Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

The Binance Hack

An independent record of the October 2026 Binance hack

Attack reconstruction: Consolidation

Back to the overview · Previous stage: Freezes · Next stage: Laundering

The claims placed under one stage of the attack, each with its source. The quote, the capture time and the hash of the stored copy are on the statement page that each line links to. Which stage a claim sits under is chosen by keywords in its one-line summary, so it is a reading aid and not a finding.

3 approved claims under this stage.

Consolidation

Where taken funds are said to have been gathered, and what the attacker is said to hold afterwards.

  1. Reported other

    Halborn said that between 20:30 and 20:33, before Tether acted, 700 million USDT left the hub in two transfers, and that Tether later caught 205 million of it one and two hops downstream.

    Halborn. Original Statement 765 Captured .

No time stated

  1. No time stated
    Reported other

    Elliptic said the attacker controls around $3.25 billion of assets that an issuer cannot freeze, spread across more than 800 addresses, including around 584,000 ETH, 18,327 BTC and 233 million XRP.

    Elliptic, Elliptic. Original Statement 101 Captured .

  2. No time stated
    Reported other

    TRM said the attacker now held more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach.

    TRM Labs, TRM Labs. Original Statement 152 Captured .