Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
Newest first. The raw hash is the SHA-256 of the stored copy exactly as fetched. We keep the copy privately and publish its hash. The text hash is of the text extracted from it, which is what is compared between captures.
| Captured (UTC) | Fetched via | HTTP | Raw sha256 | Text sha256 | Text changed |
|---|---|---|---|---|---|
| firecrawl-web08 | 200 | aa78fa667bac2eea5769f8516483a3eb24e387c7a7fd1779b28ae9df4fab52e8 | 5b83bf50feef71b1fc79e704f2c66b05c3dc70cef3833fcbe8d35a0b986e9078 | No |
No text changes detected between captures of this source.
The attack, the largest in crypto history, began at 8:04 pm UTC Thursday and the perpetrators, linked to the same North Korean hackers behind last month’s Bitget hack, immediately began converting assets.
CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began.
LlamaRisk, an Aave risk service provider, said in its 1:00 am update that the attacker’s position subsequently held around $59.9 million in USDT collateral against $43.8 million in debt. Aave said the position remained overcollateralized and did not put protocol suppliers at risk.
Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled around $3.33 billion in assets that issuers could not immobilize.
“USDT is real money backed by dollars, and the position is criminal but overcollateralized in the eyes of the protocol.”
frozen funds don’t necessarily equate to recovered funds. Immobilizing assets prevents the suspected attackers from spending them, but it doesn’t automatically return them to Binance or its users.