Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
Each claim is one attributed statement with a verbatim quote from a stored copy of the source. Only claims a person has approved are shown.
Official means the party said it, not that it is true.
348 claims.
In March 2022, hackers compromised the Ronin Network, stealing approximately US$620 million worth of cryptocurrency from the project.
was an attack conducted by anonymous hackers on August 10, 2021. The attack transferred over $610 million in digital
Some $473 million in funds were later taken from FTX in an "unauthorized transaction".
after having lost 744,408 bitcoins in a theft which went undetected for years.
In January 2018, Coincheck was hacked and approximately 500 million NEM tokens ($530 million) were stolen.
Download every address our investigators have linked to the Binance hack as a single CSV file.
On October 29, about $6.43 billion was stolen from Binance across 11 blockchains.
Reviewer note: TRM and Hacken count ten blockchains.
Swaps into THORChain use the same amounts again and again, with one value appearing 19 times.
The main Tron distribution wallet has sent funds every hour for 31 hours straight.** The longest pause was 46 minutes, and there was no overnight break.
The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:
Reviewer note: The FBI list has 608 ETH, 19 BTC and 1 SOL addresses. They are in the alert; the Wallets page lists them with this claim as provenance.
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
“First batch network now opened in phase one of withdrawals is $BTC bitcoin network,” Binance said on X.
Reviewer note: Binance's own words, quoted on X as reported by Cointelegraph.
Binance is preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 (UTC).
Reviewer note: 06:00 UTC is the start of the window Binance announced, not a time at which withdrawals were confirmed open.
November 1, 06:00 UTC: Binance announced it has begun reopening withdrawals, starting with $BTC Bitcoin network.
Reviewer note: The 06:00 UTC time is as written in Elliptic's update log, not a time stated by Binance.
Deposit services remain open and are not affected by the incident.
Once the investigation is complete, we will publish a post-incident report with further details on the incident.
Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update. The outstanding 5% are tokens outside the top ten listed above, and are less liquid in the market and take longer time to source at the required scale.
Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users.
Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update.
October 31, 22:41 UTC.** About $196 million has been sent out of the main Tron distribution wallet to around 200 wallets,
Bitcoin traded near $77,400 at 4:00 pm on Saturday, about 4% below its price shortly before the attack began Thursday
they had robust intelligence pointing to North Korean state-backed hacking unit the Lazarus Group, also known as TraderTraitor
The US Secret Service said on Friday it is "working around the clock" with private sector partners "to identify, freeze, trace, and recover funds" stolen from Binance.