin.com News reported; we found no comment from Binance or Ethena. Reserve says Binance confirmed it will repurchase 3.38 billion RSR, the amount taken in the attack; that is Reserve’s account, not a Binance statement. Coindaro’s own reading, not any source’s: purchases of this kind, if that is what the ENA transfer was, replenish what Binance holds against customer balances and do not recover the stolen coins. As of about 12:00 UTC on Saturday we had found no published result of the snapshot planned for about 07:30 UTC, and no Update #3; we cannot say that the snapshot took place, or that it failed.

Update, 31 October 2026, 06:03 UTC: In its Security Incident Update #2, posted on X at about 19:33 UTC on Friday and reported by Reuters and Bitcoin.com News, Binance targets a phased withdrawal restart in about 34 hours, which CryptoNews works out as about 05:30 UTC on Sunday 1 November, subject to security checks. It plans a first proof-of-reserves snapshot within 12 hours, about 07:30 UTC on Saturday, with results by Monday 2 November; we had not seen that snapshot, or any Update #3, at the time of this stamp. Binance repeats that it has found “no evidence that wallet private keys were leaked”. Elliptic, in a page last updated at 19:30 UTC on Friday, estimates that the attacker controls about $3.23 billion no issuer can freeze, and thinks the suspected North Korea link likely, “although the attribution is not yet certain”.

Update, 30 October 2026, 18:00 UTC: Co-CEO Richard Teng said in a video on X, logged by Cointelegraph at 14:34 UTC, that the attacker used a “self-destruct mechanism” to destroy its tools and traces, and that the EIP-7702 delegation over a hot wallet “did not pass through our normal approval controls”. He aims to restart withdrawals within 40 hours, which means Sunday 1 November if the rebuilt service passes testing, and promises a full proof of reserves by Monday 2 November. Teng says the attack targeted Binance’s own hot wallet, not customer funds, while CoinDesk’s reading of the 1 October proof of reserves lists that wallet among the assets backing customer balances. A Binance spokesperson told Cointelegraph that the $5 billion in matching tokens is “held in the exchange’s custody” but gave no wallet addresses, so there is still no outside check.

Update, 30 October 2026, 12:00 UTC: Binance said on Friday it has set aside more than $6.34 billion in company funds to cover the losses, according to Reuters and Cointelegraph, about $5 billion of it already held in the affected tokens and all of it separate from the roughly $3 billion frozen. It also reported “additional points of breach” beyond the engineer’s laptop, and co-CEO Richard Teng said the attack was not a single “one-click” action. Chainalysis attributes the hack to TraderTraitor in its own post and counts about $2.8 billion frozen, while Lookonchain counts about $158 million of altcoins swapped into ETH. Withdrawals were still paused at about 12:00 UTC, when Binance’s count stood at 45 hours.