Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
Newest first. The raw hash is the SHA-256 of the stored copy exactly as fetched. We keep the copy privately and publish its hash. The text hash is of the text extracted from it, which is what is compared between captures.
| Captured (UTC) | Fetched via | HTTP | Raw sha256 | Text sha256 | Text changed |
|---|---|---|---|---|---|
| firecrawl-web08 | 200 | 5eb4d1d5e510578854843e63b881901275c38c726862d795e2846a4f004c4e1f | f11b32b33f431a65ba82080dd9ab07be6373778e4252f84647e5809999661cac | No |
No text changes detected between captures of this source.
Around 4:20 p.m. ET on October 29, 2026, funds began leaving Binance hot wallets across multiple blockchains. Unauthorized transfers totaled approximately $6.4 billion, the largest theft in crypto history.
But the industry caught up with them more quickly than they expected: by 5:14 pm eastern the freezes started.
Stablecoin issuers began freezing funds by 5:14 p.m. ET on October 29
That direct on-chain link strengthened our assessment that TraderTraitor carried out the Binance hack and we announced it on October 30, 12:30am Eastern Time.
Chainalysis attributes the hack to TraderTraitor, a North Korean cybercrime group.
Approximately $2.8 billion has been frozen so far.
Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH.
Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses.
This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.
The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors.