Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

The Binance Hack

An independent record of the October 2026 Binance hack

Attack reconstruction: Per-chain draining

Back to the overview · Previous stage: Withdrawal transactions · Next stage: Freezes

The claims placed under one stage of the attack, each with its source. The quote, the capture time and the hash of the stored copy are on the statement page that each line links to. Which stage a claim sits under is chosen by keywords in its one-line summary, so it is a reading aid and not a finding.

12 approved claims under this stage.

Per-chain draining

Statements about individual blockchains, grouped under each chain the statement names.

Ethereum

  1. Reported recovery

    Arkham stated that early Friday, the attacker's wallets sent $38.82 million in Ethereum to a new address while still holding $1.12 billion in ETH.

    Arkham Intelligence, Decrypt. Original Statement 681 Captured .

  2. No time stated
    Reported amount

    Cointelegraph reported that Blockaid said it had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.

    Cointelegraph. Original Statement 117 Captured .

Bitcoin

  1. Reported amount

    Hacken said that at 20:20 UTC, a Bitcoin hot wallet sent out 18,270 BTC.

    Hacken. Original Statement 17 Captured .

  2. Reported amount

    TRM said a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address at 20:20 UTC, and that the funds began splitting into round pieces inside the same block.

    Timeline row: TRM said a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address

    TRM Labs, TRM Labs. Original Statement 140 Captured .

XRP Ledger

  1. Reported amount

    Hacken said that the first transfers occurred at 20:05 UTC on the XRP Ledger, where five Binance wallets sent 233 million XRP to a single address.

    Hacken. Original Statement 16 Captured .

  2. Reported amount

    TRM said that between 20:05 and 20:09 UTC five Binance wallets on the XRP Ledger sent 233.46 million XRP to a single attacker address.

    Timeline row: TRM said five Binance wallets on the XRP Ledger sent 233.46M XRP to one address between 20:05 and 20:09

    TRM Labs, TRM Labs. Original Statement 139 Captured .

  3. Reported amount

    Halborn's table put the loss on the XRP Ledger at 233.46 million XRP, about 296 million dollars, from five wallets each emptied to the reserve minimum.

    Halborn. Original Statement 984 Captured .

Solana

  1. No time stated
    Reported root cause

    Halborn said Bitquery notes the XRP and Solana drains share no address with the rest of the operation and are tied to it only by timing and transaction construction, a tie Halborn accepted with that caveat.

    Halborn. Original Statement 770 Captured .

Arbitrum

  1. No time stated
    Reported amount

    Cointelegraph reported that Blockaid said it had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.

    Cointelegraph. Original Statement 117 Captured .

  2. No time stated
    Reported amount

    Blockaid said that within 12 minutes, Binance 55 on Optimism sent 44.2M OP, four hot wallets on Arbitrum sent 74.6M ARB and 8,426 ETH, and four on Avalanche sent 1.81M AVAX and 8.41M USDT.

    Blockaid. Original Statement 966 Captured .

Optimism

  1. No time stated
    Reported amount

    Blockaid said that within 12 minutes, Binance 55 on Optimism sent 44.2M OP, four hot wallets on Arbitrum sent 74.6M ARB and 8,426 ETH, and four on Avalanche sent 1.81M AVAX and 8.41M USDT.

    Blockaid. Original Statement 966 Captured .

Avalanche

  1. Reported amount

    TRM said a second wave around 23:05 UTC reached Binance wallets on Avalanche and Polygon.

    Timeline row: TRM said a second wave of transfers reached Binance wallets on Avalanche and Polygon

    TRM Labs, TRM Labs. Original Statement 149 Captured .

  2. Reported amount

    Hacken's timeline table lists a second wave of transfers from Binance wallets on Avalanche and Polygon at 23:05 UTC.

    Hacken. Original Statement 156 Captured .

  3. No time stated
    Reported amount

    Cointelegraph reported that Blockaid said it had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.

    Cointelegraph. Original Statement 117 Captured .

  4. No time stated
    Reported amount

    Hacken said most of the money left in about 20 minutes, with a smaller second wave on Avalanche and Polygon around 23:05 UTC.

    Hacken. Original Statement 315 Captured .

  5. No time stated
    Reported amount

    Blockaid said that within 12 minutes, Binance 55 on Optimism sent 44.2M OP, four hot wallets on Arbitrum sent 74.6M ARB and 8,426 ETH, and four on Avalanche sent 1.81M AVAX and 8.41M USDT.

    Blockaid. Original Statement 966 Captured .

Polygon

  1. Reported amount

    TRM said a second wave around 23:05 UTC reached Binance wallets on Avalanche and Polygon.

    Timeline row: TRM said a second wave of transfers reached Binance wallets on Avalanche and Polygon

    TRM Labs, TRM Labs. Original Statement 149 Captured .

  2. Reported amount

    Hacken's timeline table lists a second wave of transfers from Binance wallets on Avalanche and Polygon at 23:05 UTC.

    Hacken. Original Statement 156 Captured .

  3. No time stated
    Reported amount

    Hacken said most of the money left in about 20 minutes, with a smaller second wave on Avalanche and Polygon around 23:05 UTC.

    Hacken. Original Statement 315 Captured .

Stored records per chain (counts of rows, not amounts)
ChainClaims under this stageAddresses named by a sourceArchived transfersBlacklist events for listed addresses
Ethereum2Attacker: 610; Intermediary: 1; Victim: 245566
Bitcoin2Attacker: 191620
XRP Ledger3none00
Solana1Attacker: 100
Arbitrum2none00
Optimism1none00
Avalanche5none00
Polygon3none00