Attack reconstruction

A reconstruction of the attack in stages, built only from approved claims and approved timeline rows. Each line is one party's statement with its quote and source. Where parties disagree about time or mechanism, both are shown and nothing is reconciled.

How to read this page. The stage headings are fixed. Which stage a claim appears under is chosen by keywords in the claim's one-line summary, so a claim can sit under a stage a reader would not have chosen. It is a reading aid, not a finding. A claim appears under one stage only.

All times are UTC unless a source gave another zone, which is converted only where the source states the zone. A time taken from a live blog is when the entry was posted. A date with no time of day is shown as a day and is not placed on the minute index. Times from different sources are not averaged.

178 approved claims placed under a stage, 73 items on the minute index, 9 flagged conflicts, 10 open questions.

Minute by minute

Initial access

What sources say about how the attacker first reached the systems involved, and any preparation they describe before the first transfer.

2026-10-29 (date only)
Reported root cause
TRM Labs stated that the attacker deployed code and tested it on wallets early on October 29 before installing it on a Binance hot wallet four hours later.
Quoted text
“Early on October 29, the operator deployed a first piece of code for the attack and tested it on two wallets,” TRM says. “Later that day, it rehearsed the final version on a third wallet, then routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.”
Reviewer note: TRM account relayed by WIRED. Event time 00:00 UTC on 29 Oct is a date-only placeholder (source says early on October 29, no clock time).
TRM Labs, WIRED. Original Statement 379 Captured 2026-11-01 12:48 UTC.
2026-10-29 13:51 UTC
Reported root cause
Halborn said that at 13:51 on 29 October the attacker ran a rehearsal on a test wallet delegated with three authorizations at nonces 0, 1 and 2, of which exactly one applied.
Quoted text
At 13:51 they ran a rehearsal that is worth a second look: a test wallet delegated with three authorizations at nonces 0, 1 and 2, of which exactly one applied.
Halborn. Original Statement 772 Captured 2026-11-01 14:21 UTC.
2026-10-29 15:59 UTC
Reported root cause
Halborn said the final contract went live at 15:59 on 29 October and that a second rehearsal exercised the sweep path three times between 16:25 and 16:47.
Quoted text
The final contract went live at 15:59, a second rehearsal exercised the sweep path three times between 16:25 and 16:47, and the test funds were routed back.
Halborn. Original Statement 773 Captured 2026-11-01 14:21 UTC.
2026-10-29 20:32 UTC
Reported amount
Spreek posted on X, labelling it unconfirmed, that an entire Binance wallet had been drained into a new EOA and that the contract call was funded by Tornado Cash.
Quoted text
Unconfirmed, but possibly massive binance hack. Entire Binance wallet drained into new EOA. Contract call was funded by Tornado Cash
Spreek, X. Original Statement 780 Captured 2026-11-01 14:48 UTC.
2026-10-30 (date only)
Reported root cause
Binance co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malicious software designed to delete evidence.
Quoted text
Binance's other co-CEO, Richard Teng, said in a post on X that the breach was a "complex attack" that was not carried out by one person and included a compromised laptop as well as malicious software designed to delete evidence of its activity as it went along, "making it more difficult for us to trace and investigate."
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Richard Teng, Yahoo Finance. Original Statement 212 Captured 2026-11-01 12:48 UTC.
2026-10-30 02:23 UTC
Reported root cause
Binance's update of 02:23 UTC on October 30 stated that its initial investigation suggests the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.
Quoted text
Binance's update of 02:23 UTC, Oct 30 , says its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," and that it has "found no evidence of any wallet private key leak."
Binance, Hacken. Original Statement 24 Captured 2026-11-01 12:47 UTC.
2026-10-30 02:23 UTC
Official root cause
Binance said in its first 30 October update that its initial investigation suggested a compromised DevOps engineer's laptop may have let an attacker reach a service container and submit unauthorized withdrawals.
Quoted text
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.
Binance, Binance. Original Statement 280 Captured 2026-11-01 13:11 UTC.
2026-10-30 14:34 UTC
Reported root cause
Cointelegraph reported that Richard Teng said the attacker used a self-destruct mechanism to destroy tools and traces, complicating the investigation.
Quoted text
Teng also disclosed that the attacker used a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation.
Richard Teng, Cointelegraph. Original Statement 340 Captured 2026-11-01 12:52 UTC.

No time stated

No time stated
Reported root cause
Blockaid said the operator address 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 was funded through three Tornado Cash withdrawals starting October 28.
Quoted text
The operator address, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , was funded through three Tornado Cash withdrawals starting October 28.
blockaid.io. Original Statement 105 Captured 2026-11-01 12:47 UTC.
No time stated
Reported other
Cointelegraph reported that blockchain researcher Spreek first raised concerns, posting on X that assets from a Binance-linked Ethereum wallet had been moved to a newly created address through a contract call allegedly funded by Tornado Cash.
Quoted text
Concerns were first raised by blockchain researcher Spreek, who posted on X that assets from a Binance-linked Ethereum wallet had been transferred to a newly created address through a contract call allegedly funded by Tornado Cash.
Spreek, Cointelegraph. Original Statement 112 Captured 2026-11-01 12:52 UTC.
No time stated
Reported root cause
TRM Labs said preparation began at least 36 hours before the theft, with the operator wallet receiving three small Tornado Cash withdrawals from the morning of 28 October.
Quoted text
Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.
TRM Labs, TRM Labs. Original Statement 301 Captured 2026-11-01 12:48 UTC.
No time stated
Reported root causesays something is unexplained
TRM Labs said early indicators suggested the attacker had phished the Ethereum authorizations, but that this leaves the other chains unexplained.
Quoted text
Early indicators on the Ethereum activity suggested the attacker had phished the authorizations. That explanation covers Ethereum and leaves the other chains unexplained.
TRM Labs, TRM Labs. Original Statement 303 Captured 2026-11-01 12:48 UTC.
No time stated
Reported root cause
Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Quoted text
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Hacken. Original Statement 325 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
Tom Robinson of Elliptic stated that Binance says the attack began with a compromised engineer's laptop, which is a hallmark of TraderTraitor.
Quoted text
“Binance says the attack began with a compromised engineer’s laptop. Targeting crypto company staff is a TraderTraitor hallmark,” Elliptic’s Robinson says.
Reviewer note: Robinson (Elliptic) relaying Binance first-update laptop hypothesis and his own TraderTraitor comparison; quote says targeting staff is the hallmark.
Tom Robinson, WIRED. Original Statement 382 Captured 2026-11-01 12:48 UTC.
No time stated
Reported root cause
Immunefi Vice President Simone Imbrescia stated that the sweeper contract used in the hack was only around 130 lines and that simple code can be devastating if access is powerful enough.
Quoted text
The sweeper contract was only around 130 lines, Immunefi Vice President Simone Imbrescia said in a statement shared with The Block. "The hard part sometimes is getting access to a system powerful enough to make very simple code devastating," Imbrescia said.
Reviewer note: Immunefi VP Simone Imbrescia, statement shared with The Block.
Simone Imbrescia, The Block. Original Statement 529 Captured 2026-11-01 13:01 UTC.
No time stated
Reported root cause
CFTC Chairman Michael Selig characterized the attack as a vulnerability introduced from a laptop rather than a flaw in the blockchain.
Quoted text
Selig characterized the attack as a laptop-introduced vulnerability rather than a blockchain flaw—but Binance has since found “additional points of breach.”
Reviewer note: CFTC Chairman Michael Selig characterisation, with the article own caveat that Binance later reported additional breach points.
Decrypt. Original Statement 594 Captured 2026-11-01 13:02 UTC.
No time stated
Reported root causesays something is unexplained
Halborn said nothing public establishes how the laptop was infected, how long the attacker had access, the operating system or the malware.
Quoted text
Nothing public establishes the infection method, the dwell time, the operating system or the malware.
Halborn. Original Statement 754 Captured 2026-11-01 14:21 UTC.
No time stated
Reported root cause
Halborn said the operator wallet was funded from Tornado Cash starting the morning of 28 October, in three withdrawals of about 0.098 ETH from the 0.1 ETH pool.
Quoted text
The operator wallet was funded from Tornado Cash starting the morning of October 28, in three withdrawals of about 0.098 ETH from the 0.1 ETH pool.
Halborn. Original Statement 771 Captured 2026-11-01 14:21 UTC.

Internal movement

What sources say happened between that first foothold and the ability to move funds: which internal systems were reached and whether keys were involved.

2026-10-29 20:24 UTC
Reported root cause
Blockaid said the attacker first drained a Binance wallet it calls Binance 14 starting 20:24 UTC in a single transaction worth about $2.5B, minutes after Binance's own signing infrastructure, which it said was under the attacker's control, signed an EIP-7702 authorization delegating it to an attacker-deployed sweeper.
Quoted text
The attacker first drained Binance 14 starting 20:24 UTC in a single transaction worth about $2.5B, minutes after Binance’s own signing infrastructure, under the attacker’s control, signed an EIP-7702 authorization delegating it to an attacker-deployed sweeper.
blockaid.io. Original Statement 104 Captured 2026-11-01 12:47 UTC.
2026-10-30 (date only)
Reported root cause
Binance co-CEO Richard Teng said the attacker did not simply use one engineer's permissions and that it was not a single 'one-click' action.
Quoted text
co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action."
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Richard Teng, Hacken. Original Statement 25 Captured 2026-11-01 12:47 UTC.
2026-10-30 (date only)
Reported root cause
Richard Teng explained that hackers manipulated a transaction approval system to move money from a hot wallet without passing through normal controls.
Quoted text
The hackers were able to manipulate a system used to approve transactions to move money out of a Binance-controlled, internet-connected so-called "hot" wallet in a way that did not pass through normal approval controls, Teng said.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Richard Teng, Yahoo Finance. Original Statement 213 Captured 2026-11-01 12:48 UTC.
2026-10-30 00:26 UTC
Reported root cause
Cointelegraph quoted Blockaid CEO Ido Ben-Natan as describing a compromise of signing infrastructure and saying he did not think a key was leaked.
Quoted text
a compromise of signing infrastructure. We don’t think a key was leaked,” he said.
Ido Ben-Natan, Cointelegraph. Original Statement 475 Captured 2026-11-01 13:01 UTC.
2026-10-30 02:23 UTC
Official root cause
Binance said in its first 30 October update that it had found no evidence of any wallet private key leak.
Quoted text
We have found no evidence of any wallet private key leak.
Binance, Binance. Original Statement 281 Captured 2026-11-01 13:11 UTC.
2026-10-30 08:37 UTC
Reported root cause
Cointelegraph reported that Binance said its investigation had uncovered additional points of breach after initially pointing to a possibly compromised laptop, and that it remained on track to resume withdrawals in 45 hours.
Quoted text
Binance’s investigation into its $6.3 billion hack has uncovered “additional points of breach,” the exchange said , after initially pointing to a potentially compromised laptop. The exchange said it was still gathering facts in coordination with law enforcement. Binance said it remained on track to resume withdrawals in 45 hours, while deposits remained unaffected.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (8:37 am UTC), not a time stated by the speaker.
Binance, Cointelegraph. Original Statement 129 Captured 2026-11-01 12:52 UTC.
2026-10-30 11:00 UTC
Reported root cause
Cointelegraph quoted Blockaid CEO Ido Ben-Natan as saying the signer signed a transaction that it should not have.
Quoted text
“The takeaway is that ultimately the signer signed a transaction that they shouldn’t have,” he said.
Ido Ben-Natan, Cointelegraph. Original Statement 356 Captured 2026-11-01 12:52 UTC.
2026-10-30 14:34 UTC
Reported root cause
Cointelegraph reported that co-CEO Richard Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, and that the delegation did not pass through Binance's normal approval controls.
Quoted text
The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (2:34 pm UTC), not a time stated by the speaker.
Richard Teng, Cointelegraph. Original Statement 134 Captured 2026-11-01 12:52 UTC.
2026-10-30 19:33 UTC
Official root cause
Binance said in its second 30 October update that its later investigation had uncovered additional points of breach beyond a compromised laptop.
Quoted text
Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach.
Binance, Binance. Original Statement 284 Captured 2026-11-01 13:11 UTC.
2026-10-30 19:33 UTC
Official root cause
Binance repeated in its second 30 October update that it had found no evidence that wallet private keys were leaked.
Quoted text
At this stage, we have found no evidence that wallet private keys were leaked.
Binance, Binance. Original Statement 285 Captured 2026-11-01 13:11 UTC.

No time stated

No time stated
Reported root cause
Binance's initial investigation suggested an engineer's laptop was compromised, allowing access to unauthorised withdrawals, but a later update said they had uncovered additional points of breach.
Quoted text
Binance's initial investigation suggested an engineer's laptop was compromised, which allowed access to unauthorised withdrawals, but a later update said they had uncovered "additional points of breach".
Binance, BBC News. Original Statement 8 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
Richard Teng, Binance's co-chief executive officer, stated that the hack was carried out by more than one person using sophisticated methods to hide their tracks.
Quoted text
Richard Teng, Binance's co-chief executive officer, said the hack was carried out by more than one person, and the hackers used sophisticated methods to hide their tracks, such as a "self-destruct mechanism".
Richard Teng, BBC News. Original Statement 9 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
Binance stated that an initial investigation suggested the incident may have involved a compromised laptop, but a subsequent investigation uncovered additional points of breach.
Quoted text
The company said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach."
Binance, npr.org. Original Statement 44 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
Binance initially linked the breach to a compromised DevOps engineer's laptop but later stated it uncovered additional points of breach in a complex attack not carried out by one person.
Quoted text
Binance initially linked the breach to a compromised DevOps engineer's laptop, but now says it has uncovered additional points of breach in a complex attack that "was not carried out by one person".
Binance, Elliptic. Original Statement 56 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
TRM said that in its assessment the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Quoted text
In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
TRM Labs, TRM Labs. Original Statement 150 Captured 2026-11-01 12:48 UTC.
No time stated
Official root cause
Binance said in its Security Incident Update dated 2026-10-30 that its initial investigation suggested the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions, and that it had found no evidence of any wallet private key leak.
Quoted text
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.
Binance, Binance. Original Statement 161 Captured 2026-11-01 13:11 UTC.
No time stated
Official root cause
Binance said in its Security Incident Update #2 that its subsequent investigation had uncovered additional points of breach beyond a possibly compromised laptop, and that it had found no evidence that wallet private keys were leaked.
Quoted text
Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach. At this stage, we have found no evidence that wallet private keys were leaked.
Binance, Binance. Original Statement 171 Captured 2026-11-01 13:11 UTC.
No time stated
Reported root cause
Blockaid CEO Ido Ben-Natan stated that the attackers appeared to have compromised Binance’s transaction signing process.
Quoted text
Blockaid CEO Ido Ben-Natan said the attackers appeared to have compromised Binance’s transaction signing process. Binance said Friday that it had found no evidence of leaked wallet private keys, though its investigation remained ongoing.
Ido Ben-Natan, Cointelegraph. Original Statement 278 Captured 2026-11-01 12:52 UTC.
No time stated
Reported root cause
Elliptic reported that Richard Teng said in a video update that the attack was not carried out by one person.
Quoted text
Teng added that the attack "was not carried out by one person"
Reviewer note: Event time cleared 2026-11-01: the quote states no date or time for Teng's video update.
Elliptic, Elliptic. Original Statement 308 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root causesays something is unexplained
Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures.
Quoted text
Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.
Hacken. Original Statement 316 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
Hacken said Binance's statement that no private key leaked and investigators' view that Binance's signing system signed for the attacker can both be true.
Quoted text
Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.
Hacken. Original Statement 323 Captured 2026-11-01 12:47 UTC.
No time stated
Reported other
Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.
Quoted text
Cap value and rate per wallet at the signer and hold new destinations for a second approval
Hacken. Original Statement 324 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Quoted text
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Hacken. Original Statement 326 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
NPR reported that Kok Tin Gan of NyxLab said the event raises questions about why stronger approval controls were not in place.
Quoted text
The event, meanwhile, also raises questions about why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab.
Kok Tin Gan, npr.org. Original Statement 331 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
The BBC quoted Richard Teng as saying the attack was not carried out by one person.
Quoted text
This was not carried out by one person.
Richard Teng, BBC News. Original Statement 337 Captured 2026-11-01 13:11 UTC.
No time stated
Reported root cause
Ido Ben-Natan said attackers may have used a compromised developer’s computer to gain access to Binance’s wallet-signing infrastructure.
Quoted text
Ben-Natan said attackers may have used a compromised developer’s computer to gain access to Binance’s wallet-signing infrastructure.
Reviewer note: Blockaid CEO Ido Ben-Natan speculation as reported by Cointelegraph; Binance itself said its first update pointed to a DevOps engineer laptop.
Ido Ben-Natan, Cointelegraph. Original Statement 464 Captured 2026-11-01 12:52 UTC.
No time stated
Reported root causesays something is unexplained
Halborn said the only link in the attack chain Binance had confirmed so far was the first one, and that everything between the laptop and the signatures was still inference.
Quoted text
and the only link Binance has confirmed so far is the first one. Everything between the laptop and the signatures is still inference
Halborn. Original Statement 751 Captured 2026-11-01 14:21 UTC.
No time stated
Reported root causesays something is unexplained
Halborn said how access to a container became accepted financial instructions was the link nobody had explained.
Quoted text
Link two is the one nobody has explained: how access to a container became accepted financial instructions.
Halborn. Original Statement 752 Captured 2026-11-01 14:21 UTC.
No time stated
Reported root cause
Halborn listed five candidate paths from the container to accepted withdrawals, without saying which was used.
Quoted text
The candidate paths are misuse of that service identity, modification of withdrawal requests in flight, deployment of altered code under a stronger identity, manipulation of policy or approvals, or direct access to a signing interface.
Halborn. Original Statement 753 Captured 2026-11-01 14:21 UTC.
No time stated
Reported root cause
Halborn said nine other chains lost funds through correctly signed transfers, which it called the strongest evidence that the compromise sat in the signing path rather than in one wallet's key.
Quoted text
Nine other chains lost money through nothing more exotic than correctly signed transfers, and that is the strongest evidence that the compromise sat in the signing path rather than in one wallet's key.
Halborn. Original Statement 755 Captured 2026-11-01 14:21 UTC.
No time stated
Reported root cause
Halborn said that whether Binance's signing path signs raw digests or accepts EIP-7702 authorizations as a message type is inference, and that only Binance's signer request log can settle it.
Quoted text
So either Binance’s signing path signs raw digests, or it supports 7702 authorizations as a message type and nothing in front of it objected to fifty of them. Both are inference.
Halborn. Original Statement 757 Captured 2026-11-01 14:21 UTC.
No time stated
Reported root causesays something is unexplained
Halborn said Binance had confirmed the first two boxes of its attack-chain diagram and that the box in between was the one the post-mortem has to explain.
Quoted text
Binance has confirmed the first two boxes, the chain shows the last four, and the dashed box in between is the one the post-mortem has to explain.
Halborn. Original Statement 758 Captured 2026-11-01 14:21 UTC.
No time stated
Reported root cause
Halborn said the question that decides the root cause is which identity caused which component to authorize which bytes, and why that instruction passed, and that it cannot be answered from outside.
Quoted text
The question that decides the root cause is simple to state and impossible to answer from the outside: which identity caused which component to authorize which bytes, and why did that instruction pass?
Halborn. Original Statement 759 Captured 2026-11-01 14:21 UTC.

Withdrawal transactions

The transactions by which funds are said to have left the exchange wallets, and how each is said to have been authorised.

2026-10-29 (date only)
Reported root cause
The page states that eleven Binance hot-wallet keys signed transfers to an address created minutes earlier, and one signed an EIP-7702 authorization.
Quoted text
Eleven Binance hot-wallet keys signed transfers to an address created minutes earlier, and one of them signed an EIP-7702 authorization that turned its wallet into standing infrastructure for the attacker.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
blockaid.io. Original Statement 89 Captured 2026-11-01 12:47 UTC.
2026-10-29 (date only)
Reported amount
Hacken wrote that on the evening of 29 October 2026 an attacker emptied Binance hot wallets on 10 blockchains.
Quoted text
On the evening of 29 October 2026, an attacker emptied Binance hot wallets on 10 blockchains
Reviewer note: Date only: the quote says "On the evening of 29 October 2026". No clock time is stated, so 00:00 UTC is a placeholder. Re-authored 2026-11-01 with a fuller exact quote; replaces claim 399, whose quote did not hold the date the statement gave.
Hacken. Original Statement 914 Captured 2026-11-01 12:47 UTC.
2026-10-29 20:05 UTC
Official amount
Binance said in its Security Incident Update #2 that at around 20:05 UTC on 2026-10-29 its hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.
Timeline row: Binance said its hot wallets were compromised at around 20:05 UTC, a loss of about $6.3B
Quoted text
At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.
Reviewer note: Binance states the time as 'around 2026-10-29 20:05 (UTC)'.
Binance, Binance. Original Statement 167 Captured 2026-11-01 13:11 UTC.
2026-10-29 20:20 UTC
Reported root cause
TRM said the operator submitted a single Ethereum transaction at 20:20 UTC containing 50 authorizations signed by a Binance hot wallet, each pointing to a sweeper contract.
Quoted text
At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweeper contract that accepts instructions only from the operator.
TRM Labs, TRM Labs. Original Statement 141 Captured 2026-11-01 12:48 UTC.
2026-10-29 20:20 UTC
Reported amount
Chainalysis said funds began leaving Binance hot wallets around 4:20 p.m. ET on October 29, 2026, and that unauthorized transfers totaled approximately $6.4 billion.
Timeline row: Chainalysis said funds began leaving Binance hot wallets (stated as around 4:20 p.m. ET)
Quoted text
Around 4:20 p.m. ET on October 29, 2026, funds began leaving Binance hot wallets across multiple blockchains. Unauthorized transfers totaled approximately $6.4 billion, the largest theft in crypto history.
Reviewer note: Chainalysis states the time as 4:20 p.m. ET. Converted to UTC at UTC-4 (US daylight time was in effect on 29 October 2026).
Chainalysis, Chainalysis. Original Statement 189 Captured 2026-11-01 13:11 UTC.
2026-10-29 20:20 UTC
Reported other
Chainalysis said funds began leaving Binance hot wallets at around 4:20 p.m. ET on 29 October.
Quoted text
Around 4:20 p.m. ET on October 29, 2026, funds began leaving Binance hot wallets across multiple blockchains.
Chainalysis, Chainalysis. Original Statement 300 Captured 2026-11-01 13:11 UTC.
2026-10-29 20:20 UTC
Reported root cause
Blockaid said that at 20:20:59 UTC on October 29 the operator sent a transaction to the wallet it calls Binance 14 carrying 50 EIP-7702 authorizations signed with that wallet's key, each delegating the wallet to the sweeper.
Timeline row: Blockaid said the operator sent a transaction carrying 50 EIP-7702 authorizations to a Binance Ethereum hot wallet
Quoted text
At 20:20:59 the operator sent a type-4 transaction to Binance 14, 0x28C6c06298d514Db089934071355E5743bf21d60 , carrying 50 EIP-7702 authorizations signed with the Binance 14 key, one per nonce from 18,914,775 to 18,914,824, each delegating the wallet to the sweeper.
blockaid.io. Original Statement 106 Captured 2026-11-01 12:47 UTC.
2026-10-29 20:24 UTC
Reported amount
The page states that at 20:24 UTC, one transaction moved about $2.53B out of a single Ethereum wallet.
Timeline row: Hacken said one Ethereum transaction moved about $2.53B out of a single Binance wallet
Quoted text
Ethereum sits in the middle of this sequence: at 20:24, one transaction moved about $2.53B out of a single wallet.
Hacken. Original Statement 18 Captured 2026-11-01 12:47 UTC.
2026-10-29 20:24 UTC
Reported amount
Blockaid said that at 20:24:23 UTC on October 29 the operator called sweep on Binance 14, sending 167,464 ETH, 1.615B USDT and about 60 other tokens to a collection address with no prior history, a basket it valued at about $2.5B.
Quoted text
At 20:24:23, three minutes and 24 seconds later, the operator called sweep on Binance 14 (transaction ), sending 167,464 ETH, 1.615B USDT, and about 60 other tokens to a collection address with no prior history, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c . Binance 14 was left with 1 ETH. At prices at the time, the basket was worth about $2.5B.
blockaid.io. Original Statement 107 Captured 2026-11-01 12:47 UTC.
2026-10-29 20:24 UTC
Reported amount
Halborn said the operator called Binance 14 at 20:24:23, 3 minutes 24 seconds after the delegation, in block 26,300,770.
Quoted text
At 20:24:23 (3 minutes 24 seconds after the delegation), in block 26,300,770, the operator called Binance 14.
Halborn. Original Statement 760 Captured 2026-11-01 14:21 UTC.
2026-10-29 20:41 UTC
Reported amount
Blockaid said that at 20:41:23 UTC the operator used the still-delegated Binance 14 to move 780M USDC from a Circle smart account to the collection address, followed by another 43M USDC.
Timeline row: Blockaid said 780M USDC was moved from a Circle smart account linked to Binance
Quoted text
At 20:41:23 the operator used the still-delegated Binance 14, which owns the Circle smart account Binance Hot Wallet 34 , to move 780M USDC from that account to the collection address, followed by another 43M USDC.
blockaid.io. Original Statement 108 Captured 2026-11-01 12:47 UTC.
2026-10-29 21:44 UTC
Reported amount
Blockaid said that at 21:44 UTC the operator swept Binance 14 again for 200M USDT and 13 other tokens deposited since the first sweep.
Timeline row: Blockaid said the operator swept the still-delegated Binance wallet again for 200M USDT and 13 other tokens
Quoted text
At 21:44 it swept Binance 14 again for 200M USDT and 13 other tokens deposited since the first sweep.
blockaid.io. Original Statement 109 Captured 2026-11-01 12:47 UTC.
2026-10-30 (date only)
Reported amount
Cointelegraph quoted Senator Cynthia Lummis as saying hackers stole more than $6 billion from Binance in less than 4 hours.
Quoted text
Yesterday, hackers stole more than $6 billion from Binance in less than 4 hours, the biggest heist in history.
Reviewer note: Date only: the article says Lummis wrote this "in a Friday post on X"; Friday was 30 October 2026. No clock time is stated, so 00:00 UTC is a placeholder.
Cointelegraph. Original Statement 398 Captured 2026-11-01 12:52 UTC.
2026-10-30 00:10 UTC
Reported recovery
Hacken said the chain confirms Binance 14 signed a new authorization at 00:10:35 UTC on 30 October that reset its delegation, 3 hours 46 minutes after the sweep.
Timeline row: Hacken said Binance signed a new authorization resetting the delegation on its Ethereum wallet
Quoted text
at 00:10:35 UTC on 30 October, Binance 14 signed a new authorization that reset its delegation, 3 hours 46 minutes after the sweep.
Hacken. Original Statement 110 Captured 2026-11-01 12:47 UTC.
2026-10-30 00:10 UTC
Reported recovery
Halborn said the delegation on Binance 14 was cleared at 00:10:35 on 30 October, three hours and fifty minutes after it was installed.
Quoted text
The delegation was cleared at 00:10:35 on October 30, three hours and fifty minutes after it was installed.
Halborn. Original Statement 763 Captured 2026-11-01 14:21 UTC.
2026-10-30 11:00 UTC
Reported root cause
Cointelegraph reported that Blockaid CEO Ido Ben-Natan said attackers could have stolen the funds without EIP-7702.
Quoted text
Attackers could have stolen the funds without EIP-7702, Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph on Friday.
Ido Ben-Natan, Cointelegraph. Original Statement 352 Captured 2026-11-01 12:52 UTC.
2026-10-30 11:00 UTC
Reported root cause
Cointelegraph quoted Ido Ben-Natan of Blockaid as saying the 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some checks.
Quoted text
“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,”
Ido Ben-Natan, Cointelegraph. Original Statement 353 Captured 2026-11-01 12:52 UTC.
2026-10-30 11:00 UTC
Reported root cause
Cointelegraph reported that Ethereum community member VEER said EIP-7702 gave attackers a handy sweep button on Ethereum.
Quoted text
VEER later said the Binance attack appeared broader than a single malicious signature, but that EIP-7702 gave attackers “a handy sweep button on Ethereum.”
Cointelegraph. Original Statement 354 Captured 2026-11-01 12:52 UTC.
2026-10-30 11:00 UTC
Reported root cause
Cointelegraph reported that Ambire CEO Ivo Georgiev said EIP-7702 made little difference because the hackers already had the ability to authorize transactions.
Quoted text
Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said that EIP-7702 made little difference to the attack because the hackers already had the ability to authorize transactions.
Ivo Georgiev, Cointelegraph. Original Statement 355 Captured 2026-11-01 12:52 UTC.

No time stated

No time stated
Reported amount
TRM stated that an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes.
Quoted text
"An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM said.
TRM Labs, npr.org. Original Statement 46 Captured 2026-11-01 12:47 UTC.
No time stated
Reported amount
TRM said an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains on October 29, 2026, most of it in about 20 minutes starting at 20:05 UTC.
Quoted text
On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC.
TRM Labs, TRM Labs. Original Statement 136 Captured 2026-11-01 12:48 UTC.
No time stated
Reported amount
TRM said that three minutes and 24 seconds after the delegation the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address, moving 167,464 ETH and 63 tokens including 1.615 billion USDT in one transaction.
Quoted text
Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
TRM Labs, TRM Labs. Original Statement 142 Captured 2026-11-01 12:48 UTC.
No time stated
Reported amount
Chainalysis said unauthorized transfers totaled approximately $6.4 billion.
Quoted text
Unauthorized transfers totaled approximately $6.4 billion, the largest theft in crypto history.
Chainalysis, Chainalysis. Original Statement 298 Captured 2026-11-01 13:11 UTC.
No time stated
Reported amount
Elliptic said the attacker drained Binance hot wallets across 11 blockchains over a few hours.
Quoted text
Over the course of a few hours, the attacker drained Binance hot wallets across 11 blockchains.
Elliptic, Elliptic. Original Statement 309 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
Hacken said that at Binance the EIP-7702 delegation stayed in place for 3 hours 46 minutes after the sweep and later deposits were swept again.
Quoted text
At Binance the delegation stayed for 3 hours 46 minutes after the sweep and later deposits were swept again
Hacken. Original Statement 317 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
Blockaid said the EIP-7702 delegation was visible on-chain for three minutes and 24 seconds before the sweep.
Quoted text
The delegation itself was visible onchain for three minutes and 24 seconds before the sweep
blockaid.io. Original Statement 327 Captured 2026-11-01 12:47 UTC.
No time stated
Reported root cause
Blockaid said its transaction security engine classified the delegation transaction as malicious because an EOA was being upgraded through EIP-7702 to an untrusted address.
Quoted text
Blockaid's transaction security engine classified the type-4 transaction that delegated Binance 14 as malicious on sight, with the reason that an EOA was being upgraded through EIP-7702 to an untrusted address.
blockaid.io. Original Statement 329 Captured 2026-11-01 12:47 UTC.
No time stated
Reported amount
WIRED reported, citing TRM Labs, that the majority of the stolen crypto was taken in around 20 minutes on 29 October.
Quoted text
The majority of the stolen crypto was taken in a period of around 20 minutes on October 29, according to analysis by crypto tracing firm TRM Labs.
WIRED. Original Statement 332 Captured 2026-11-01 12:48 UTC.
No time stated
Reported root cause
TRM Labs said that on the nine chains other than Ethereum, Binance wallets sent funds to the attacker through ordinary signed transfers.
Quoted text
Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.
TRM Labs, TRM Labs. Original Statement 458 Captured 2026-11-01 12:48 UTC.
No time stated
Reported root cause
Ivo Georgiev warned that exchange engineers might overlook the need to revoke a malicious EIP-7702 delegation after regaining control of their systems.
Quoted text
He said attackers could have drained the funds through other methods, but warned that exchange engineers might overlook the need to revoke a malicious EIP-7702 delegation after regaining control of their systems.
Reviewer note: Ambire CEO Ivo Georgiev as reported by Cointelegraph.
Ivo Georgiev, Cointelegraph. Original Statement 466 Captured 2026-11-01 12:52 UTC.
No time stated
Reported root cause
Halborn said, as its own inference, that fifty pre-signed EIP-7702 authorizations suggest someone who could get the key to sign digests but could not control when, how fast or how many times.
Quoted text
An attacker holding the raw key would sign one authorization at submission time. Fifty pre-signed ones suggest someone who could get the key to sign digests but could not control when, how fast, or how many times.
Halborn. Original Statement 756 Captured 2026-11-01 14:21 UTC.
No time stated
Reported amount
Halborn said a second Ethereum hot wallet, Binance 16, signed nine ordinary transfers to the attacker worth about $174 million with no delegation involved.
Quoted text
Binance 16, the second Ethereum hot wallet, signed nine ordinary transfers to the attacker worth about $174 million, with no delegation at all.
Halborn. Original Statement 761 Captured 2026-11-01 14:21 UTC.
No time stated
Reported root cause
Halborn gave its own reading of why EIP-7702 was used on Binance 14 when plain signed withdrawals were available: persistence and independence.
Quoted text
My reading is persistence and independence. One signature bought unlimited, policy-free control of the largest wallet until someone revoked it, with no further requests through a compromised path that could be cut at any moment.
Halborn. Original Statement 762 Captured 2026-11-01 14:21 UTC.
No time stated
Reported root cause
Halborn offered two readings of the 23:05 second wave: the transfers were signed earlier and held back, or the attacker's access outlived the withdrawal pause.
Quoted text
Either those transfers were signed earlier and held back, or the attacker's access outlived the pause.
Halborn. Original Statement 769 Captured 2026-11-01 14:21 UTC.

Per-chain draining

Statements about individual blockchains, grouped under each chain the statement names.

Ethereum

No time stated
Reported amount
Cointelegraph reported that Blockaid said it had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.
Quoted text
Blockchain security firm Blockaid said its team had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.
Cointelegraph. Original Statement 117 Captured 2026-11-01 12:52 UTC.

Bitcoin

2026-10-29 20:20 UTC
Reported amount
The page states that at 20:20 UTC, a Bitcoin hot wallet sent out 18,270 BTC.
Quoted text
At 20:20 a Bitcoin hot wallet sent out 18,270 BTC, and a Tron wallet sent more than 600 million USDT right after that.
Hacken. Original Statement 17 Captured 2026-11-01 12:47 UTC.
2026-10-29 20:20 UTC
Reported amount
TRM said a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address at 20:20 UTC, and that the funds began splitting into round pieces inside the same block.
Timeline row: TRM said a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address
Quoted text
At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address, which began splitting the funds into round 1,000 BTC and 100 BTC pieces inside the same block.
TRM Labs, TRM Labs. Original Statement 140 Captured 2026-11-01 12:48 UTC.

XRP Ledger

2026-10-29 20:05 UTC
Reported amount
The page states that the first transfers occurred at 20:05 UTC on the XRP Ledger, where five Binance wallets sent 233 million XRP to a single address.
Quoted text
The first transfers came at 20:05 UTC on the XRP Ledger, where five Binance wallets sent 233 million XRP to a single address.
Hacken. Original Statement 16 Captured 2026-11-01 12:47 UTC.
2026-10-29 20:05 UTC
Reported amount
TRM said that between 20:05 and 20:09 UTC five Binance wallets on the XRP Ledger sent 233.46 million XRP to a single attacker address.
Timeline row: TRM said five Binance wallets on the XRP Ledger sent 233.46M XRP to one address between 20:05 and 20:09
Quoted text
Between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP to a single attacker address, leaving each wallet with only its minimum balance.
TRM Labs, TRM Labs. Original Statement 139 Captured 2026-11-01 12:48 UTC.

Solana

No time stated
Reported root cause
Halborn said Bitquery notes the XRP and Solana drains share no address with the rest of the operation and are tied to it only by timing and transaction construction, a tie Halborn accepted with that caveat.
Quoted text
Bitquery notes that the XRP and Solana drains share no address with the rest of the operation and are tied to it only by timing and transaction construction
Halborn. Original Statement 770 Captured 2026-11-01 14:21 UTC.

Arbitrum

No time stated
Reported amount
Cointelegraph reported that Blockaid said it had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.
Quoted text
Blockchain security firm Blockaid said its team had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.
Cointelegraph. Original Statement 117 Captured 2026-11-01 12:52 UTC.

Avalanche

2026-10-29 23:05 UTC
Reported amount
TRM said a second wave around 23:05 UTC reached Binance wallets on Avalanche and Polygon.
Timeline row: TRM said a second wave of transfers reached Binance wallets on Avalanche and Polygon
Quoted text
A second wave around 23:05 UTC reached Binance wallets on Avalanche and Polygon.
TRM Labs, TRM Labs. Original Statement 149 Captured 2026-11-01 12:48 UTC.
2026-10-29 23:05 UTC
Reported amount
Hacken's timeline table lists a second wave of transfers from Binance wallets on Avalanche and Polygon at 23:05 UTC.
Quoted text
23:05 | Second wave: Binance wallets on Avalanche and Polygon send funds.
Hacken. Original Statement 156 Captured 2026-11-01 12:47 UTC.
No time stated
Reported amount
Cointelegraph reported that Blockaid said it had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.
Quoted text
Blockchain security firm Blockaid said its team had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.
Cointelegraph. Original Statement 117 Captured 2026-11-01 12:52 UTC.
No time stated
Reported amount
Hacken said most of the money left in about 20 minutes, with a smaller second wave on Avalanche and Polygon around 23:05 UTC.
Quoted text
Most of the money left in about 20 minutes, and a smaller second wave hit Avalanche and Polygon around 23:05 UTC.
Hacken. Original Statement 315 Captured 2026-11-01 12:47 UTC.

Polygon

2026-10-29 23:05 UTC
Reported amount
TRM said a second wave around 23:05 UTC reached Binance wallets on Avalanche and Polygon.
Timeline row: TRM said a second wave of transfers reached Binance wallets on Avalanche and Polygon
Quoted text
A second wave around 23:05 UTC reached Binance wallets on Avalanche and Polygon.
TRM Labs, TRM Labs. Original Statement 149 Captured 2026-11-01 12:48 UTC.
2026-10-29 23:05 UTC
Reported amount
Hacken's timeline table lists a second wave of transfers from Binance wallets on Avalanche and Polygon at 23:05 UTC.
Quoted text
23:05 | Second wave: Binance wallets on Avalanche and Polygon send funds.
Hacken. Original Statement 156 Captured 2026-11-01 12:47 UTC.
No time stated
Reported amount
Hacken said most of the money left in about 20 minutes, with a smaller second wave on Avalanche and Polygon around 23:05 UTC.
Quoted text
Most of the money left in about 20 minutes, and a smaller second wave hit Avalanche and Polygon around 23:05 UTC.
Hacken. Original Statement 315 Captured 2026-11-01 12:47 UTC.

Stored records per chain (counts of rows, not amounts)
Chain	Claims under this stage	Addresses named by a source	Freeze events
Ethereum	1	Attacker: 610; Intermediary: 1; Victim: 2	6
Bitcoin	2	Attacker: 19	0
XRP Ledger	2	none	0
Solana	1	Attacker: 1	0
Arbitrum	1	none	0
Avalanche	4	none	0
Polygon	3	none	0

Freezes

Freezes, blacklists and emergency moves by issuers and network bodies, with the time each source gives.

2026-10-29 (date only)
Reported freeze
The page reports that between $2.7B and $2.84B was frozen within hours of the attack, mostly stablecoins.
Quoted text
Between $2.7B and $2.84B was frozen within hours , almost all of it stablecoins that issuers such as Tether and Circle can block.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Hacken gives a range, shown here as its two end values. The source Hacken links for the range is Elliptic.
Hacken. Original Statement 13 Captured 2026-11-01 12:47 UTC.
2026-10-29 (date only)
Reported freeze
The page states that about $3B was frozen within hours, while most of the ETH and other native assets stayed with the attacker.
Quoted text
About $3B was frozen within hours, while most of the ETH and other native assets stayed with the attacker.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
blockaid.io. Original Statement 90 Captured 2026-11-01 12:47 UTC.
2026-10-29 20:24 UTC
Reported freeze
Elliptic said the stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC, that Tether froze that wallet 37 minutes later locking 1.18 billion USDT, and that Circle froze the 823 million USDC in the same wallet three minutes after that.
Quoted text
The stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC. Tether froze that wallet 37 minutes later, locking 1.18 billion USDT in place, and then followed the funds, freezing four more attacker addresses within 17 minutes. Circle froze the 823 million USDC in the same wallet three minutes after that.
Elliptic, Elliptic. Original Statement 92 Captured 2026-11-01 12:47 UTC.
2026-10-29 21:01 UTC
Reported freeze
The page states that Tether froze 971.1M USDT at 21:01 UTC, 37 minutes after the Ethereum transaction.
Quoted text
21:01 | Tether freezes 971.1M USDT, 37 minutes after the Ethereum transaction.
Reviewer note: The Speaker field names the party that acted. The timing and the amount are as stated by Hacken, not by Tether. Hacken adds that another count dates the first freezes at 21:14.
Tether, Hacken. Original Statement 19 Captured 2026-11-01 12:47 UTC.
2026-10-29 21:01 UTC
Reported freeze
TRM said Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep, and that later sweeps landed in that frozen wallet, which then held 1.175 billion USDT.
Timeline row: TRM said Tether froze 971.1M USDT in the main receiving wallet, 37 minutes after the main sweep
Quoted text
Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep. Later sweeps landed in the frozen wallet, which now holds 1.175 billion USDT.
TRM Labs, TRM Labs. Original Statement 143 Captured 2026-11-01 12:48 UTC.
2026-10-29 21:04 UTC
Reported freeze
The page states that Circle froze 823M USDC at 21:04 UTC.
Quoted text
21:04 | Circle freezes 823M USDC.
Reviewer note: The Speaker field names the party that acted. The timing and the amount are as stated by Hacken, not by Circle.
Circle, Hacken. Original Statement 20 Captured 2026-11-01 12:47 UTC.
2026-10-29 21:04 UTC
Reported freeze
TRM said Circle froze the 823 million USDC in the main receiving wallet at 21:04 UTC, in coordination with law enforcement.
Timeline row: TRM said Circle froze 823M USDC in the main receiving wallet
Quoted text
Circle froze the 823 million USDC in the main receiving wallet at 21:04 UTC, in coordination with law enforcement.
TRM Labs, TRM Labs. Original Statement 144 Captured 2026-11-01 12:48 UTC.
2026-10-29 21:04 UTC
Reported freeze
Decrypt reported that Tether froze 975.1 million USDT in the main receiving address and Circle froze 823 million USDC in the same wallet at 21:04 UTC, bringing the total frozen to about $1.8 billion.
Quoted text
Tether froze 975.1 million USDT in the main receiving address, and Circle, issuer of the rival stablecoin USDC, froze 823 million USDC in the same wallet at 21:04 UTC, bringing the total frozen to about $1.8 billion.
Reviewer note: Statement reworded to "Decrypt reported" and approved 2026-11-01. The Decrypt page was published 2026-10-29 21:36 UTC; the 21:04 UTC in the quote is the Circle freeze. Decrypt's 975.1 million USDT differs from Hacken's and TRM's 971.1 million.
Decrypt. Original Statement 694 Captured 2026-11-01 13:03 UTC.
2026-10-29 21:14 UTC
Reported freeze
Hacken said that another count dates the first freezes at 21:14, whereas its table lists Tether's freeze at 21:01.
Timeline row: Hacken noted another count dates the first freezes at 21:14, against 21:01 in its own table
Quoted text
Another count dates the first freezes at 21:14.
Reviewer note: Hacken does not name the source of the alternative count.
Hacken. Original Statement 153 Captured 2026-11-01 12:47 UTC.
2026-10-29 21:14 UTC
Reported freeze
Chainalysis said freezes started by 5:14 p.m. Eastern on October 29.
Timeline row: Chainalysis said freezes started by 5:14 p.m. Eastern; TRM and Hacken list Tether's first freeze at 21:01
Quoted text
But the industry caught up with them more quickly than they expected: by 5:14 pm eastern the freezes started.
Reviewer note: Chainalysis states 5:14 p.m. Eastern. Converted to UTC at UTC-4. Hacken and TRM list Tether's freeze at 21:01 UTC.
Chainalysis, Chainalysis. Original Statement 191 Captured 2026-11-01 13:11 UTC.
2026-10-29 21:14 UTC
Reported freeze
Chainalysis said stablecoin issuers began freezing funds by 5:14 p.m. ET (21:14 UTC) on 29 October.
Quoted text
Stablecoin issuers began freezing funds by 5:14 p.m. ET on October 29
Chainalysis, Chainalysis. Original Statement 299 Captured 2026-11-01 13:11 UTC.
2026-10-29 21:15 UTC
Reported freeze
Cointelegraph reported that Changpeng Zhao said Tether and Circle had frozen approximately $971 million and $823 million respectively.
Quoted text
the activity appeared to be a hack, adding that Tether and Circle had frozen approximately $971 million and $823 million, respectively.
Changpeng Zhao, Cointelegraph. Original Statement 349 Captured 2026-11-01 12:52 UTC.
2026-10-29 21:15 UTC
Reported freeze
Cointelegraph reported that Tether CEO Paolo Ardoino said Tether had frozen more than $1.567 billion in USDT linked to the potential exploit.
Quoted text
the company had frozen more than $1.567 billion in USDT linked to the potential exploit.
Paolo Ardoino, Cointelegraph. Original Statement 350 Captured 2026-11-01 12:52 UTC.
2026-10-29 22:01 UTC
Reported freeze
TRM said Ripple froze the wallet holding the stolen RLUSD at 22:01 UTC, with 40.5 million of the 88.5 million RLUSD still inside.
Timeline row: TRM said Ripple froze the wallet holding the stolen RLUSD, with 40.5M of 88.5M RLUSD still inside
Quoted text
Ripple froze the wallet holding the stolen RLUSD at 22:01 UTC, with 40.5 million of the 88.5 million RLUSD still inside.
TRM Labs, TRM Labs. Original Statement 145 Captured 2026-11-01 12:48 UTC.
2026-10-29 22:01 UTC
Reported freeze
Hacken's timeline table lists Ripple freezing 40.5M RLUSD at 22:01 UTC, citing TRM.
Quoted text
22:01 | Ripple freezes 40.5M RLUSD.
Hacken. Original Statement 154 Captured 2026-11-01 12:47 UTC.
2026-10-29 22:06 UTC
Reported freeze
Halborn said Tether blacklisted Binance 14 itself at 22:06.
Timeline row: Halborn said Tether blacklisted Binance 14 itself at 22:06
Quoted text
Tether: blacklisted Binance 14 itself at 22:06.
Halborn. Original Statement 766 Captured 2026-11-01 14:21 UTC.
2026-10-29 22:10 UTC
Reported freeze
TRM said World Liberty Financial froze the 27.8 million USD1 in the main receiving wallet at 22:10 UTC, and froze USD1 in the compromised Binance hot wallet at 22:26 UTC.
Timeline row: TRM said World Liberty Financial froze 27.8M USD1 in the main receiving wallet
Quoted text
World Liberty Financial froze the 27.8 million USD1 in the main receiving wallet at 22:10 UTC, and froze USD1 in the compromised Binance hot wallet at 22:26 UTC.
TRM Labs, TRM Labs. Original Statement 146 Captured 2026-11-01 12:48 UTC.
2026-10-29 22:10 UTC
Reported freeze
Hacken's timeline table lists World Liberty Financial freezing 27.8M USD1 at 22:10 UTC, citing TRM.
Quoted text
22:10 | World Liberty Financial freezes 27.8M USD1.
Hacken. Original Statement 155 Captured 2026-11-01 12:47 UTC.
2026-10-29 22:32 UTC
Reported freeze
Cointelegraph reported that Aave froze markets across its V3 and V4 deployments as a precaution following the Binance hack.
Quoted text
Decentralized lending protocol Aave froze markets across its V3 and V4 deployments as a precaution following the Binance hack.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (10:32 pm UTC), not a time stated by the speaker.
Cointelegraph. Original Statement 118 Captured 2026-11-01 12:52 UTC.
2026-10-29 22:32 UTC
Reported freeze
Cointelegraph reported that LlamaRisk said the exploiter deposited 60 million USDT into Aave and borrowed 19,762 WETH worth about $44.6 million at the time.
Quoted text
the Binance exploiter deposited 60 million USDT and borrowed 19,762 Wrapped Ether (WETH), worth about $44.6 million at the time.
Cointelegraph. Original Statement 409 Captured 2026-11-01 12:52 UTC.
2026-10-29 22:36 UTC
Reported freeze
Cointelegraph reported that, according to Yi He, World Liberty Financial froze $27 million in USD1 and $2 million of WLFI, and that World Liberty Financial co-founder and CEO Zach Witkoff said USD1 had frozen the $27 million associated with the hack.
Quoted text
World Liberty Financial has frozen $27 million in US-dollar-pegged stablecoin USD1 and $2 million worth of WLFI, according to Binance co-founder Yi He. “USD1 has taken proactive steps to freeze the $27 million in USD1 associated with the Binance hack,” said World Liberty Financial co-founder and CEO Zach Witkoff.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (10:36 pm UTC), not a time stated by the speaker.
Cointelegraph. Original Statement 119 Captured 2026-11-01 12:52 UTC.
2026-10-29 23:35 UTC
Reported freeze
The page states that Binance stated the verified frozen total was $2.54B at 23:35 UTC.
Quoted text
23:35 | Binance states that the verified frozen total is $2.54B.
Reviewer note: Hacken relays a Binance statement and cites TRM for it.
Binance, Hacken. Original Statement 21 Captured 2026-11-01 12:47 UTC.
2026-10-29 23:35 UTC
Reported freeze
Cointelegraph reported that Binance said the verified total of assets frozen had reached $2.54 billion, and that Binance said this clarified differing figures in circulation, including references to $1.8 billion.
Quoted text
Binance said the verified total of assets frozen in connection with the hack had reached $2.54 billion, clarifying differing figures circulating publicly, including references to $1.8 billion.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (11:35 pm UTC), not a time stated by the speaker.
Binance, Cointelegraph. Original Statement 120 Captured 2026-11-01 12:52 UTC.
2026-10-29 23:35 UTC
Reported freeze
TRM said Binance stated at 23:35 UTC that the verified total frozen had reached USD 2.54 billion.
Timeline row: TRM said Binance stated the verified frozen total had reached $2.54B (Hacken and Cointelegraph give the same time)
Quoted text
Binance said at 23:35 UTC that the verified total frozen had reached USD 2.54 billion.
TRM Labs, TRM Labs. Original Statement 147 Captured 2026-11-01 12:48 UTC.
2026-10-29 23:35 UTC
Reported freeze
Cointelegraph reported that Binance said the verified total frozen had reached $2.54 billion, clarifying differing figures circulating publicly including $1.8 billion.
Quoted text
the verified total of assets frozen in connection with the hack had reached $2.54 billion, clarifying differing figures circulating publicly, including references to $1.8 billion.
Binance, Cointelegraph. Original Statement 344 Captured 2026-11-01 12:52 UTC.
2026-10-29 23:40 UTC
Reported freeze
Cointelegraph reported that, according to Ripple's Jack McDonald, Ripple was freezing RLUSD linked to the Binance hack and coordinating with relevant parties, without disclosing an amount.
Quoted text
Ripple is freezing holdings of its dollar-pegged RLUSD stablecoin linked to the Binance hack, according to Jack McDonald, the company’s senior vice president of stablecoins. McDonald said Ripple was “actively freezing affected funds” and coordinating with relevant parties to support the investigation. He did not disclose the amount frozen.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (11:40 pm UTC), not a time stated by the speaker.
Jack McDonald, Cointelegraph. Original Statement 121 Captured 2026-11-01 12:52 UTC.
2026-10-30 (date only)
Reported freeze
Binance stated that customer funds were safe and that it had located about $3 billion of the affected assets while working with partners to freeze them.
Quoted text
Binance said customer funds were safe and it is working with industry partners to freeze some of the affected assets, with about $3 billion located so far.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Binance, Yahoo Finance. Original Statement 208 Captured 2026-11-01 12:48 UTC.
2026-10-30 00:08 UTC
Reported recovery
The page states that the Arbitrum Security Council moved 8,426 ETH and 74.6M ARB out of the attacker's reach at 00:08 UTC on October 30.
Quoted text
30 Oct, 00:08 | The Arbitrum Security Council moves 8,426 ETH and 74.6M ARB out of the attacker's reach.
Reviewer note: The Speaker field names the party that acted. The timing and the amount are as stated by Hacken, not by the Arbitrum Security Council.
Arbitrum Security Council, Hacken. Original Statement 22 Captured 2026-11-01 12:47 UTC.
2026-10-30 00:08 UTC
Reported freeze
TRM said the Arbitrum Security Council used its emergency powers at 00:08 UTC to force two transfers out of the attacker's wallet on Arbitrum, moving 8,426 ETH and 74.6 million ARB, about USD 30 million, out of the attacker's reach.
Timeline row: TRM said the Arbitrum Security Council moved 8,426 ETH and 74.6M ARB out of the attacker's reach
Quoted text
At 00:08 UTC, it used those powers to force two transfers out of the attacker's wallet on Arbitrum, moving 8,426 ETH and 74.6 million ARB, about USD 30 million, out of the attacker's reach.
TRM Labs, TRM Labs. Original Statement 148 Captured 2026-11-01 12:48 UTC.
2026-10-30 00:52 UTC
Reported freeze
Cointelegraph reported that Binance said the current verified amount of assets frozen from the hack was $3 billion.
Quoted text
Binance said the current verified amount of assets frozen from the hack is now $3 billion.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (12:52 am UTC), not a time stated by the speaker.
Binance, Cointelegraph. Original Statement 124 Captured 2026-11-01 12:52 UTC.
2026-10-30 00:52 UTC
Reported freeze
Cointelegraph reported that the Arbitrum Security Council said it executed a transaction to freeze $30.5 million, involving 74.6 million ARB and 8,425 ETH, and that the funds were transferred to an intermediary frozen wallet.
Timeline row: Cointelegraph reported the Arbitrum Security Council said it froze $30.5M; TRM and Hacken give 00:08 for the transfer (live-blog entry time)
Quoted text
The update came after the Arbitrum Security Council said it executed a transaction to freeze $30.5 million from the Binance exploit, involving 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH). “The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications,” it said. “As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet,” it said.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (12:52 am UTC), not a time stated by the speaker. Hacken and TRM give 00:08 UTC for the Arbitrum action itself.
Arbitrum Security Council, Cointelegraph. Original Statement 125 Captured 2026-11-01 12:52 UTC.
2026-10-30 01:00 UTC
Reported freeze
LlamaRisk reported that the attacker’s position on Aave held around $59.9 million in USDT collateral against $43.8 million in debt, and Aave stated the position remained overcollateralized.
Quoted text
LlamaRisk, an Aave risk service provider, said in its 1:00 am update that the attacker’s position subsequently held around $59.9 million in USDT collateral against $43.8 million in debt. Aave said the position remained overcollateralized and did not put protocol suppliers at risk.
Reviewer note: LlamaRisk 1:00 am update; the source does not state a zone, so the 01:00 UTC event time is the extractor assumption. Differs from claim 409 (60M collateral, 44.6M WETH borrowed at the time).
LlamaRisk, Cointelegraph. Original Statement 393 Captured 2026-11-01 12:52 UTC.
2026-10-30 07:00 UTC
Reported freeze
Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.
Timeline row: Cointelegraph reported Elliptic estimated $2.84B frozen by 07:00 UTC on Friday (Hacken gives the same figure at 08:00 UTC)
Quoted text
Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.
Reviewer note: Elliptic estimate relayed by Cointelegraph; side by side with Elliptic 2.85B (claim 57), Hacken 2.84B at 08:00 UTC (claim 23).
Elliptic, Cointelegraph. Original Statement 395 Captured 2026-11-01 12:52 UTC.
2026-10-30 08:00 UTC
Reported freeze
The page states that the verified frozen total reached $2.84B, which is 44% of the theft, at 08:00 UTC.
Timeline row: Hacken said the verified frozen total reached $2.84B, 44% of the theft
Quoted text
08:00 | Verified frozen total reaches $2.84B, 44% of the theft.
Hacken. Original Statement 23 Captured 2026-11-01 12:47 UTC.
2026-10-30 19:33 UTC
Official freeze
Binance said in its second 30 October update that approximately $3 billion had been frozen on-chain to date.
Quoted text
Approximately $3 billion has been frozen on-chain to date.
Binance, Binance. Original Statement 469 Captured 2026-11-01 13:11 UTC.

No time stated

No time stated
Reported freeze
Binance stated that it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms, and partners.
Quoted text
On Friday, the company said it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms and partners.
Binance, BBC News. Original Statement 10 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Hacken said Ripple and World Liberty Financial froze their tokens inside the compromised wallet, which stopped new deposits of those tokens from being taken.
Quoted text
Ripple and World Liberty Financial froze their tokens inside the compromised wallet, which stopped new deposits of those tokens from being taken.
Reviewer note: Statement given an attribution 2026-11-01: it had none.
Hacken. Original Statement 26 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Binance stated that it worked with blockchain partners to freeze roughly $3 billion in affected assets.
Quoted text
Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets.
Binance, npr.org. Original Statement 40 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Elliptic has verified $2.85 billion of frozen or seized funds, which is 44% of the theft, mostly USDT and USDC.
Quoted text
Elliptic has verified $2.85 billion of frozen or seized funds, 44% of the theft, almost all of it USDT and USDC. The attacker is swapping the rest into ETH and other assets that cannot be frozen, and moving funds between blockchains, using automated scripts that run around the clock.
Elliptic, Elliptic. Original Statement 57 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Elliptic said the Arbitrum Security Council took emergency action to move assets out of the attacker's reach, and that Optimism's governance appears to have done the same on October 31, moving 44 million OP (around $5 million).
Quoted text
The Arbitrum Security Council took emergency action to move assets out of the attacker's reach, and on October 31 Optimism's governance appears to have done the same, moving 44 million OP (around $5 million) out of the attacker's address.
Elliptic, Elliptic. Original Statement 93 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Elliptic said stablecoins make up 94% of the frozen funds, almost entirely on Ethereum and Tron, and that nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen.
Quoted text
Stablecoins make up 94% of the frozen funds, almost entirely on Ethereum and Tron. Arbitrum and Optimism are the only blockchains where everything stolen has been secured, in both cases by the network's own governance. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because native assets have no issuer that can freeze them.
Elliptic, Elliptic. Original Statement 94 Captured 2026-11-01 12:47 UTC.
No time stated
Reported other
Elliptic said the attacker converted around $786 million of stablecoins into ETH and TRX before the freezes landed.
Quoted text
Before the freezes landed, the attacker converted around $786 million of stablecoins into ETH and TRX.
Elliptic, Elliptic. Original Statement 95 Captured 2026-11-01 12:47 UTC.
No time stated
Reported other
Elliptic said a second attacker wallet deposited 59.9 million USDT into Aave as collateral and borrowed 19,762 ETH before Aave froze the affected markets.
Quoted text
A second attacker wallet deposited 59.9 million USDT into Aave as collateral and borrowed 19,762 ETH, before Aave froze the affected markets. The loan is still open and close to the point of liquidation.
Elliptic, Elliptic. Original Statement 97 Captured 2026-11-01 12:47 UTC.
No time stated
Reported other
Elliptic said 234 million USDT was swapped for 638 million TRX on SunSwap on Tron, and 48 million RLUSD was sold on Ethereum before Ripple froze the remainder.
Quoted text
On Tron, 234 million USDT was swapped for 638 million TRX on SunSwap. On Ethereum, 48 million RLUSD was sold before Ripple froze the remainder, and around 150 other tokens were dumped for ETH on decentralized exchanges.
Elliptic, Elliptic. Original Statement 98 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Blockaid said Tether and Circle froze about $1.8B in the main collection address within 40 minutes, and that with later freezes by other issuers and the Arbitrum Security Council, Binance puts the verified total frozen at about $3B.
Quoted text
Tether and Circle froze about $1.8B in the main collection address within 40 minutes, and with later freezes by other issuers and the Arbitrum Security Council, Binance puts the verified total frozen at about $3B.
blockaid.io. Original Statement 103 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Cointelegraph reported that Changpeng Zhao said the activity appeared to be a hack and that Tether and Circle had frozen approximately $971 million and $823 million respectively.
Quoted text
Binance co-founder Changpeng Zhao said the activity appeared to be a hack, adding that Tether and Circle had frozen approximately $971 million and $823 million, respectively. Zhao said he expected all user funds to be fully covered.
Changpeng Zhao, Cointelegraph. Original Statement 114 Captured 2026-11-01 12:52 UTC.
No time stated
Reported freeze
Cointelegraph reported that Circle CEO Jeremy Allaire said Circle had frozen more than $800 million in USDC in coordination with law enforcement.
Quoted text
Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue supporting the investigation.
Jeremy Allaire, Cointelegraph. Original Statement 115 Captured 2026-11-01 12:52 UTC.
No time stated
Reported freeze
Cointelegraph reported that Tether CEO Paolo Ardoino said Tether had frozen more than $1.567 billion in USDT linked to the potential exploit.
Quoted text
Tether CEO Paolo Ardoino said the company had frozen more than $1.567 billion in USDT linked to the potential exploit.
Paolo Ardoino, Cointelegraph. Original Statement 116 Captured 2026-11-01 12:52 UTC.
No time stated
Reported freeze
TRM said Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB, a total of roughly USD 2.7 billion.
Quoted text
Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion.
TRM Labs, TRM Labs. Original Statement 138 Captured 2026-11-01 12:48 UTC.
No time stated
Reported freeze
Hacken said stablecoin issuers began freezing 56 minutes after the first transfer, that Tether acted first at 21:01 and Circle three minutes later, and that Binance suspended deposits and withdrawals that night and published a written update at 02:23 UTC.
Quoted text
Stablecoin issuers began freezing funds 56 minutes after the first transfer. Tether acted first, at 21:01, about 37 minutes after the big Ethereum transaction, and Circle followed three minutes later. Binance suspended deposits and withdrawals that night and published a written update at 02:23 UTC, a little over six hours after the first transfer.
Hacken. Original Statement 158 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Yahoo Finance reported that Tether said it froze nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million.
Quoted text
Stablecoin issuer Tether said it froze nearly $1.57 billion in assets linked to the incident, while Circle froze more than $800 million.
Yahoo Finance. Original Statement 159 Captured 2026-11-01 12:48 UTC.
No time stated
Reported freeze
WIRED quoted Elliptic's Tom Robinson as saying that around $2.8 billion, or around 44 percent of the total stolen, had been frozen so far, almost all of it stablecoins.
Quoted text
Elliptic’s Robinson says that around $2.8 billion, or around 44 percent of the total amount stolen, has been frozen by crypto companies and exchanges so far, with almost all of this being stablecoins.
Tom Robinson, WIRED. Original Statement 160 Captured 2026-11-01 12:48 UTC.
No time stated
Official freeze
Binance said in its Security Incident Update dated 2026-10-30 that it had worked with blockchain partners to freeze affected assets, with about $3 billion frozen on-chain so far.
Quoted text
We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance, Binance. Original Statement 163 Captured 2026-11-01 13:11 UTC.
No time stated
Official freeze
Binance said in its Security Incident Update #2 that it had worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets, and that approximately $3 billion had been frozen on-chain to date.
Quoted text
Worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets. Approximately $3 billion has been frozen on-chain to date.
Binance, Binance. Original Statement 170 Captured 2026-11-01 13:11 UTC.
No time stated
Reported freeze
Chainalysis said approximately $2.8 billion had been frozen so far.
Quoted text
Approximately $2.8 billion has been frozen so far.
Reviewer note: Elsewhere on the same page the as-of time is left as an unfilled placeholder ('[time] ET').
Chainalysis, Chainalysis. Original Statement 192 Captured 2026-11-01 13:11 UTC.
No time stated
Reported other
Chainalysis said the attacker swapped $325 million in stablecoins into $285 million in ETH over nearly 20 minutes to try to stay ahead of the freezes.
Quoted text
Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH.
Chainalysis, Chainalysis. Original Statement 194 Captured 2026-11-01 13:11 UTC.
No time stated
Reported freeze
The Block reported that Binance co-CEO Yi He said Ripple promptly froze roughly $200 million in associated funds; TRM reports a 40.5M RLUSD freeze; the sources do not say whether the figures measure the same thing.
Quoted text
Ripple "promptly" froze roughly $200 million in associated funds, co-CEO Yi He [said]
Reviewer note: TRM, by contrast, confirmed a 40.5 million RLUSD freeze on-chain.
Yi He, The Block. Original Statement 204 Captured 2026-11-01 13:01 UTC.
No time stated
Reported freeze
The Guardian reported that Binance has said the attack began with a compromised employee laptop and involved multiple breach points, that it found no evidence of private-key leakage, and that it said roughly $3bn of affected assets had been frozen.
Quoted text
Binance has said the attack began with a compromised employee laptop and involved multiple breach points. It found no evidence of private-key leakage and said roughly $3bn of affected assets had been frozen.
Reviewer note: Statement reworded 2026-11-01: it gave the Guardian's paraphrase as Binance's own statement and dropped the hedge. Binance's own updates say the incident "may involve" a compromised laptop (statements 280 and 284).
Binance, The Guardian. Original Statement 223 Captured 2026-11-01 12:48 UTC.
No time stated
Reported freeze
Binance co-CEO Yi He said Ripple helped stop about USD 200 million from moving; TRM reports a 40.5M RLUSD freeze; the sources do not say whether the figures measure the same thing.
Quoted text
Binance co-CEO Yi He said Ripple helped stop about USD 200 million from moving; TRM has confirmed the 40.5 million RLUSD freeze onchain.
Reviewer note: Yi He's figure is Binance's side of a disagreement: TRM confirmed 40.5 million RLUSD frozen on-chain.
Yi He, TRM Labs. Original Statement 243 Captured 2026-11-01 12:48 UTC.
No time stated
Reported freeze
Elliptic said it had verified $2.85 billion of frozen or seized funds, 44% of the theft.
Quoted text
Elliptic has verified $2.85 billion of frozen or seized funds, 44% of the theft
Elliptic, Elliptic. Original Statement 313 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Elliptic said Tether froze the main attacker Ethereum wallet 37 minutes later, locking 1.18 billion USDT.
Quoted text
Tether froze that wallet 37 minutes later, locking 1.18 billion USDT in place
Elliptic, Elliptic. Original Statement 314 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Hacken said stablecoin issuers began freezing funds 56 minutes after the first transfer.
Quoted text
Stablecoin issuers began freezing funds 56 minutes after the first transfer.
Hacken. Original Statement 318 Captured 2026-11-01 12:47 UTC.
No time stated
Reported freeze
Tom Robinson of Elliptic stated that the remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which cannot be frozen.
Quoted text
“The remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which no one can freeze,” Robinson says.
Reviewer note: Elliptic Robinson estimate relayed by WIRED; compare Elliptic 3.25B (claim 101) and 3.33B at 07:00 UTC (claim 395).
Tom Robinson, WIRED. Original Statement 383 Captured 2026-11-01 12:48 UTC.
No time stated
Reported freeze
Decrypt reported that Tether and Circle had locked up about $2.39 billion between them, which it put at 43% of the haul, leaving somewhere between $2.6 and $3.2 billion still out there.
Quoted text
Tether and Circle used it, locking up about $2.39 billion between them. That’s 43% of the haul. That leaves somewhere between $2.6 and $3.2 billion still out there.
Reviewer note: Statement reworded to "Decrypt reported" and approved 2026-11-01. From Decrypt's Morning Minute, published 2026-10-30 12:31 UTC; the time of the count is not stated. The $1.8 billion on 29 October (claim 694) is the same outlet's earlier count.
Decrypt. Original Statement 663 Captured 2026-11-01 13:03 UTC.
No time stated
Reported freeze
Halborn said issuers froze about 2.8 billion dollars, most of it within 47 minutes of the main sweep, but that the attacker had moved 700 million USDT out of the hub before the first freeze and converted close to 800 million dollars of stablecoins into assets nobody can freeze.
Quoted text
The issuers froze about 2.8 billion dollars, and most of it within 47 minutes of the main sweep, but the attacker had moved 700 million USDT out of the hub before the first freeze landed and converted close to 800 million dollars of stablecoins into assets nobody can freeze.
Halborn. Original Statement 764 Captured 2026-11-01 14:21 UTC.
No time stated
Reported other
Halborn said that by Elliptic's count about 3.33 billion dollars sat in roughly 43 addresses that nobody can freeze, including 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX.
Quoted text
What the attacker keeps is what nobody can freeze. By Elliptic's count about 3.33 billion dollars sat in roughly 43 addresses: 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX, with about 445 million in XRP, SOL and NEAR that has not moved at all.
Halborn. Original Statement 767 Captured 2026-11-01 14:21 UTC.

Freeze events read from chain data (see the freeze scoreboard)
Time	Chain	Token	Target	Transaction
2026-10-29 21:01 UTC	ethereum	USDT	`0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c` View on explorer	`0x7baba482077843514d9c72bac0110ba0916b0814288a72917e2c3bb27a9d8659` View on explorer
2026-10-29 21:04 UTC	ethereum	USDC	`0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c` View on explorer	`0xc954c86f118e8e410e6a3eb9e3b38ff4a95fbdae9d2d58e13166afb7a1f4fc5f` View on explorer
2026-10-29 22:06 UTC	ethereum	USDT	`0x28c6c06298d514db089934071355e5743bf21d60` View on explorer	`0x312e166cb9e602582f426288f755a4b08e1eddb456b7e4bd614adae11080d305` View on explorer
2026-10-29 23:53 UTC	ethereum	USDC	`0x28c6c06298d514db089934071355e5743bf21d60` View on explorer	`0xb57c2143508019ac592a9dadb988b39003589f6f54c1924d4163f60520a784f5` View on explorer
2026-10-29 23:54 UTC	ethereum	USDC	`0xee7ae85f2fe2239e27d9c1e23fffe168d63b4055` View on explorer	`0xf2faba0e8ab74e84dde0c7ded90effe20a4cedbde1653f0c98220d2f774eeebb` View on explorer
2026-10-30 13:27 UTC	ethereum	USDC	`0x294828705974ad04d86a24a2ff6efe762505a0ed` View on explorer	`0x884b83c4ed4ddb0a33cb4977df7d9aa1b94ac14f8b7218680824955337fadb1c` View on explorer

Consolidation

Where taken funds are said to have been gathered, and what the attacker is said to hold afterwards.

2026-10-29 20:30 UTC
Reported other
Halborn said that between 20:30 and 20:33, before Tether acted, 700 million USDT left the hub in two transfers, and that Tether later caught 205 million of it one and two hops downstream.
Quoted text
Between 20:30 and 20:33, before Tether acted, 700 million USDT left the hub in two transfers; Tether later caught 205 million of it one and two hops downstream.
Halborn. Original Statement 765 Captured 2026-11-01 14:21 UTC.

No time stated

No time stated
Reported other
Elliptic said the attacker controls around $3.25 billion of assets that an issuer cannot freeze, spread across more than 800 addresses, including around 584,000 ETH, 18,327 BTC and 233 million XRP.
Quoted text
At current prices, the attacker now controls around $3.25 billion of assets that cannot be frozen by an issuer, spread across more than 800 addresses. This includes around 584,000 ETH ($1.32 billion), 18,327 BTC ($1.42 billion) and 233 million XRP.
Elliptic, Elliptic. Original Statement 101 Captured 2026-11-01 12:47 UTC.
No time stated
Reported other
TRM said the attacker held more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach (as of 00:30 UTC on October 30).
Quoted text
It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach.
TRM Labs, TRM Labs. Original Statement 152 Captured 2026-11-01 12:48 UTC.

Laundering

Conversions, swaps, bridges and distribution after the transfers, as described by the analytics firms that traced them.

2026-10-29 20:59 UTC
Reported amount
Cointelegraph reported that CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began.
Timeline row: Cointelegraph reported CertiK traced $500M USDT to one address, with $325M sold to market makers for ETH by 20:59 UTC
Quoted text
CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began.
Reviewer note: CertiK engineer Dickson Wu via Cointelegraph. 20:59 UTC is the by time in the source. Statement given an attribution to Cointelegraph 2026-11-01: it had none.
Dickson Wu, Cointelegraph. Original Statement 388 Captured 2026-11-01 12:52 UTC.
2026-10-30 10:09 UTC
Reported other
Cointelegraph reported that Chainalysis said its investigators were observing never-seen-before laundering patterns with the stolen funds.
Quoted text
“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” the company said . “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (10:09 am UTC), not a time stated by the speaker.
Chainalysis, Cointelegraph. Original Statement 130 Captured 2026-11-01 12:52 UTC.
2026-10-30 11:38 UTC
Reported other
Elliptic said that on October 30 the attacker sold all stolen AVAX for USDC between 11:38 and 12:29 UTC, bridged it to Ethereum using Circle's CCTP, and swapped it for 7,242.8 ETH.
Timeline row: Elliptic said the attacker began moving funds between blockchains, selling stolen AVAX for USDC from 11:38
Quoted text
On October 30, the attacker began moving funds between blockchains. Between 11:38 and 12:29 UTC, they sold all of the stolen AVAX for USDC, bridged it to Ethereum using Circle's Cross-Chain Transfer Protocol (CCTP), and swapped it for 7,242.8 ETH.
Elliptic, Elliptic. Original Statement 100 Captured 2026-11-01 12:47 UTC.
2026-10-31 22:41 UTC
Reported other
Elliptic said at 22:41 UTC on October 31 that about $196 million had been sent out of the main Tron distribution wallet to around 200 wallets.
Timeline row: Elliptic said about $196M had been sent out of the main Tron distribution wallet to around 200 wallets
Quoted text
October 31, 22:41 UTC. About $196 million has been sent out of the main Tron distribution wallet to around 200 wallets,
Elliptic, Elliptic. Original Statement 199 Captured 2026-11-01 13:11 UTC.

No time stated

No time stated
Reported other
Elliptic said 434 million USDT was swapped for 160,451 ETH on Ethereum at a loss of 12% to 26% against the market price, which it read as the attacker prioritising speed over value.
Quoted text
On Ethereum, 434 million USDT was swapped for 160,451 ETH through Uniswap, 1inch and market makers' request-for-quote systems. The swaps implied a loss of 12% to 26% against the market price, suggesting the attacker was prioritizing speed over value.
Elliptic, Elliptic. Original Statement 96 Captured 2026-11-01 12:47 UTC.
No time stated
Reported other
Elliptic said the 18,270 BTC was split through a peel chain into 19 addresses, most holding 1,000 BTC each, and that none of it had yet been sent to a service.
Quoted text
The 18,270 BTC has been split through a short peel chain into 19 addresses, most holding 1,000 BTC each. None of it has yet been sent to a service.
Elliptic, Elliptic. Original Statement 99 Captured 2026-11-01 12:47 UTC.
No time stated
Reported other
Chainalysis said many addresses receive exactly 1 TRX, then additional funds, then forward the funds, which it said suggests a programmatic process.
Quoted text
Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses.
Chainalysis, Chainalysis. Original Statement 195 Captured 2026-11-01 13:11 UTC.
No time stated
Reported other
Elliptic said the main Tron distribution wallet had sent funds every hour for 31 hours straight, with a longest pause of 46 minutes and no overnight break.
Quoted text
The main Tron distribution wallet has sent funds every hour for 31 hours straight. The longest pause was 46 minutes, and there was no overnight break.
Elliptic, Elliptic. Original Statement 196 Captured 2026-11-01 13:11 UTC.
No time stated
Reported other
Elliptic said swaps into THORChain use the same amounts repeatedly, with one value appearing 19 times, which it read as evidence of software-driven laundering.
Quoted text
Swaps into THORChain use the same amounts again and again, with one value appearing 19 times.
Elliptic, Elliptic. Original Statement 197 Captured 2026-11-01 13:11 UTC.
No time stated
Reported other
Chainalysis said many addresses receive exactly 1 TRX, then more funds, then forward them, and that this repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.
Quoted text
This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.
Chainalysis, Chainalysis. Original Statement 296 Captured 2026-11-01 13:11 UTC.
No time stated
Reported othersays something is unexplained
Elliptic said whether the laundering automation involves AI agents rather than conventional scripts cannot be determined from the on-chain data.
Quoted text
Whether the automation involves AI agents, rather than conventional scripts, cannot be determined from the on-chain data.
Elliptic, Elliptic. Original Statement 304 Captured 2026-11-01 12:47 UTC.
No time stated
Reported other
Elliptic said the pattern of transactions suggests much of the laundering was carried out by software rather than by hand.
Quoted text
The pattern of transactions suggests that much of the laundering was carried out by software rather than by hand.
Elliptic, Elliptic. Original Statement 305 Captured 2026-11-01 12:47 UTC.
No time stated
Reported other
Aave Chan Initiative founder Marc Zeller explained that USDT is real money backed by dollars and that the position is criminal but overcollateralized in the eyes of the protocol.
Quoted text
“USDT is real money backed by dollars, and the position is criminal but overcollateralized in the eyes of the protocol.”
Reviewer note: Marc Zeller of Aave Chan Initiative, quoting his X post as relayed by Cointelegraph.
Marc Zeller, Cointelegraph. Original Statement 394 Captured 2026-11-01 12:52 UTC.
No time stated
Reported amount
Bitquery added that the attackers initially stole 200,630 ETH and accumulated the rest by swapping stolen stablecoins and other tokens.
Quoted text
The attackers initially stole 200,630 ETH and accumulated the rest by swapping stolen stablecoins and other tokens, Bitquery added.
Reviewer note: Bitquery, relayed by Cointelegraph. Compare Blockaid sweep of 167,464 ETH (claim 107).
Bitquery, Cointelegraph. Original Statement 497 Captured 2026-11-01 13:01 UTC.
No time stated
Reported recovery
Chainalysis stated that the attackers in the Binance hack are using automation to obscure the trail and leveraging DeFi protocols on Tron to avoid stablecoin freezes.
Quoted text
The firm has also been tracking funds stolen in Binance’s separate multibillion-dollar hack, saying the attackers are using automation to obscure the trail and leveraging DeFi protocols on Tron to dodge stablecoin freezes.
Reviewer note: Chainalysis statement relayed by The Block; the Tron DeFi detail is not in the earlier Chainalysis claims.
Chainalysis, The Block. Original Statement 524 Captured 2026-11-01 13:01 UTC.

Not yet explained

Two lists. The first is the open questions on the open questions page that concern the attack. The second is approved statements in which a source itself says something is unpublished, unknown or unexplained. Neither list is a finding that the answer does not exist.

Open questions

When did Binance first detect the unauthorised transfers, and how? OpenInitial access Who could answer: Binance
What was the full attack chain, from first foothold to signatures on every chain? Partly answeredInitial access Who could answer: Binance post-mortem; law enforcement
Was the compromised laptop the first entry point, and how was it compromised? Partly answeredInitial access Who could answer: Binance
How did the attacker obtain valid signatures if no private key leaked? OpenInternal movement Who could answer: Binance; law enforcement
Did Binance's signing system apply value, rate or destination limits, and what did they check? OpenInternal movement Who could answer: Binance
What has Binance said about its transaction controls? Partly answeredInternal movement Who could answer: Binance
How much has been recovered, as opposed to frozen? Partly answeredFreezes Who could answer: Binance; law enforcement; token issuers
Where will the assets that issuers cannot freeze go next? OpenConsolidation Who could answer: On-chain analysts; exchanges; law enforcement
Was the attack carried out by one person or a team? Partly answered Who could answer: Binance; law enforcement
When will Binance publish its full post-mortem? Partly answered Who could answer: Binance

Sources saying it is not explained

TRM Labs said early indicators suggested the attacker had phished the Ethereum authorizations, but that this leaves the other chains unexplained. Initial access TRM Labs, claim 303
Halborn said nothing public establishes how the laptop was infected, how long the attacker had access, the operating system or the malware. Initial access Halborn, claim 754
Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures. Internal movement Hacken, claim 316
Halborn said the only link in the attack chain Binance had confirmed so far was the first one, and that everything between the laptop and the signatures was still inference. Internal movement Halborn, claim 751
Halborn said how access to a container became accepted financial instructions was the link nobody had explained. Internal movement Halborn, claim 752
Halborn said Binance had confirmed the first two boxes of its attack-chain diagram and that the box in between was the one the post-mortem has to explain. Internal movement Halborn, claim 758
Elliptic said whether the laundering automation involves AI agents rather than conventional scripts cannot be determined from the on-chain data. Laundering Elliptic, claim 304

Disagreements

Pairs of approved statements that do not fit together, flagged by a reviewer. They are grouped by words in the reviewer's note (a time or a zone, a mechanism word, or neither). The site does not decide which is right. A conflict can come from a different method, a different clock, a later correction or an error on either side.

Disagreements about time (3)

Hacken's timeline shows Tether freezing 971.1M USDT at 21:01 (UTC). Chainalysis says issuers began freezing by 5:14 p.m. ET, which is 21:14 UTC if Eastern Daylight Time is meant.

The page states that Tether froze 971.1M USDT at 21:01 UTC, 37 minutes after the Ethereum transaction.

21:01 | Tether freezes 971.1M USDT, 37 minutes after the Ethereum transaction.

Hacken. Captured 2026-11-01 12:47 UTC. Original

Chainalysis said stablecoin issuers began freezing funds by 5:14 p.m. ET (21:14 UTC) on 29 October.

Stablecoin issuers began freezing funds by 5:14 p.m. ET on October 29

Chainalysis. Captured 2026-11-01 13:11 UTC. Original

Binance says the hot wallets were compromised at around 20:05 UTC. Chainalysis says funds began leaving at around 4:20 p.m. ET. The sources do not say whether these refer to the same first transfer.

Binance said in its Security Incident Update #2 that at around 20:05 UTC on 2026-10-29 its hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.

At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.

Binance. Captured 2026-11-01 13:11 UTC. Original

Chainalysis said funds began leaving Binance hot wallets at around 4:20 p.m. ET on 29 October.

Around 4:20 p.m. ET on October 29, 2026, funds began leaving Binance hot wallets across multiple blockchains.

Chainalysis. Captured 2026-11-01 13:11 UTC. Original

Hacken's timeline (statement 19) lists Tether freezing 971.1M USDT at 21:01 UTC, 37 minutes after the Ethereum transaction. Elliptic (statement 92) says Tether froze the main attacker Ethereum wallet 37 minutes after 20:24 UTC, "locking 1.18 billion USDT in place". Both put the freeze at the same moment and give different amounts. TRM (statement 143) says Tether froze 971.1 million USDT in that wallet at 21:01 and that later sweeps landed in the frozen wallet, which now holds 1.175 billion USDT. The Elliptic text we hold does not say whether its 1.18 billion includes those later sweeps. Shown side by side, not reconciled.

The page states that Tether froze 971.1M USDT at 21:01 UTC, 37 minutes after the Ethereum transaction.

21:01 | Tether freezes 971.1M USDT, 37 minutes after the Ethereum transaction.

Hacken. Captured 2026-11-01 12:47 UTC. Original

Elliptic said the stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC, that Tether froze that wallet 37 minutes later locking 1.18 billion USDT, and that Circle froze the 823 million USDC in the same wallet three minutes after that.

The stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC. Tether froze that wallet 37 minutes later, locking 1.18 billion USDT in place, and then followed the funds, freezing four more attacker addresses within 17 minutes. Circle froze the 823 million USDC in the same wallet three minutes after that.

Elliptic. Captured 2026-11-01 12:47 UTC. Original

Disagreements about mechanism (1)

Binance's first 30 October update pointed to a compromised DevOps engineer's laptop. Its second update the same day said later investigation had uncovered additional points of breach.

Binance said in its first 30 October update that its initial investigation suggested a compromised DevOps engineer's laptop may have let an attacker reach a service container and submit unauthorized withdrawals.

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.

Binance. Captured 2026-11-01 13:11 UTC. Original

Binance said in its second 30 October update that its later investigation had uncovered additional points of breach beyond a compromised laptop.

Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach.

Binance. Captured 2026-11-01 13:11 UTC. Original

Other disagreements: counts and amounts (5)

Binance puts the loss at about $6.3B. Elliptic counts $6.43B and says its total excludes a further $169 million that left after withdrawals were suspended. The sources do not say whether the gap comes from pricing time, chains counted or other scope.

Binance said in its Security Incident Update #2 that at around 20:05 UTC on 2026-10-29 its hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.

At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.

Binance. Captured 2026-11-01 13:11 UTC. Original

Elliptic said $6.43 billion in cryptoassets was stolen from Binance on 29 October 2026.

On October 29, 2026, $6.43 billion in cryptoassets were stolen from Binance, the world's largest cryptoasset exchange, according to Elliptic's analysis.

Elliptic. Captured 2026-11-01 12:47 UTC. Original

Chainalysis is quoted with two totals: about $6.4 billion in its own write-up and $5.912 billion at the time of theft in an earlier Cointelegraph report. Both are attributed to Chainalysis.

Chainalysis said unauthorized transfers totaled approximately $6.4 billion.

Unauthorized transfers totaled approximately $6.4 billion, the largest theft in crypto history.

Chainalysis. Captured 2026-11-01 13:11 UTC. Original

Cointelegraph reported that Chainalysis estimated the amount stolen at $5.912 billion at the time of theft.

its current estimate of the amount stolen from Binance is $5.912 billion at the time of theft, four times the amount stolen from crypto exchange Bybit in 2025.

Cointelegraph. Captured 2026-11-01 12:52 UTC. Original

Binance says approximately $3 billion is frozen. Elliptic says it has verified $2.85 billion. Chainalysis counts about $2.8 billion. The sources date their counts differently or not at all.

Binance said in its second 30 October update that approximately $3 billion had been frozen on-chain to date.

Approximately $3 billion has been frozen on-chain to date.

Binance. Captured 2026-11-01 13:11 UTC. Original

Elliptic said it had verified $2.85 billion of frozen or seized funds, 44% of the theft.

Elliptic has verified $2.85 billion of frozen or seized funds, 44% of the theft

Elliptic. Captured 2026-11-01 12:47 UTC. Original

Tether's CEO is quoted as saying more than $1.567 billion in USDT was frozen. Elliptic says Tether froze the main attacker Ethereum wallet, locking 1.18 billion USDT, and then froze four more addresses.

Cointelegraph reported that Tether CEO Paolo Ardoino said Tether had frozen more than $1.567 billion in USDT linked to the potential exploit.

the company had frozen more than $1.567 billion in USDT linked to the potential exploit.

Cointelegraph. Captured 2026-11-01 12:52 UTC. Original

Elliptic said Tether froze the main attacker Ethereum wallet 37 minutes later, locking 1.18 billion USDT.

Tether froze that wallet 37 minutes later, locking 1.18 billion USDT in place

Elliptic. Captured 2026-11-01 12:47 UTC. Original

Hacken says the attacker emptied hot wallets on 10 blockchains. Elliptic says 11 blockchains. The captured quotes do not reconcile the two counts.

Hacken wrote that on the evening of 29 October 2026 an attacker emptied Binance hot wallets on 10 blockchains.

On the evening of 29 October 2026, an attacker emptied Binance hot wallets on 10 blockchains

Hacken. Captured 2026-11-01 12:47 UTC. Original

Elliptic said the attacker drained Binance hot wallets across 11 blockchains over a few hours.

Over the course of a few hours, the attacker drained Binance hot wallets across 11 blockchains.

Elliptic. Captured 2026-11-01 12:47 UTC. Original

Competing descriptions of the mechanism

Theories on the theories page whose evidence includes a claim about how the attack worked. Each is speculation, attributed, with the quoted evidence for and against kept apart.

Theory Open

EIP-7702 caused the hack

After Binance co-CEO Richard Teng said the attacker used an EIP-7702 delegation, some commenters treated the Ethereum feature as the cause. Ethereum community member VEER said it gave attackers a handy sweep button on Ethereum.

Assessment on the theory page: EIP-7702 was used on Ethereum for the largest single transaction, about $2.53B according to Elliptic and Hacken. TRM Labs says Binance wallets on the other nine chains sent funds through ordinary signed transfers. Two security executives told Cointelegraph the theft could have been done without EIP-7702. Hacken and Blockaid's CEO describe a compromised signing path; in the sources captured as of 2026-11-01, Binance has not published a root cause.

10 quoted items of evidence

Context. Hacken said that at Binance the EIP-7702 delegation stayed in place for 3 hours 46 minutes after the sweep and later deposits were swept again.
At Binance the delegation stayed for 3 hours 46 minutes after the sweep and later deposits were swept again
Hacken. Original Statement 317 Captured 2026-11-01 12:47 UTC.
Note: The delegation stayed in place for 3 hours 46 minutes.
Evidence against. Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Hacken. Original Statement 326 Captured 2026-11-01 12:47 UTC.
Note: Signing system signed across chains.
Context. Blockaid said the EIP-7702 delegation was visible on-chain for three minutes and 24 seconds before the sweep.
The delegation itself was visible onchain for three minutes and 24 seconds before the sweep
blockaid.io. Original Statement 327 Captured 2026-11-01 12:47 UTC.
Note: Delegation visible before the sweep.
Context. Blockaid said its transaction security engine classified the delegation transaction as malicious because an EOA was being upgraded through EIP-7702 to an untrusted address.
Blockaid's transaction security engine classified the type-4 transaction that delegated Binance 14 as malicious on sight, with the reason that an EOA was being upgraded through EIP-7702 to an untrusted address.
blockaid.io. Original Statement 329 Captured 2026-11-01 12:47 UTC.
Note: Blockaid says its engine flagged the delegation.
Evidence against. TRM Labs said that on the nine chains other than Ethereum, Binance wallets sent funds to the attacker through ordinary signed transfers.
Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.
TRM Labs, TRM Labs. Original Statement 458 Captured 2026-11-01 12:48 UTC.
Note: Other chains used ordinary signed transfers.
Evidence for. Cointelegraph reported that co-CEO Richard Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, and that the delegation did not pass through Binance's normal approval controls.
The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”
Richard Teng, Cointelegraph. Original Statement 134 Captured 2026-11-01 12:52 UTC.
Note: Teng: the delegation did not pass through normal approval controls.
Evidence against. Cointelegraph reported that Blockaid CEO Ido Ben-Natan said attackers could have stolen the funds without EIP-7702.
Attackers could have stolen the funds without EIP-7702, Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph on Friday.
Ido Ben-Natan, Cointelegraph. Original Statement 352 Captured 2026-11-01 12:52 UTC.
Note: Attackers could have stolen the funds without EIP-7702.
Evidence for. Cointelegraph quoted Ido Ben-Natan of Blockaid as saying the 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some checks.
“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,”
Ido Ben-Natan, Cointelegraph. Original Statement 353 Captured 2026-11-01 12:52 UTC.
Note: Blockaid's CEO: 7702 is a way to do it in one sweep.
Evidence for. Cointelegraph reported that Ethereum community member VEER said EIP-7702 gave attackers a handy sweep button on Ethereum.
VEER later said the Binance attack appeared broader than a single malicious signature, but that EIP-7702 gave attackers “a handy sweep button on Ethereum.”
Cointelegraph. Original Statement 354 Captured 2026-11-01 12:52 UTC.
Note: A handy sweep button on Ethereum.
Evidence against. Cointelegraph reported that Ambire CEO Ivo Georgiev said EIP-7702 made little difference because the hackers already had the ability to authorize transactions.
Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said that EIP-7702 made little difference to the attack because the hackers already had the ability to authorize transactions.
Ivo Georgiev, Cointelegraph. Original Statement 355 Captured 2026-11-01 12:52 UTC.
Note: EIP-7702 made little difference.

Theory Open

The North Korea attribution is wrong or premature

Some firms and commenters raised doubts about attributing the theft to North Korea's TraderTraitor group. Before the FBI statement, Hacken listed reasons for caution, including a small overlap with funds from the Bitget theft and a slower pace of conversion than it said North Korean groups usually show. On Hacker News, two commenters suggested North Korea was a convenient or politically attractive target to blame.

Assessment on the theory page: On 31 October the FBI said North Korea was responsible and named TraderTraitor. TRM Labs, Chainalysis and Elliptic reached the same view earlier. They cite the on-chain link to Bitget funds, the preparation, and methods similar to the Bybit theft. Hacken's reasons for caution were written before the FBI statement. The FBI statement we captured does not set out its evidence. In the sources captured as of 2026-11-01, the two Hacker News comments give no evidence for another actor. In the sources captured as of 2026-11-01, Binance has not published its root cause. Hacken wrote that "that firm", the Elliptic analysis it links, calls this "the most diagnostic fact still missing". As of 2026-11-01 the weight of captured public attribution points to North Korea, with technical questions still open.

16 quoted items of evidence

Context. The BBC described TraderTraitor as also known as the Lazarus Group.
they had robust intelligence pointing to North Korean state-backed hacking unit the Lazarus Group, also known as TraderTraitor
BBC News. Original Statement 338 Captured 2026-11-01 12:47 UTC.
Note: BBC says TraderTraitor is also known as Lazarus.
Evidence for. Hacken, giving reasons for caution on North Korea attribution, said the overlap with Bitget funds is small: about $39,000 of Binance funds at the shared address against about $510,000 from Bitget.
The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget
Hacken. Original Statement 319 Captured 2026-11-01 12:47 UTC.
Note: Hacken: overlap with Bitget funds is small.
Evidence for. Hacken said the thief left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where it said North Korean groups usually move faster.
The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster.
Hacken. Original Statement 320 Captured 2026-11-01 12:47 UTC.
Note: Hacken: slower conversion than usual for North Korean groups.
Evidence for. Hacken wrote that the root cause is still unpublished, which, it wrote, "that firm" calls "the most diagnostic fact still missing". The passage follows Hacken's link to an Elliptic analysis, which it calls "the most careful reading".
None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."
Hacken. Original Statement 911 Captured 2026-11-01 12:47 UTC.
Note: Hacken: root cause still unpublished. Hacken's text gives "the most diagnostic fact still missing" to the Elliptic analysis it links.
Context. Hacken wrote that no government had confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days.
Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days .
Hacken. Original Statement 912 Captured 2026-11-01 12:47 UTC.
Note: Written before the FBI statement.
Evidence against. Elliptic said very few actors could coordinate an attack across 11 blockchains in around three hours.
Very few actors could coordinate an attack across 11 blockchains in around three hours.
Elliptic, Elliptic. Original Statement 306 Captured 2026-11-01 12:47 UTC.
Note: Elliptic: few actors could coordinate this.
Evidence against. Elliptic said the Binance theft closely resembles the Bybit theft, in which a developer's machine at the wallet provider Safe{Wallet} was compromised.
This closely resembles the Bybit theft, in which North Korean hackers compromised a developer's machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved.
Elliptic, Elliptic. Original Statement 307 Captured 2026-11-01 12:47 UTC.
Note: Elliptic: resembles Bybit.
Evidence against. Elliptic said funds stolen from Binance and from the Bitget exploit have been combined in several wallets, and that the link was first reported by ZachXBT.
The two sets of funds have now been combined in several wallets, and the amount has grown overnight. The link was first reported by ZachXBT.
Elliptic, Elliptic. Original Statement 310 Captured 2026-11-01 12:47 UTC.
Note: Elliptic: Binance and Bitget funds combined in several wallets.
Context. WIRED reported, before the FBI statement, that neither Binance nor law enforcement officials had named suspected links to North Korean hackers.
Neither Binance nor law enforcement officials have named any suspected links between the attack and North Korean hackers.
WIRED. Original Statement 333 Captured 2026-11-01 12:48 UTC.
Note: WIRED, before the FBI statement.
Context. The Guardian live blog described TraderTraitor as having emerged from Lazarus, a group working from North Korea's Reconnaissance General Bureau.
TraderTraitor emerged from Lazarus, a group working from North Korea’s Reconnaissance General Bureau, a military intelligence agency.
The Guardian. Original Statement 402 Captured 2026-11-01 12:48 UTC.
Note: The Guardian says TraderTraitor emerged from Lazarus.
Evidence against. TRM Labs attributed the attack to TraderTraitor, which it called North Korea's elite hacking unit, with high confidence.
North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.
TRM Labs, TRM Labs. Original Statement 302 Captured 2026-11-01 12:48 UTC.
Note: TRM attributes to TraderTraitor with high confidence.
Evidence against. Cointelegraph reported that ZachXBT said Binance funds and Bitget funds were commingled in the same address, which he said indicates the same actor is likely behind both incidents.
“This indicates the same actor is likely behind both incidents,” he said.
ZachXBT, Cointelegraph. Original Statement 347 Captured 2026-11-01 12:52 UTC.
Note: ZachXBT says the same actor is likely behind both.
Evidence against. Chainalysis said its strongest evidence for TraderTraitor was seeing Binance funds commingle in real time with funds stolen in the Bitget exploit.
The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors.
Chainalysis, Chainalysis. Original Statement 297 Captured 2026-11-01 13:11 UTC.
Note: Chainalysis: funds commingled with Bitget funds.
Evidence against. The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October 2026.
The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
Federal Bureau of Investigation (FBI), FBI. Original Statement 295 Captured 2026-11-01 13:11 UTC.
Note: FBI says North Korea was responsible.
Evidence for. A Hacker News commenter commented that North Korea is a convenient target to blame instead of highlighting random insiders as the actual cause.
I think NK is a convenient target to blame, instead of highlighting that random events from random insiders across different financial operations are the actual cause.
Hacker News. Original Statement 423 Captured 2026-11-01 13:39 UTC.
Note: Commenter says North Korea is a convenient target.
Evidence for. A Hacker News commenter commented that picking politically attractive proxy scapegoats is a classic move.
Yet, picking politically attractive proxy-scapegoats is a classic pro move.
Hacker News. Original Statement 429 Captured 2026-11-01 13:39 UTC.
Note: Commenter says scapegoats are a classic move.

Theory Open

AI agents were used in the attack or the laundering

Reports of automated laundering led to questions about AI agents. Chainalysis said the attackers appear to use automation. A separate Chainalysis breach was described by The Block as the work of an AI-assisted hacker. Elliptic said whether the automation involves AI agents cannot be determined from on-chain data.

Assessment on the theory page: The captured sources say the laundering looks automated. None of the sources captured as of 2026-11-01 shows AI agents were used against Binance. Elliptic says the on-chain data cannot settle it. Chainalysis said its own breach is not related to the Binance theft. We found no source in the sources captured as of 2026-11-01 that reports evidence of AI agents in the Binance attack itself.

5 quoted items of evidence

Context. Elliptic said whether the laundering automation involves AI agents rather than conventional scripts cannot be determined from the on-chain data.
Whether the automation involves AI agents, rather than conventional scripts, cannot be determined from the on-chain data.
Elliptic, Elliptic. Original Statement 304 Captured 2026-11-01 12:47 UTC.
Note: Elliptic cannot determine this from on-chain data.
Context. Elliptic said the pattern of transactions suggests much of the laundering was carried out by software rather than by hand.
The pattern of transactions suggests that much of the laundering was carried out by software rather than by hand.
Elliptic, Elliptic. Original Statement 305 Captured 2026-11-01 12:47 UTC.
Note: Elliptic: software rather than hand.
Context. The Block reported that Chainalysis said an AI-assisted hacker breached its systems and accessed non-sensitive customer data including names and emails.
Blockchain analytics firm Chainalysis said an AI-assisted hacker breached its systems and accessed “non-sensitive” customer data, including names and emails.
The Block. Original Statement 459 Captured 2026-11-01 13:01 UTC.
Note: A separate Chainalysis breach.
Evidence against. The Block reported that Chainalysis said its own breach is not related to the Binance theft.
Chainalysis said the incident is "not related to the recent crypto theft at Binance."
Chainalysis, The Block. Original Statement 460 Captured 2026-11-01 13:01 UTC.
Note: Chainalysis says its breach is unrelated to the Binance theft.
Context. Chainalysis said many addresses receive exactly 1 TRX, then more funds, then forward them, and that this repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.
This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.
Chainalysis, Chainalysis. Original Statement 296 Captured 2026-11-01 13:11 UTC.
Note: Chainalysis: programmatic process.

Theory Open

Questions raised about approval controls during the 20-minute transfer

TRM Labs and WIRED report that most of the money left in about 20 minutes. Kok Tin Gan of NyxLab told NPR the event raises questions about why stronger approval controls were not in place. Binance co-CEO Richard Teng said the attacker's delegation did not pass through normal approval controls.

Assessment on the theory page: Sources agree the main drain took about 20 minutes, with one Ethereum transaction of about $2.53B at 20:24 UTC. Blockaid says it flagged the drain under two minutes after the sweep and that the delegation was visible on-chain for 3 minutes 24 seconds before it. Hacken says the delegation stayed in place for 3 hours 46 minutes and that nobody outside Binance knows whether a policy layer was set. In the sources captured as of 2026-11-01, Binance has not said when it first detected the transfers or what limits its signing system applied. The attacker destroyed tooling and traces, Teng said, which complicates the investigation. The post-mortem Binance promised should answer these points.

12 quoted items of evidence

Context. Hacken said most of the money left in about 20 minutes, with a smaller second wave on Avalanche and Polygon around 23:05 UTC.
Most of the money left in about 20 minutes, and a smaller second wave hit Avalanche and Polygon around 23:05 UTC.
Hacken. Original Statement 315 Captured 2026-11-01 12:47 UTC.
Note: Hacken agrees on about 20 minutes.
Evidence for. Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures.
Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.
Hacken. Original Statement 316 Captured 2026-11-01 12:47 UTC.
Note: Policy layer unknown. (in the sources captured as of 2026-11-01)
Evidence for. Hacken said that at Binance the EIP-7702 delegation stayed in place for 3 hours 46 minutes after the sweep and later deposits were swept again.
At Binance the delegation stayed for 3 hours 46 minutes after the sweep and later deposits were swept again
Hacken. Original Statement 317 Captured 2026-11-01 12:47 UTC.
Note: Delegation stayed 3 hours 46 minutes.
Context. Hacken said stablecoin issuers began freezing funds 56 minutes after the first transfer.
Stablecoin issuers began freezing funds 56 minutes after the first transfer.
Hacken. Original Statement 318 Captured 2026-11-01 12:47 UTC.
Note: First freezes 56 minutes after the first transfer.
Context. Hacken recommended that wallet operators cap value and rate per wallet at the signer and hold new destinations for a second approval.
Cap value and rate per wallet at the signer and hold new destinations for a second approval
Hacken. Original Statement 324 Captured 2026-11-01 12:47 UTC.
Note: Hacken's suggested limits.
Evidence for. NPR reported that Kok Tin Gan of NyxLab said the event raises questions about why stronger approval controls were not in place.
The event, meanwhile, also raises questions about why stronger approval controls were not in place, said Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab.
Kok Tin Gan, npr.org. Original Statement 331 Captured 2026-11-01 12:47 UTC.
Note: Questions about approval controls.
Evidence for. Blockaid said the EIP-7702 delegation was visible on-chain for three minutes and 24 seconds before the sweep.
The delegation itself was visible onchain for three minutes and 24 seconds before the sweep
blockaid.io. Original Statement 327 Captured 2026-11-01 12:47 UTC.
Note: Delegation visible for 3 minutes 24 seconds before the sweep.
Evidence for. Blockaid said its detection flagged the drain under two minutes after the sweep and before any public report.
Blockaid’s detection flagged the drain under two minutes after the sweep and before any public report
blockaid.io. Original Statement 328 Captured 2026-11-01 12:47 UTC.
Note: An outside firm flagged it within two minutes.
Context. WIRED reported, citing TRM Labs, that the majority of the stolen crypto was taken in around 20 minutes on 29 October.
The majority of the stolen crypto was taken in a period of around 20 minutes on October 29, according to analysis by crypto tracing firm TRM Labs.
WIRED. Original Statement 332 Captured 2026-11-01 12:48 UTC.
Note: Most funds taken in about 20 minutes.
Context. Cointelegraph reported that co-CEO Richard Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, and that the delegation did not pass through Binance's normal approval controls.
The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”
Richard Teng, Cointelegraph. Original Statement 134 Captured 2026-11-01 12:52 UTC.
Note: Delegation did not pass through normal approval controls.
Evidence against. Cointelegraph reported that Richard Teng said the attacker used a self-destruct mechanism to destroy tools and traces, complicating the investigation.
Teng also disclosed that the attacker used a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation.
Richard Teng, Cointelegraph. Original Statement 340 Captured 2026-11-01 12:52 UTC.
Note: Teng says the attacker destroyed tooling and traces.
Context. Cointelegraph reported that concerns were first raised by blockchain researcher Spreek on X.
Concerns were first raised by blockchain researcher Spreek, who
Spreek, Cointelegraph. Original Statement 411 Captured 2026-11-01 12:52 UTC.
Note: An on-chain researcher raised the first alert.

Theory Contradicted

The Ethereum authorizations were phished

Early indicators on the Ethereum activity suggested the attacker had phished the authorizations, according to TRM Labs and Hacken.

Assessment on the theory page: Both firms said this would explain Ethereum but none of the other chains. TRM Labs says wallets on the other nine chains sent funds through ordinary signed transfers. Blockaid's CEO and later analyses point to a compromise of the signing system, not a leaked key. Binance says it found no evidence of a private key leak. No source in the sources captured as of 2026-11-01 now defends the phishing explanation.

7 quoted items of evidence

Context. Hacken said Binance's statement that no private key leaked and investigators' view that Binance's signing system signed for the attacker can both be true.
Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.
Hacken. Original Statement 323 Captured 2026-11-01 12:47 UTC.
Note: No key leak and a compromised signing system can both be true.
Evidence for. Hacken said early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
Hacken. Original Statement 325 Captured 2026-11-01 12:47 UTC.
Note: Hacken: early signs pointed to phishing.
Evidence against. Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
Hacken. Original Statement 326 Captured 2026-11-01 12:47 UTC.
Note: Most likely the signing system signed.
Evidence against. The page states that eleven Binance hot-wallet keys signed transfers to an address created minutes earlier, and one signed an EIP-7702 authorization.
Eleven Binance hot-wallet keys signed transfers to an address created minutes earlier, and one of them signed an EIP-7702 authorization that turned its wallet into standing infrastructure for the attacker.
blockaid.io. Original Statement 89 Captured 2026-11-01 12:47 UTC.
Note: Eleven hot-wallet keys signed transfers.
Evidence for. TRM Labs said early indicators suggested the attacker had phished the Ethereum authorizations, but that this leaves the other chains unexplained.
Early indicators on the Ethereum activity suggested the attacker had phished the authorizations. That explanation covers Ethereum and leaves the other chains unexplained.
TRM Labs, TRM Labs. Original Statement 303 Captured 2026-11-01 12:48 UTC.
Note: TRM: early indicators suggested phishing.
Evidence against. TRM Labs said that on the nine chains other than Ethereum, Binance wallets sent funds to the attacker through ordinary signed transfers.
Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.
TRM Labs, TRM Labs. Original Statement 458 Captured 2026-11-01 12:48 UTC.
Note: Other chains used ordinary signed transfers.
Evidence against. Cointelegraph quoted Blockaid CEO Ido Ben-Natan as describing a compromise of signing infrastructure and saying he did not think a key was leaked.
a compromise of signing infrastructure. We don’t think a key was leaked,” he said.
Ido Ben-Natan, Cointelegraph. Original Statement 475 Captured 2026-11-01 13:01 UTC.
Note: Blockaid's CEO: signing infrastructure compromised, key not leaked.

Theory Open

A compromised vendor or software supply chain was involved

Commenters and analysts asked whether a vendor or supply chain compromise was involved. Binance said it found additional points of breach beyond an engineer's laptop. Elliptic said the theft resembles Bybit, where a developer's machine at the wallet provider Safe{Wallet} was compromised.

Assessment on the theory page: In the sources captured as of 2026-11-01, Binance has not said whether any third-party vendor was involved. Its updates describe an engineer's laptop and additional points of breach without detail. The Polymarket compromise earlier on 29 October involved a third-party provider, but the Guardian called it an unrelated incident. Chainalysis said its own breach is not related to the Binance theft. We found no source in the sources captured as of 2026-11-01 that links a vendor compromise to Binance. The promised post-mortem may settle this.

6 quoted items of evidence

Context. Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures.
Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.
Hacken. Original Statement 316 Captured 2026-11-01 12:47 UTC.
Note: Signing-system design not public. (in the sources captured as of 2026-11-01)
Context. Elliptic said the Binance theft closely resembles the Bybit theft, in which a developer's machine at the wallet provider Safe{Wallet} was compromised.
This closely resembles the Bybit theft, in which North Korean hackers compromised a developer's machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved.
Elliptic, Elliptic. Original Statement 307 Captured 2026-11-01 12:47 UTC.
Note: Bybit loss involved a compromised developer machine at Safe{Wallet}.
Context. The Block reported that Chainalysis said its own breach is not related to the Binance theft.
Chainalysis said the incident is "not related to the recent crypto theft at Binance."
Chainalysis, The Block. Original Statement 460 Captured 2026-11-01 13:01 UTC.
Note: Chainalysis says its own breach is unrelated.
Context. Binance said in its second 30 October update that its later investigation had uncovered additional points of breach beyond a compromised laptop.
Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach.
Binance, Binance. Original Statement 284 Captured 2026-11-01 13:11 UTC.
Note: Binance found additional points of breach.
Evidence against. The Guardian reported that, in an incident it described as unrelated, the prediction market operator Polymarket temporarily halted trading earlier on Thursday after a security incident involving a third-party provider.
In an unrelated incident earlier on Thursday, the prediction market operator Polymarket temporarily halted trading after a security incident involving a third-party provider.
The Guardian. Original Statement 913 Captured 2026-11-01 13:11 UTC.
Note: The Guardian calls the Polymarket halt unrelated.
Evidence against. A Hacker News commenter replied that the actors behind that supply chain attack did not seem to have the skills to reach a full Binance compromise within hours.
I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.
Hacker News. Original Statement 426 Captured 2026-11-01 13:39 UTC.
Note: Replies that the other attack's actors lacked the skills to reach Binance in hours.

Theory Open

The timing of the theft was linked to other events

The theft came days before a US election and while the Clarity Act was stalled in the Senate. A separate Polymarket compromise happened the same day. Politicians used the hack in arguments about crypto legislation.

Assessment on the theory page: The sources captured as of 2026-11-01 show coincidences of date. They do not show a link. TRM Labs says preparation began at least 36 hours before the theft. Nothing in the sources captured as of 2026-11-01 shows the attacker chose the date for political or market reasons, and no source says so. The politicians quoted were using the event in debate. They were not claiming to know who chose the timing. Bitcoin was about 4% below its pre-attack price two days later, and Cointelegraph also cited a tech-stock sell-off.

10 quoted items of evidence

Evidence against. TRM Labs said preparation began at least 36 hours before the theft, with the operator wallet receiving three small Tornado Cash withdrawals from the morning of 28 October.
Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.
TRM Labs, TRM Labs. Original Statement 301 Captured 2026-11-01 12:48 UTC.
Note: Preparation began at least 36 hours earlier.
Context. Cointelegraph reported that Bitcoin traded near $77,400 on Saturday, about 4% below its price shortly before the attack began.
Bitcoin traded near $77,400 at 4:00 pm on Saturday, about 4% below its price shortly before the attack began Thursday
Cointelegraph. Original Statement 366 Captured 2026-11-01 12:52 UTC.
Note: Bitcoin about 4% below its pre-attack price.
Context. Cointelegraph quoted Senator Cynthia Lummis as saying the stalled Clarity Act would have given crypto firms legal cover to freeze suspicious transactions the instant law enforcement calls.
The Clarity Act would have given crypto firms legal cover to freeze suspicious transactions the instant law enforcement calls.
Cointelegraph. Original Statement 370 Captured 2026-11-01 12:52 UTC.
Note: Senator Lummis cites the stalled Clarity Act.
Context. Cointelegraph quoted CFTC Chair Michael Selig as saying the hack proves the CFTC's point in proposing regulations for crypto markets.
“This proves our exact point in proposing regulations for crypto markets.
Michael Selig, Cointelegraph. Original Statement 371 Captured 2026-11-01 12:52 UTC.
Note: CFTC Chair Selig says the hack proves the CFTC's point.
Context. Cointelegraph reported that it was not clear whether there was any immediate political advantage to be gained from the hack, but that Republican and Democratic sides began staking out positions almost immediately.
It was not clear whether there was any immediate political advantage to be gained from the hack, which was widely attributed to a North Korean group, but Republican and Democratic sides began staking out positions almost immediately.
Cointelegraph. Original Statement 372 Captured 2026-11-01 12:52 UTC.
Note: Cointelegraph: unclear whether anyone gains.
Context. Cointelegraph reported that political and administration figures began offering opinions on the hack with a US election approaching on 3 November.
Soon after the $6.3 billion hack of Binance, the biggest in crypto history, some political and administration figures began offering their opinions with a US election approaching on Nov. 3 and voting already having begun in many locations.
Cointelegraph. Original Statement 373 Captured 2026-11-01 12:52 UTC.
Note: US election on 3 November.
Context. Cointelegraph reported that crypto company shares fell sharply on Friday, with Coinbase down more than 13% a day after reporting lower third-quarter revenue.
Shares of publicly traded cryptocurrency companies fell sharply Friday, with Coinbase dropping more than 13% a day after reporting a decline in third-quarter revenue
Cointelegraph. Original Statement 369 Captured 2026-11-01 12:52 UTC.
Note: Coinbase fell a day after reporting lower revenue.
Context. Cointelegraph reported that the hack's effect on crypto markets was compounded by tech-stock losses tied to Q4 earnings projections.
The effects of the hack on crypto markets were compounded by tech-stock losses that came with Q4 earnings projections.
Cointelegraph. Original Statement 368 Captured 2026-11-01 12:52 UTC.
Note: Tech-stock losses compounded the move.
Evidence against. The Guardian reported that, in an incident it described as unrelated, the prediction market operator Polymarket temporarily halted trading earlier on Thursday after a security incident involving a third-party provider.
In an unrelated incident earlier on Thursday, the prediction market operator Polymarket temporarily halted trading after a security incident involving a third-party provider.
The Guardian. Original Statement 913 Captured 2026-11-01 13:11 UTC.
Note: The Guardian calls the Polymarket halt unrelated.
Evidence against. A Hacker News commenter replied that the actors behind that supply chain attack did not seem to have the skills to reach a full Binance compromise within hours.
I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.
Hacker News. Original Statement 426 Captured 2026-11-01 13:39 UTC.
Note: Commenter doubts that actor could reach Binance in hours.

Theory Unsupported

Was an insider involved? Commenters' question, no evidence reported

No source captured as of 2026-11-01 reports evidence that an insider was involved, and no investigator or official in those sources has said so. Some Hacker News commenters asked whether the theft was an inside job, and one wrote that it was almost certainly an inside job given the knowledge of Binance systems the attack needed. This is speculation by commenters.

Assessment on the theory page: Commenters point to the knowledge of Binance systems the attack needed. Binance's co-CEO said the investigation has not attributed responsibility to any individual. The FBI says North Korea's TraderTraitor group is responsible. We found no source, in the sources captured as of 2026-11-01, that reports evidence of knowing insider involvement. In the sources captured as of 2026-11-01, Binance has not yet published its post-mortem, so how the attacker obtained the signatures is not public. We do not identify or comment on any individual.

8 quoted items of evidence

Context. Hacken said nobody outside Binance knows whether a policy layer was set on the signing system, what it checked, or how the attacker obtained signatures.
Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.
Hacken. Original Statement 316 Captured 2026-11-01 12:47 UTC.
Note: How signatures were obtained is not public. (in the sources captured as of 2026-11-01)
Context. Elliptic reported that Richard Teng said in a video update that the attack was not carried out by one person.
Teng added that the attack "was not carried out by one person"
Elliptic, Elliptic. Original Statement 308 Captured 2026-11-01 12:47 UTC.
Note: Teng said the attack was not carried out by one person.
Context. TRM Labs said preparation began at least 36 hours before the theft, with the operator wallet receiving three small Tornado Cash withdrawals from the morning of 28 October.
Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.
TRM Labs, TRM Labs. Original Statement 301 Captured 2026-11-01 12:48 UTC.
Note: Preparation traced on-chain, including test runs.
Context. Cointelegraph reported that Richard Teng wrote that Binance's investigation has not attributed responsibility to any individual.
“Our investigation has not attributed responsibility to any individual,” he wrote.
Richard Teng, Cointelegraph. Original Statement 346 Captured 2026-11-01 12:52 UTC.
Note: Binance has not attributed responsibility to any individual. (in the sources captured as of 2026-11-01)
Evidence against. The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October 2026.
The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
Federal Bureau of Investigation (FBI), FBI. Original Statement 295 Captured 2026-11-01 13:11 UTC.
Note: The FBI attributes the theft to North Korea.
Context. A Hacker News commenter commented that the hack was almost certainly an inside job given the knowledge of Binance systems required.
And almost certainly an inside job given the knowledge of Binance systems required.
Hacker News. Original Statement 375 Captured 2026-11-01 13:33 UTC.
Note: Commenter's view, no evidence given. (in the sources captured as of 2026-11-01)
Context. A Hacker News commenter wrote that a risk management system should not let $5bn be transferred instantly, and wondered whether it was an inside job.
You split it into thousands and then use hardware security modules with a risk management system so it doesn't let you transfer $5bn instantly. Unless it was an inside job maybe? I'd be really curious to know what their security architecture was.
Hacker News. Original Statement 473 Captured 2026-11-01 13:39 UTC.
Note: Asks about an inside job after noting the size of the transfers.
Context. A Hacker News commenter asked whether there was actually a hack into Binance systems or just an insider or credential leak.
Was there actually a hack into binance systems, or was it just some insider or credential leak?
Hacker News. Original Statement 424 Captured 2026-11-01 13:39 UTC.
Note: A question, not an assertion.

Mechanisms described for earlier incidents

Statements dated before this incident in which a source describes how an earlier incident worked. They are listed for comparison with the descriptions above. A resemblance is the source's own observation and is not evidence about this incident. Their attribution statements are on the attribution page.

Official The FBI, DC3 and Japan's National Police Agency said in their DMM notice that TraderTraitor activity is often characterized by targeted social engineering directed at multiple employees of the same company simultaneously.
Quoted text
TraderTraitor activity is often characterized by targeted social engineering directed at multiple employees of the same company simultaneously.
Federal Bureau of Investigation (FBI), FBI. Original Statement 795 Captured 2026-11-01 14:48 UTC.
Official The FBI, DC3 and Japan's National Police Agency said a North Korean cyber actor posing as a LinkedIn recruiter contacted an employee of Ginco, a Japan-based wallet software company, in late March 2024.
Quoted text
In late March 2024, a North Korean cyber actor, masquerading as a recruiter on LinkedIn, contacted an employee at Ginco, a Japan-based enterprise cryptocurrency wallet software company.
Federal Bureau of Investigation (FBI), FBI. Original Statement 796 Captured 2026-11-01 14:48 UTC.
Official The FBI, DC3 and Japan's National Police Agency said that after mid-May 2024 TraderTraitor actors exploited session cookie information to impersonate the compromised employee, and that in late May the actors likely used the access to manipulate a legitimate transaction request, causing the loss of 4,502.9 BTC.
Quoted text
After mid-May 2024, TraderTraitor actors exploited session cookie information to impersonate the compromised employee
Federal Bureau of Investigation (FBI), FBI. Original Statement 797 Captured 2026-11-01 14:48 UTC.
Official The FBI, DC3 and Japan's National Police Agency said the actors likely used their access in late May 2024 to manipulate a legitimate transaction request by a DMM employee, resulting in the loss of 4,502.9 BTC worth $308 million at the time.
Quoted text
In late-May 2024, the actors likely used this access to manipulate a legitimate transaction request by a DMM employee, resulting in the loss of 4,502.9 BTC, worth $308 million at the time of the attack.
Federal Bureau of Investigation (FBI), FBI. Original Statement 798 Captured 2026-11-01 14:48 UTC.
Reported Halborn said the root of the Bybit transaction was a malicious transaction designed to modify the smart contract logic of the exchange's multi-signature wallet.
Quoted text
The root of the Bybit transaction was a malicious transaction designed to modify the smart contract logic of the exchange’s multi-signature wallet.
Halborn. Original Statement 804 Captured 2026-11-01 14:48 UTC.
Reported Chainalysis said the Bybit attack highlights a common DPRK playbook of social engineering attacks and intricate laundering methods.
Quoted text
This attack highlights a common playbook used by the DPRK: orchestrating social engineering attacks and employing intricate laundering methods in an attempt to move stolen funds undetected.
Chainalysis, Chainalysis. Original Statement 803 Captured 2026-11-01 14:48 UTC.
Official The FBI said in its 26 February 2025 Bybit notice that it refers to this North Korean malicious cyber activity as TraderTraitor.
Quoted text
FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor
Federal Bureau of Investigation (FBI), FBI IC3. Original Statement 791 Captured 2026-11-01 14:48 UTC.

Labelled speculation

Statements recorded with status theory about how the attack worked. They are opinions from named or anonymous commenters, not evidence.

7 labelled statements

Theory Kok Tin Gan, cofounder and CEO of NyxLab, stated that the incident looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet.
"This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet," he said, referring to cryptocurrency wallets that hold users' "private keys," or unique authorizations, digitally and which are connected to the internet.
Kok Tin Gan, npr.org. Original Statement 53 Captured 2026-11-01 12:47 UTC.
Theory A Hacker News commenter commented that the hack was almost certainly an inside job given the knowledge of Binance systems required.
And almost certainly an inside job given the knowledge of Binance systems required.
Hacker News. Original Statement 375 Captured 2026-11-01 13:33 UTC.
Theory A Hacker News commenter commented 'My money is on an inside job.'
My money is on an inside job.
Hacker News. Original Statement 422 Captured 2026-11-01 13:39 UTC.
Theory A Hacker News commenter asked whether there was actually a hack into Binance systems or just an insider or credential leak.
Was there actually a hack into binance systems, or was it just some insider or credential leak?
Hacker News. Original Statement 424 Captured 2026-11-01 13:39 UTC.
Theory A Hacker News commenter commented that the timing of a separate software supply chain attack was not a coincidence.
Something tells me that the timing of the Claude Code supply chain attack is not a coincidence
Hacker News. Original Statement 425 Captured 2026-11-01 13:39 UTC.
Theory A Hacker News commenter replied that the actors behind that supply chain attack did not seem to have the skills to reach a full Binance compromise within hours.
I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.
Hacker News. Original Statement 426 Captured 2026-11-01 13:39 UTC.
Theory A Hacker News commenter wrote that a risk management system should not let $5bn be transferred instantly, and wondered whether it was an inside job.
You split it into thousands and then use hardware security modules with a risk management system so it doesn't let you transfer $5bn instantly. Unless it was an inside job maybe? I'd be really curious to know what their security architecture was.
Hacker News. Original Statement 473 Captured 2026-11-01 13:39 UTC.

Root-cause claims not placed under a stage

Official Binance said in Recovery Update #4 that it will publish a post-incident report with further details once the investigation is complete. Binance, Binance
Official Binance said in its second 30 October update that it expected to share further technical findings within about 48 hours. Binance, Binance
Reported Elliptic said the Binance theft closely resembles the Bybit theft, in which a developer's machine at the wallet provider Safe{Wallet} was compromised. Elliptic, Elliptic
Reported Ivo Georgiev stated that EIP 7702 is a problem because it is very poorly understood. Ivo Georgiev, Cointelegraph
Reported Richard Teng stated that the hack targeted Binance's own hot wallet and did not impact customer funds, which are primarily held in cold wallets. Richard Teng, Decrypt

Attack reconstruction

Minute by minute

2026-10-29

2026-10-30

2026-10-31

Initial access

No time stated

Internal movement

No time stated

Withdrawal transactions

No time stated

Per-chain draining

Ethereum

Bitcoin

XRP Ledger

Solana

Arbitrum

Avalanche

Polygon

Freezes

No time stated

Consolidation

No time stated

Laundering

No time stated

Not yet explained

Open questions

Sources saying it is not explained

Disagreements

Disagreements about time (3)

Hacken's timeline shows Tether freezing 971.1M USDT at 21:01 (UTC). Chainalysis says issuers began freezing by 5:14 p.m. ET, which is 21:14 UTC if Eastern Daylight Time is meant.

Binance says the hot wallets were compromised at around 20:05 UTC. Chainalysis says funds began leaving at around 4:20 p.m. ET. The sources do not say whether these refer to the same first transfer.

Disagreements about mechanism (1)

Binance's first 30 October update pointed to a compromised DevOps engineer's laptop. Its second update the same day said later investigation had uncovered additional points of breach.

Other disagreements: counts and amounts (5)

Binance puts the loss at about $6.3B. Elliptic counts $6.43B and says its total excludes a further $169 million that left after withdrawals were suspended. The sources do not say whether the gap comes from pricing time, chains counted or other scope.

Chainalysis is quoted with two totals: about $6.4 billion in its own write-up and $5.912 billion at the time of theft in an earlier Cointelegraph report. Both are attributed to Chainalysis.

Binance says approximately $3 billion is frozen. Elliptic says it has verified $2.85 billion. Chainalysis counts about $2.8 billion. The sources date their counts differently or not at all.

Tether's CEO is quoted as saying more than $1.567 billion in USDT was frozen. Elliptic says Tether froze the main attacker Ethereum wallet, locking 1.18 billion USDT, and then froze four more addresses.

Hacken says the attacker emptied hot wallets on 10 blockchains. Elliptic says 11 blockchains. The captured quotes do not reconcile the two counts.

Competing descriptions of the mechanism

Mechanisms described for earlier incidents

Labelled speculation

Root-cause claims not placed under a stage