Statements

The attack, the largest in crypto history, began at 8:04 pm UTC Thursday and the perpetrators, linked to the same North Korean hackers behind last month’s Bitget hack, immediately began converting assets.

The final contract went live at 15:59, a second rehearsal exercised the sweep path three times between 16:25 and 16:47, and the test funds were routed back.

At 13:51 they ran a rehearsal that is worth a second look: a test wallet delegated with three authorizations at nonces 0, 1 and 2, of which exactly one applied.

The BTC was stolen from Binance hot wallets during a breach that affected nine blockchains in under four hours on Thursday.

On the evening of 29 October 2026, an attacker emptied Binance hot wallets on 10 blockchains

In an unrelated incident earlier on Thursday, the prediction market operator Polymarket temporarily halted trading after a security incident involving a third-party provider.

Our teams are aware of reports of a potential security issue and are actively investigating. Rest assured that user funds are completely safe

The suspected breach has already prompted stablecoin issuers Tether and Circle to freeze more than $2.3 billion in assets associated with the incident.

Blockchain analytics firm Arkham put the haul at $6.01 billion, taken from Binance hot wallets on nine blockchains between 4:10 p.m. and 7:05 p.m. ET on Thursday, it said in a tweet

Binance wallets on the other nine chains also sent funds to the attacker through ordinary signed transfers, which TRM said points to a compromise of Binance's hot wallet signing infrastructure rather than a flaw in Ethereum itself.

Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.

Bitcoin fell below $77,000 late Thursday as the Binance exploit intensified a market-wide sell-off. * BNB lost 7.1%, Ethereum slid 5.2%, and XRP fell 7%.

Ben-Natan also said the activity resembled operations linked to North Korea, citing Blockaid’s familiarity with those attacks. He pointed to sophisticated onchain preparations but emphasized that the attribution remained unconfirmed.

Before Binance’s latest update, Arkham CEO Miguel Morel told Cointelegraph there was insufficient information to determine whether the attack involved stolen keys or compromised infrastructure. “From what we can tell, it appears the hack is still ongoing,” he said at the time.

“Early on October 29, the operator deployed a first piece of code for the attack and tested it on two wallets,” TRM says. “Later that day, it rehearsed the final version on a third wallet, then routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.”

According to Glassnode, Thursday’s Binance breach was the largest cryptocurrency hack on record, with around $6.3 billion affected, exceeding the combined losses from the next nine largest hacks. The previous record was the $1.5 billion Bybit exploit in February 2025.

It could be the biggest heist of any kind in history, according to Elliptic, a consultancy specialising in crypto-related crime. The incident, which took place late on Thursday, is more than four times bigger than the previous largest crypto hack, the $1.5bn one targeting the Bybit exchange last year . Elliptic says there does not appear to be anything comparable in the pre-crypto era.

The bulk of the Binance heist unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.

About $3B was frozen within hours, while most of the ETH and other native assets stayed with the attacker.

Eleven Binance hot-wallet keys signed transfers to an address created minutes earlier, and one of them signed an EIP-7702 authorization that turned its wallet into standing infrastructure for the attacker.

Attacks on signing infrastructure, where an attacker makes an organization’s own keys sign for them, remain the largest source of losses onchain, and at Binance’s estimate of $6.3B this is the largest theft on record, more than four times the roughly $1.5B taken from Bybit in February 2025.

Elliptic's analysis shows that $6.43 billion in cryptoassets was stolen from Binance on October 29, 2026, more than four times the $1.46 billion stolen from Bybit in 2025.

Zhao posted Thursday on X that "User funds are safe!" but added that the theft "does look like a hack on Binance."

TRM, in a post on its website Thursday, attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit. "We make this judgment with high confidence," the firm said.

The world's biggest cryptocurrency exchange reported Thursday that approximately $6.3 billion was impacted in an apparent hack.