ReportedattributionStatement 347
Cointelegraph reported that the speaker said this indicates the same actor is likely behind both incidents.
“This indicates the same actor is likely behind both incidents,” he said.
Statements
Each statement is one attributed line with a verbatim quote from a stored copy of the source. Only approved statements are shown.
Official means the party said it, not that it is true.
- Verified on-chain. Reproduced by us from raw chain data kept in our own storage. The method is shown.
- Official. Stated by the party concerned (an exchange, an agency, a token issuer or similar), attributed to them. Official means the party said it, not that it is true.
- Reported. Stated by news media or an analytics firm, attributed to them.
- Disputed. Credible sources conflict. The statement links the sources that disagree.
- Debunked. Contradicted by primary evidence, which is linked.
- Theory. Speculation, attributed to whoever proposed it, shown with the evidence for and against.
443 statements.
ReportedattributionStatement 128
Cointelegraph reported that onchain investigator ZachXBT said stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address after arriving via THORChain.
In a separate post, onchain investigator ZachXBT said the stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address on Friday, after arriving via THORChain.
ReportedamountStatement 127
Cointelegraph reported that Chainalysis CEO Jonathan Levin said the hack was likely carried out by TraderTraitor and, in a post on X, put the theft at $6.4 billion.
Chainalysis co-founder and CEO Jonathan Levin said the Binance hack was likely carried out by North Korean hacking group TraderTraitor , citing links to a previous hack. In a post on X, Levin put the theft at $6.4 billion, slightly above Binance’s estimated $6.3 billion impact.
ReportedattributionStatement 784
ZachXBT's post says the Bitget exploit was attributed to DPRK-linked; the archived text of the post ends at that word.
The Bitget exploit was attributed to DPRK-linked
ReportedattributionStatement 783
ZachXBT posted on X that funds stolen from Binance and from the Bitget exploit were commingled at the same address 45 minutes before his post, after arriving via THORChain, which he said indicates the same actor is likely behind both incidents.
Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain. This indicates the same actor is likely behind both incidents.
ReportedattributionStatement 193
Chainalysis said it announced its attribution to TraderTraitor on October 30 at 12:30 a.m. Eastern Time.
That direct on-chain link strengthened our assessment that TraderTraitor carried out the Binance hack and we announced it on October 30, 12:30am Eastern Time.
ReportedattributionStatement 157
Hacken's timeline table lists the first public attribution to TraderTraitor at 04:30 UTC on October 30, citing The Next Web.
04:30 | First public attribution to TraderTraitor.
ReportedwithdrawalsStatement 126
Cointelegraph reported that Binance said withdrawals remained paused while it completes a security revamp, with service expected to resume within 48 hours.
Binance said withdrawals remain paused while it completes a security revamp of its withdrawal service and related addresses, with service expected to resume within 48 hours.
ReportedattributionStatement 782
Jonathan Levin of Chainalysis posted on X that Chainalysis assessed the hack as likely done by the DPRK group TraderTraitor due to links to a previous hack.
We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack.
TheoryotherStatement 428
A Hacker News commenter wrote that DebugBear is related to the Polymarket hack, not Binance.
From what I've read, DebugBear is related to the Polymarket hack, not Binance.
OfficialreservesStatement 916
Binance said in its Security Incident Update dated 2026-10-30 that it will also publish an updated Proof of Reserves once the remediation is complete.
We will also publish an updated Proof of Reserves once the remediation is complete.
OfficialresponseStatement 166
Binance added a note to its Security Incident Update dated 2026-10-30 saying the announcement was updated on 2026-10-30 to clarify that deposits remain unaffected.
Note: This announcement was updated on 2026-10-30 to clarify deposits remain unaffected and continue to operate as normal.
OfficialwithdrawalsStatement 165
Binance said in its Security Incident Update dated 2026-10-30 that as an immediate precaution it had temporarily suspended withdrawals, revoked the affected address authorisation, and engaged law enforcement and blockchain intelligence partners.
As an immediate precaution, Binance has: - temporarily suspended withdrawals while security checks are completed; - revoked the affected address authorisation; - engaged law enforcement and blockchain intelligence partners to trace and recover funds.
OfficialrecoveryStatement 164
Binance said in its Security Incident Update dated 2026-10-30 that it will cover all losses from the SAFU fund and the company's funds, and that user funds are safe.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.
OfficialfreezeStatement 163
Binance said in its Security Incident Update dated 2026-10-30 that it had worked with blockchain partners to freeze affected assets, with about $3 billion frozen on-chain so far.
We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
OfficialamountStatement 162
Binance said in its Security Incident Update dated 2026-10-30 that the estimated total impact sits at around $6.3B.
The estimated total impact sits at around $6.3B.
OfficialattributionStatement 283
Binance said in its first 30 October update that it was working with law enforcement partners to confirm the identity of the criminals.
We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
OfficialresponseStatement 282
Binance told users in its first 30 October update to rely only on official Binance channels for updates.
Please rely only on official Binance channels for updates.
Officialroot causeStatement 161
Binance said in its Security Incident Update dated 2026-10-30 that its initial investigation suggested the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions, and that it had found no evidence of any wallet private key leak.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.
Reportedroot causeStatement 24
Binance's update of 02:23 UTC on October 30 stated that its initial investigation suggests the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.
Binance's update of 02:23 UTC, Oct 30 , says its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," and that it has "found no evidence of any wallet private key leak."
ReportedrecoveryStatement 14
Binance stated it will cover all losses from its SAFU reserve and company funds, and that user funds are safe.
Binance says it will cover all losses from its SAFU reserve and company funds, and that user funds are safe.
ReportedresponseStatement 566
Coinbase CEO Brian Armstrong stated that Coinbase is doing everything it can to support the current situation, including blocking transfers to compromised wallets.
Coinbase CEO Brian Armstrong said Coinbase is "doing everything we can to support in the current situation," including blocking transfers to compromised wallets.
ReportedamountStatement 205
The Block reported that Chainalysis estimated roughly $5.9 billion was stolen at the time of the theft.
Blockchain analytics firm Chainalysis estimated that roughly $5.9 billion was stolen at the time of the theft.
ReportedfreezeStatement 393
LlamaRisk reported that the attacker’s position on Aave held around $59.9 million in USDT collateral against $43.8 million in debt, and Aave stated the position remained overcollateralized.
LlamaRisk, an Aave risk service provider, said in its 1:00 am update that the attacker’s position subsequently held around $59.9 million in USDT collateral against $43.8 million in debt. Aave said the position remained overcollateralized and did not put protocol suppliers at risk.
ReportedfreezeStatement 125
Cointelegraph reported that the Arbitrum Security Council said it executed a transaction to freeze $30.5 million, involving 74.6 million ARB and 8,425 ETH, and that the funds were transferred to an intermediary frozen wallet.
The update came after the Arbitrum Security Council said it executed a transaction to freeze $30.5 million from the Binance exploit, involving 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH). “The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications,” it said. “As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet,” it said.