At 20:41:23 the operator called Binance 14 with a different function. The delegated code called execute on Hot Wallet 34 with an ERC-20 transfer, moving 780 million USDC to the hub (transaction 0xdc10…7481, block 26,300,855). * Another 43 million followed at 20:59:47. Together that is the 823 million USDC Circle froze.
Halborn said that at 20:41:23 the operator moved 780 million USDC to the hub via Hot Wallet 34, and that another 43 million followed at 20:59:47, together making up the 823 million USDC that Circle froze.
This line is our short summary of the quote below. The quote is the evidence.
From this source: Explained: Hacks Inside the Largest Crypto Theft on Record: What the $6.3 Billion Binance Hack Means for Bank Custody 10.30.2026, with all of its statements.
Other statements from the same source
Halborn said Binance's own pipeline pushed 200 million USDT into a compromised wallet eighty minutes after the drain.
Binance’s own pipeline pushed 200 million USDT into a compromised wallet eighty minutes after the drain.
Halborn said Binance lost about four percent of what it held, which it said sounds like a conservative hot allocation until four percent is six billion.
Binance lost about four percent of what it held, which sounds like a conservative hot allocation until four percent is six billion.
Halborn said that in both the Bybit and Binance incidents the legitimate signing system produced a valid signature for the attacker's transaction, and that in neither was a key broken, extracted or, as far as anyone can show, copied.
In both, the legitimate signing system produced a valid signature for the attacker's transaction, and in neither was a key broken, extracted or, as far as anyone can show, copied.
Halborn said that on October 29, 2026, between 20:05 and 23:56 UTC, an attacker moved about 6.3 billion dollars out of Binance's hot wallets on ten blockchains, and that nobody had yet shown that a private key was stolen.
On October 29, 2026, between 20:05 and 23:56 UTC, an attacker moved about 6.3 billion dollars out of Binance's hot wallets on ten blockchains, and nobody has yet shown that a private key was stolen.
Halborn said Sygnia traced the Bybit loss to a compromised developer workstation, stolen cloud session tokens and a tampered signing interface, called it the same playbook with a different entry, and added that precedent is not evidence.
In Bybit, Sygnia traced the loss to a compromised developer workstation at the wallet provider, stolen cloud session tokens and a tampered signing interface. Same playbook, different entry. Precedent is not evidence, but it is a very good search warrant.