Press kit

For journalists and researchers. This site is an independent record, not a news organisation and not associated with Binance. It records who said what, with a link and an archived copy, so you can check the original.

How to cite

Cite the original publisher, not this site, for anything that is a claim. Every claim page gives the publisher, the original link, the capture time and the sha256 of our archived copy.
Use the status label with care. Official means the party said it, not that it is true. Reported means a media outlet or analytics firm said it. Only Verified on-chain is our own reproducible calculation, and its method is shown.
Where figures differ between sources we show them all and never average them. Quote the one you are using, with its source.
Cite this site for the archive and the on-chain calculations, with the address of the specific page.

Suggested form:

"<claim summary>", <publisher>, <date the page was captured>. Archived at https://binancebreach.com/claims/<claim number>

Stable addresses

A claim: https://binancebreach.com/claims/<number>. If a claim is later superseded the page stays and links to its replacement.
A daily briefing: https://binancebreach.com/updates/<YYYY-MM-DD>. A detected edit to a tracked page: https://binancebreach.com/changes/<number>.
Machine-readable: RSS, JSON Feed and CSV and JSON downloads.

Fact sheet: latest approved figures

The most recent approved figure for each measure, with who published it. This is not a consensus: where sources disagree the count of different values is shown, and the full list is on Numbers.

Measure	Figure	Who published it	As of (UTC)	Source
Frozen arbitrum 2 different values published	$30,500,000.00	Cointelegraph	2026-10-30 00:52 UTC	Claim 125
Frozen ripple 2 different values published	$200,000,000.00	The Block	unknown time	Claim 204
Frozen rlusd 2 different values published	40,500,000 RLUSD	TRM Labs	2026-10-29 22:01 UTC	Claim 145
Frozen total 10 different values published	$2,840,000,000.00	Hacken	2026-10-30 08:00 UTC	Claim 23
Frozen usd1 2 different values published	27,800,000 USD1	TRM Labs	2026-10-29 22:10 UTC	Claim 146
Frozen usdc 2 different values published	823,000,000 USDC	TRM Labs	2026-10-29 21:04 UTC	Claim 144
Frozen usdt 4 different values published	971,100,000 USDT	TRM Labs	2026-10-29 21:01 UTC	Claim 143
Held matching tokens 2 different values published	$5,000,000,000.00	Binance	unknown time	Claim 169
Potential loss	$5,800,000,000.00	BleepingComputer	unknown time	Claim 201
Set aside 2 different values published	$6,340,000,000.00	Cointelegraph	2026-10-30 10:55 UTC	Claim 131
Suspicious transfers	$3,300,000,000.00	Cointelegraph	unknown time	Claim 117
Total stolen 9 different values published	$6,400,000,000.00	Cointelegraph	2026-10-30 05:01 UTC	Claim 127
Wallet holdings 2 different values published	$5,780,000,000.00	BleepingComputer	unknown time	Claim 202

Latest approved claims

Reported: Halborn said the root of the Bybit transaction was a malicious transaction designed to modify the smart contract logic of the exchange's multi-signature wallet.
Halborn. Original Captured 2026-11-01 14:48 UTC.
https://binancebreach.com/claims/804
Reported: Chainalysis said the Bybit attack highlights a common DPRK playbook of social engineering attacks and intricate laundering methods.
Chainalysis. Original Captured 2026-11-01 14:48 UTC.
https://binancebreach.com/claims/803
Reported: Chainalysis said Bybit funds consolidated in addresses holding funds from other known DPRK-linked attacks, which it called further evidence that nation state actors were behind the Bybit incident.
Chainalysis. Original Captured 2026-11-01 14:48 UTC.
https://binancebreach.com/claims/802
Reported: TRM said in its 26 February 2025 Bybit post that blockchain intelligence confirmed North Korean hackers were responsible, citing clear overlaps between the wallets used and those associated with past North Korean thefts.
TRM Labs. Original Captured 2026-11-01 14:48 UTC.
https://binancebreach.com/claims/801
Reported: Elliptic said that within two hours of the Bybit theft the stolen funds were sent to 50 different wallets, each holding approximately 10,000 ETH.
Elliptic. Original Captured 2026-11-01 14:48 UTC.
https://binancebreach.com/claims/800

Embed the tracker

A small tracker of the stolen, frozen and moved figures. It shows only sourced values, each attributed, and carries the not-associated-with-Binance notice. Select the code below to copy it.

<iframe src="https://binancebreach.com/widget" title="Binance hack tracker (binancebreach.com)" width="100%" height="460" style="max-width:30rem;border:1px solid #888" loading="lazy"></iframe>

Preview the tracker

Contact

A public contact address for press and correction requests will be published on the About page before launch. Tip and report forms are not available yet.