Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
Newest first. The raw hash is the SHA-256 of the stored copy exactly as fetched. The text hash is of the text extracted from it, which is what is compared between captures.
| Captured (UTC) | Fetched via | HTTP | Raw sha256 | Text sha256 | Text changed |
|---|---|---|---|---|---|
| firecrawl-web08 | 200 | 451c3280c64e9e46d8fc4e8856e903a79168242c594a0de486c997195bddb02f | 2ec7c41d65322acf872e3b37dfd367a328602ea25022ac4c20e679add38b785b | No |
No text changes detected between captures of this source.
Between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP to a single attacker address, leaving each wallet with only its minimum balance.
At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address, which began splitting the funds into round 1,000 BTC and 100 BTC pieces inside the same block.
At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations. Each was signed by the Binance hot wallet, and each pointed it to a sweeper contract that accepts instructions only from the operator.
Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep. Later sweeps landed in the frozen wallet, which now holds 1.175 billion USDT.
Circle froze the 823 million USDC in the main receiving wallet at 21:04 UTC, in coordination with law enforcement.
Ripple froze the wallet holding the stolen RLUSD at 22:01 UTC, with 40.5 million of the 88.5 million RLUSD still inside.
World Liberty Financial froze the 27.8 million USD1 in the main receiving wallet at 22:10 UTC, and froze USD1 in the compromised Binance hot wallet at 22:26 UTC.
A second wave around 23:05 UTC reached Binance wallets on Avalanche and Polygon.
Binance said at 23:35 UTC that the verified total frozen had reached USD 2.54 billion.
At 00:08 UTC, it used those powers to force two transfers out of the attacker's wallet on Arbitrum, moving 8,426 ETH and 74.6 million ARB, about USD 30 million, out of the attacker's reach.
On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC.
TRM traced every transfer from Binance-attributed wallets to attacker-controlled addresses across ten blockchains. Valuing each transfer at the price of the asset at the moment it was taken, the total is approximately USD 6.36 billion. At current prices, the same assets are worth about USD 6.23 billion.
Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion.
Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to send its entire balance to an attacker-controlled address. That single transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. We base this assessment on robust on and off-chain intelligence sources.
It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach.
Binance said it was investigating a potential security issue, then said it had temporarily suspended withdrawals on multiple networks as a precaution. Binance has said user funds are safe.
Binance co-CEO Yi He said Ripple helped stop about USD 200 million from moving; TRM has confirmed the 40.5 million RLUSD freeze onchain.
Reviewer note: Yi He's figure is Binance's side of a disagreement: TRM confirmed 40.5 million RLUSD frozen on-chain.
Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.
North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.
Early indicators on the Ethereum activity suggested the attacker had phished the authorizations. That explanation covers Ethereum and leaves the other chains unexplained.
Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.