Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

The Binance Hack

An independent record of the October 2026 Binance hack

All briefings

Briefing for 2026-11-02

Generated . Each line is a statement somebody made, not a finding of this site.

  1. Reportedclaim The New York Times reported that Binance's top executives put together an informal war room on its internal messaging system, Wea, with about 100 participants, including specialized cryptocurrency tracers and security personnel.

    New York Times. Original

  2. Reportedclaim The New York Times reported that Binance founder Changpeng Zhao insisted on X that "user funds are SAFU", crypto slang meant to reassure customers about their deposits.

    New York Times. Original

  3. Reportedclaim Binance said on X on October 29, 2026 that Binance Alpha trading had been temporarily suspended and that user funds remained safe.

    BeInCrypto. Original

  4. Reportedclaim The Block reported that Binance said it processed $4.65 billion in withdrawals and $1.01 billion in deposits in the first nine and a half hours after reopening withdrawals, a net outflow of about $3.64 billion.

    The Block. Original

  5. Reportedclaim The Block reported that Binance put the net outflow since it reopened withdrawals at 2.1% of its $171 billion in assets under management, based on its proof-of-reserves data from Oct. 28.

    The Block. Original

  6. Reportedclaim The Block reported that DefiLlama data, which covers the Binance wallets it tracks, showed $4.05 billion in net outflows over 24 hours, far more than the roughly $368 million in combined net inflows at the next 10 largest exchanges it tracks.

    The Block. Original

  7. Reportedclaim Binance said that after an initial spike, withdrawal volumes had declined and were stabilising as expected, while deposit volumes had remained substantial.

    The Guardian. Original

  8. Reportedclaim The Block reported that onchain analyst and Security Alliance contributor SomaXBT said North Korean hackers had laundered about $242 million of the stolen funds on the Tron blockchain in two days.

    The Block. Original

  9. Reportedclaim The Block reported that the FBI published a list of 608 Ethereum addresses, 19 bitcoin addresses and one Solana address it said were linked to the attack, with no Tron addresses.

    The Block. Original

  10. Reportedclaim THORChain technical co-founder Chad Barraford wrote on X that "THORNode operators have zero information that isn't already public and readily available in real time." The Block reported that his posts have not said whether node operators would block the listed addresses.

    The Block. Original

  11. Reportedclaim Elliptic co-founder Tom Robinson said in comments shared with The Block that the laundering activity does not appear to involve AI agents, saying the pattern is repetitive and static.

    The Block. Original

  12. Reportedclaim Chainalysis said the hackers have been depositing stablecoins into DeFi protocols on Tron for depository receipt tokens, which cannot be frozen, and later redeeming them from new addresses.

    The Block. Original

  13. Reportedclaim Cointelegraph reported that Binance's update at 12:36 UTC showed it had enabled withdrawals for tokens across 15 networks, including Bitcoin, Ethereum, BNB Smart Chain and XRP Ledger, and would restore more assets and networks in phases.

    Cointelegraph. Original

  14. Reportedclaim Cointelegraph reported that JP Thor, whom it describes as THORChain's founder and who it says claims he is no longer involved, said in his opinion that if THORNodes took the protocol offline next week "the experiment is over" and the protocol "would have failed."

    Cointelegraph. Original

  15. Reportedclaim Chainalysis said THORChain's emergency pause had "inadvertently delayed the laundering of a significant amount of funds stolen from Binance" by preventing all users, including DPRK's money launderers, from using cross-chain swaps.

    Cointelegraph. Original

  16. Reportedclaim The Block quoted Rick Maeda, head of markets at Laevitas, as saying the $643 million outflow was under 1% of spot BTC ETF assets, calling it a de-risking day and not capitulation or a loss in institutional confidence.

    The Block. Original

  17. Reportedclaim Cointelegraph reported that, according to SoSoValue, investors pulled $643 million from US-listed spot Bitcoin ETFs on Friday, leaving the funds with $515 million in net outflows for October, as crypto markets faced volatility following the $6.3 billion Binance hack.

    Cointelegraph. Original

  18. Reportedclaim The Record reported that the US Secret Service claimed that within minutes of the attack it worked with cryptocurrency industry players and the Justice Department to "identify and freeze a significant portion of stolen cryptocurrency."

    The Record. Original

  19. Reportedclaim Chainalysis senior investigator Pierce Vaughn said the automations TraderTraitor is using have procedures already in place so that when a wallet is funded or liquidity is available, the next phase of laundering is executed.

    The Record. Original

  20. Officialclaim Binance said it has covered approximately 95% of the impacted amount, and that the outstanding 5% consists of less liquid tokens that take longer to source.

    Binance. Original

  21. Officialclaim Binance said it is working to resume withdrawals for additional networks and assets, and that the next phase is planned for the day after this update, as a progressive rollout.

    Binance. Original

  22. Reportedclaim Decrypt reported Elliptic saying that about 44% of the $6.43 billion stolen from Binance has been frozen or seized.

    Decrypt. Original

  23. Reportedclaim Decrypt reported that the attacker has used about 12,000 wallets and more than 40,000 transactions in under four days, which Elliptic calls automation, not AI.

    Decrypt. Original

  24. Reportedclaim Decrypt reported Elliptic writing that the laundering is clearly automated and that nothing it has seen shows an AI agent making decisions.

    Decrypt. Original

  25. Reportedclaim Decrypt reported that about $3.24 billion remains in addresses linked to the theft, mostly ETH and the 18,270 stolen Bitcoin, which have not moved since the day of the attack.

    Decrypt. Original

  26. Officialclaim Binance said that the full zero-knowledge proof for its latest Proof of Reserve snapshot has been completed, and that users holding the ten covered tokens can verify their balances are backed at a minimum of 1:1.

    Binance. Original

  27. Officialclaim Binance said it plans another snapshot covering more tokens on 2026-11-04, then an updated full zero-knowledge proof that it estimates will take approximately 40 to 50 hours to complete.

    Binance. Original