BTC $77,541.90 −3.20%ETH $2,238.88 −3.62%SOL $96.73 −3.52%S&P 500 7,720.39 −0.30%Nasdaq 100 29,402.50 −1.38%Gold $3,972.50 −1.46%Brent $113.20 +2.17%EUR/USD 1.1196 +0.13%DXY 101.69 −0.34%US10Y 4.99% −1.11%NVDA $213.66 −0.80%TSLA $403.30 −0.23%
FREEKONOMIST
Sign in
EN
RUРусскийENEnglishESEspañolPTPortuguêsZH中文ARالعربية
INVESTIGATION · ON-CHAIN DATA

The Binance hack: $6.3B in 4 hours
Where the money went

The biggest theft in crypto history. We followed the money on-chain: which wallets, which chains, how much is frozen and how much the hacker still holds. Every figure links to its source.

Data as of 30.10.2026, 11:25 UTC. We will update as new data comes in.

The money map, minute by minute

Each filament is a transfer. Thickness is the amount, colour is the coin. Tap any wallet to see what it holds, whose it is per Arkham, where it sent money and where it got it from.

Time—Stolen (on the map; $6.36B in all)$0Frozen$0

ETHUSDTUSDCBTCTRXSOLXRPfreezecontrol (EIP-7702)

Binance wallets

Hacker wallets

Who froze

Wallet labels, balances and counterparties: Arkham (30 Oct, 08:50 UTC). Arkham tags all the hacker's wallets as one entity, "Binance Hacker". Transfer times and amounts: Etherscan, Tronscan, Bitquery, TRM. We do not draw links we cannot source.

How much was taken

17 Binance hot wallets on 10 chains. Most of it left in about 20 minutes, starting 20:05 UTC on 29 October. Analysts count slightly differently because they price the coins at different moments.

$6.36Bstolen, per TRM Labs[1]
~$3Bfrozen, per Binance[2]
17hot wallets[3]
10blockchains[1]
20 minfor the bulk of it[1]

By chain[1]

Ethereum: $3.79BBitcoin: $1.47BTron: $628MXRP Ledger: $296MSolana: $96MOther 5 chains: $77M$6.36B10 chains
  • Ethereum$3.79B60%
  • Bitcoin$1.47B23%
  • Tron$628M10%
  • XRP Ledger$296M5%
  • Solana$96M2%
  • Other 5 chains$77M1%

Who counted what

Chainalysis$6.4B
TRM Labs[1]$6.36B
Bitquery[3]$6.3B
Binance[2]$6.3B
Arkham$6.01B

The $0.4B spread: coin prices were moving during the theft itself.

The Ethereum part: $3.79B of the $6.36B[1]

This is not the whole hack, only what left on Ethereum. The total across 10 chains is $6.36B.

USDT: $1.88BUSDC: $823M200,630 ETH (~): $440MRLUSD: $88.5M180+ other tokens (~): $560M$3.79BEthereum only
  • USDT$1.88B50%
  • USDC$823M22%
  • 200,630 ETH (~)$440M12%
  • RLUSD$88.5M2%
  • 180+ other tokens (~)$560M15%

USDT, USDC and RLUSD from TRM. ETH and other tokens (~) are our own estimate of the remainder at about $2,200 per ETH; the sources give no exact split for them.

Where the money went

Left: how much was taken on each chain. Right: where that value is now. Most stablecoins were frozen in time. Bitcoin, ether, XRP and SOL have no issuing company that could freeze them, so they stayed with the hacker.

Ethereum → Frozen or clawed back: $2.45BEthereum → ETH still with the hacker (part bought with stolen USDT): $1.08BBitcoin → BTC still with the hacker: $1.41BTron → Frozen or clawed back: $380MTron → TRX still with the hacker: $241MXRP Ledger → XRP still with the hacker: $284MSolana → SOL and other coins with the hacker: $93M5 other chains → Frozen or clawed back: $45M5 other chains → SOL and other coins with the hacker: $12MEthereum → Difference: price drop, swap discounts: $260MBitcoin → Difference: price drop, swap discounts: $60MTron → Difference: price drop, swap discounts: $7MXRP Ledger → Difference: price drop, swap discounts: $12MSolana → Difference: price drop, swap discounts: $3M5 other chains → Difference: price drop, swap discounts: $20MEthereum$3.79BBitcoin$1.47BTron$628MXRP LedgerSolana5 other chainsFrozen or clawed back$2.88BBTC still with the hacker$1.41BETH still with the hacker (part bought with stolen USDT)$1.08BXRP still with the hackerTRX still with the hackerSOL and other coins with the hackerDifference: price drop, swap discounts$362M
← Taken from (TRM Labs, value at the time of theft)Where it is now (Bitquery 03:54 UTC + freezes) →

The links are our own combination of TRM, Bitquery and the freeze list; an approximation, not accounting to the cent. The "difference" is mostly the fall in ETH and BTC since the theft plus the 10–15% discounts the hacker paid to swap USDT for ETH.[1][3]

What the hacker holds now: ~$3.1B[3]

BTC: $1.41BETH: $1.08BXRP: $284MTRX: $241MSOL: $93MOther: $12M$3.1Bwith hacker
  • BTC$1.41B45%
  • ETH$1.08B35%
  • XRP$284M9%
  • TRX$241M8%
  • SOL$93M3%
  • Other$12M0%

Bitquery, 30.10 03:54 UTC.

What happened to the 2.49B stolen USDT[3]

Frozen by Tether: $1.76BSwapped to ETH: $495MSwapped to TRX: $234M71%frozen
  • Frozen by Tether$1.76B71%
  • Swapped to ETH$495M20%
  • Swapped to TRX$234M9%

Ethereum and Tron combined. About 325M USDT was sold to market makers via UniswapX and 1inch Fusion at a 10–15% premium, 60M was posted on Aave to borrow ~19,760 ETH (Aave then froze those markets), and 300M went to JustLend on Tron.[1]

The wallets holding the money[3]

ChainHacker walletHolds
Ethereum0x8532…43d4197,460 ETH
Ethereum0xc887…286a137,602 ETH
Ethereum0x897c…8df378,415 ETH
Ethereum0x5440…c94232,954 ETH
Ethereum0x79e7…544a19,740 ETH
Ethereum0x5227…2f8c17,181 ETH
Ethereum0xa97b…8d104,009 ETH
Ethereum0xc209…850a3,000 ETH
TronTSpe5H…yZ8A638,200,000 TRX
TronTRBdWq…PRki44,500,000 TRX
XRP LedgerrK21t6…fzMx233,500,000 XRP
SolanaAffzFD…BEaU970,549 SOL
Bitcoinbc1q0m…2mnm18,270 BTC (first receiver, then 19 addresses)

Balances per Bitquery at 03:54 UTC and our own Blockscout checks. At 05:15 UTC another 17,260 ETH went to a new wallet 0x03b0…20ea. Tap an address to see its live balance in the explorer.

How it happened

Binance's account as of 30 Oct 02:25 UTC: no keys leaked. An engineer's laptop was hacked, and through it a service that signs withdrawals on its own.[2]

Update 30 Oct 08:47 UTC: Binance says the laptop was not the only way in. More breach points were found and the attack was "complex". There is no full technical post-mortem yet.[24]

  1. The laptop

    Hackers break into a Binance DevOps engineer's work laptop.

  2. The service container

    From the laptop they reach a container that can submit withdrawal transactions.

  3. Signed withdrawals

    The system itself signs legitimate-looking withdrawals from 17 hot wallets on 10 chains.

  4. The EIP-7702 trick

    On Ethereum the Binance 14 wallet gets a "sweeper" code, and it hands over ETH and 63 tokens in one transaction.

  5. Laundering

    Stablecoins are swapped fast into ETH and TRX, bitcoin is split across 19 addresses.

EIP-7702 in plain words

Since spring 2025 an ordinary Ethereum wallet can "wear" smart-contract code: the owner signs an authorization and the wallet starts acting like a program. Handy for batching payments. Dangerous if someone else got that signature: the wallet then runs their program.

50 signaturesone per nonceBinance 140x28c6…1d60code → 0x63e8…6fae0x5227…2f8c167,464 ETH + 63 tokens20:20:5920:24:23

Transaction 0xad99…298b carried 50 pre-signed authorizations, one for each upcoming transaction number (nonce) of the wallet. One matched, and Binance 14 got the code 0x63e8…6fae. Three and a half minutes later the code was called and everything was swept. Binance removed the code at 00:10:35 UTC on 30 Oct; the wallet has no code again (we checked eth_getCode).[10][11]

What we don't know yet: exactly how the laptop was hacked, and why one service could sign withdrawals from 17 wallets without a second person. Binance has promised a full report.

Minute by minute (UTC)

From on-chain data (Etherscan, Bitquery, TRM) and official posts on X.[1][3]

  1. Prep

    The operator wallet gets its first funds through the Tornado Cash mixer.

  2. Prep

    The hacker deploys the "sweeper" contract that will later empty the hot wallet.

  3. Prep

    Rehearsals: three test runs on the hacker's own wallets.

  4. Prep

    About 2 more ETH for gas, again via Tornado Cash and a middle wallet.

  5. Drain

    Go time. Five Binance wallets on the XRP Ledger are emptied.

  6. Drain

    Solana and Optimism.

  7. Drain

    18,270 BTC (~$1.47B) leave in 11 transactions in one block, then split into 19 addresses, mostly 1,000 BTC each.

  8. Drain

    An EIP-7702 transaction puts foreign code on the Binance 14 wallet.

  9. Drain

    Tron: USDT and TRX.

  10. Main hit

    The main hit: 167,464 ETH plus 63 tokens (~$2.5B) in one transaction.

  11. Drain

    Binance 16: another 28,006 ETH, 55.7M USDT, 25.9M RLUSD.

  12. Post on X

    First post on X: Whale Alert flags 28,005 ETH leaving Binance for an unknown wallet. No one says "hack" yet.[20]

  13. Post on X

    First post calling it a hack: "unconfirmed, but possibly a massive Binance hack, the contract was funded by Tornado Cash".[21]

  14. Laundering

    195,460 ETH are moved on to 0x8532…43d4.

  15. Drain

    779.3M USDC from a Binance smart account.

  16. Freeze

    First freeze: World Liberty locks WLFI.

  17. Freeze

    Tether freezes the hacker's main wallet: 971M USDT.

  18. Freeze

    Circle freezes 823M USDC.

  19. Statement

    CZ on X: "it does look like a hack on Binance". User funds are safe.

  20. Freeze

    Tether: more than 1.567B USDT frozen.

  21. Statement

    Binance's first word: "investigating reports of a potential security issue, user funds are safe". 1 h 25 min after the drain began.[22]

  22. Freeze

    Ripple freezes 40.5M RLUSD, World Liberty 27.8M USD1.

  23. Statement

    Binance pauses withdrawals.

  24. Drain

    The last chains: Avalanche and Polygon.

  25. Freeze

    Binance: $2.54B confirmed frozen.

  26. Statement

    Yi He and Binance: "we will cover all losses". All deposits and withdrawals paused.

  27. Freeze

    The Arbitrum Security Council force-moves 8,426 ETH and 74.6M ARB (~$30M) out of the hacker's wallet.

  28. Statement

    Binance revokes the EIP-7702 delegation: the code is removed from Binance 14.

  29. Freeze

    Binance: around $3B frozen.

  30. Statement

    Binance names the cause: a DevOps engineer's compromised laptop.

  31. Laundering

    The hacker sells tokens (UNI, ENA, PEPE, LINK, AAVE and more) on Uniswap for ETH.

  32. Statement

    Chainalysis: high confidence it is North Korea.

  33. Statement

    Binance: deposits work, withdrawals back within 48 hours.

  34. Statement

    ZachXBT: Binance and Bitget funds arrived via THORChain at the same address. Most likely the same actor.[23]

  35. Laundering

    17,260 ETH go to a new wallet, 0x03b0…20ea.

  36. Statement

    Binance: the laptop was not the only way in; more breach points found. "A complex attack".[24]

  37. Statement

    CZ does the math: $6.xB hack, $3B frozen, $1.xB SAFU fund, a gap of about $2B.[25]

  38. Statement

    Chainalysis: a never-seen-before laundering pattern. Thousands of transactions in a short time; the attackers use automation to hide the trail.[27]

Who froze how much

The first freeze came 33 minutes after the main hit. Without it the hacker would have walked away with almost everything.

Frozen and clawed back

Tether (USDT)[3]$1.77B
11 wallets, 6 of them already empty
Circle (USDC)$824.6M
Ripple (RLUSD)$40.5M
Arbitrum Security Council[8]$30.5M
World Liberty (USD1, WLFI)$29.8M

Plus small amounts at Paxos, First Digital and Tether Gold. On-chain we see ~$2.7–2.9B in total; Binance says "around $3B", Arkham says $2.80B.[2]

How can crypto be frozen at all?

  • Stablecoins: yes. USDT and USDC are smart contracts run by the companies Tether and Circle. The contract has a built-in blacklist: the addBlackList function on USDT, the "blacklister" role on USDC. An address on it cannot send a single token.
  • Then the money can be returned. After a court order Tether burns the frozen tokens (destroyBlackFunds) and issues the same amount to the victim. Not instant: it takes a legal process.[6]
  • BTC, ETH, XRP, SOL: no. No company owns them, so nobody can press "stop". They can only be traced until the hacker brings them to an exchange that works with police.
  • The exception: Arbitrum. This network has a Security Council that can upgrade the system and force-move funds. It did: ~$30M was taken back.[8]

Which wallets are frozen

WhoChainWalletAmountNote
TetherEthereum0x5227…2f8c1,175M USDTthe hacker's main wallet; checked by us: isBlackListed = true
TetherEthereum0xaa24…54a0175M USDT
TetherEthereum0xb171…c8c330M USDT
TetherTronTG5iBM…zsGi313M USDT
TetherTronTCzBTk…7Y6266M USDT
TetherEthereum0x9749…c762 0x0ddf…697e +40 USDTfrozen already empty: the money had left
TetherAvalanche · Polygon—14.6M USDT · USDT08.4M + 6.2M
CircleEthereum0x5227…2f8c823M USDCchecked by us: isBlacklisted = true
RippleEthereum—40.5M RLUSDYi He wrote ~200M; on-chain we see 40.5M
World LibertyEthereum—29.8M USD1 · WLFI27.8M USD1 + ~2M WLFI
Arbitrum Security CouncilArbitrum0x3E2b…32d530.5M ETH · ARBnot a freeze but a forced transfer out of the hacker's wallet

Tether wallets: list and amounts from Bitquery[3], the main wallet checked by us on the USDT and USDC contracts[9]. Where Bitquery shows only a short address, we do not publish a full one until we check it ourselves.

What Tether says

Paolo Ardoino, Tether CEO

At 21:25 UTC on 29 Oct he posted on X that Tether had frozen more than 1.567B USDT "related to a potential Binance exchange hack". Bitquery's final count: 1.76B USDT across 11 wallets.[7][3]

Why Tether could do it

Tether is a centralized issuer. It can see where stolen USDT went and blacklist an address on the contract within minutes. It does this routinely: by its own count, as of April 2026 it had helped in 2,300+ cases and frozen more than $4.4B.[17]

The other side

The same button works on any address. If your wallet lands in a chain of dirty money by mistake, your USDT can be frozen too. Lifting it goes through whoever asked for it (usually police) and lawyers.

How to contact Tether

Tether freezes addresses on requests from law enforcement with legal process, not on a victim's email alone. So the order is: first a police report, then the police write to Tether.[16]

Who is behind it and what authorities say

TRM Labs

High confidence: TraderTraitor, a North Korean hacking group. The same one the FBI named for the $1.5B Bybit hack in 2025.[1][5]

Chainalysis

Also high confidence it is North Korea. Funds from the Bitget hack were mixed with the Binance funds.[12]

ZachXBT

Independent investigator, 30 Oct 04:51 UTC: Binance and Bitget funds arrived via THORChain at the same address, so most likely the same actor.[23]

Bitget was hacked for $388M in late September 2026, also through internal access to its wallets without stealing keys. About $1.1M was recovered.[26]

Important: these are conclusions of private analysts. No government has officially confirmed it is North Korea yet. The US DOJ and FBI did not respond to reporters. North Korea did not respond to Reuters. Circle said its freeze was coordinated with law enforcement; Binance says it is working with them.[19][5]

The biggest crypto hacks ever

Binance, Oct 2026$6.36B
Bybit, Feb 2025$1.46B
Ronin (Axie), Mar 2022$625M
Poly Network, Aug 2021$611M
Coincheck, Jan 2018$534M
Bitget, 2026$388M

Bybit, Ronin and, per analysts, Bitget are also tied to North Korea.

What Binance, other exchanges and the market are doing

Binance

  • Promises to cover all losses; its SAFU fund is about $1.2B.[14][6]
  • Withdrawals paused, due back within 48 hours from 04:36 UTC on 30 Oct.
  • Removed the EIP-7702 code from Binance 14 and is checking its systems.
  • CZ, 09:33 UTC: after the freezes (~$3B) and the SAFU fund, the gap is about $2B, "painful but manageable".[25]

Other exchanges

  • Coinbase and Binance.US: not affected.
  • Analysts (Fundstrat) see no solvency risk for Binance.[6]
  • No other exchange has published freeze figures yet. They usually block deposits from the hacker's addresses quietly.

DeFi and issuers

  • Tether, Circle, Ripple, World Liberty, Paxos and First Digital froze their tokens.
  • Aave froze the markets the hacker used to borrow ETH.
  • Arbitrum took back ~$30M by Security Council action.[8]

What TRM tells exchanges to do after this hack[1]

  • Screen every deposit against the labelled hacker addresses.
  • Watch for EIP-7702 delegations on their own wallets and reject unexpected ones.
  • Split signing by chain so that one service cannot drain everything.
  • Market makers should check who they trade with: the hacker sold USDT to them.

Market reaction[4]

BTC dipped to $76,368, ETH to $2,178, BNB −5%. Coinbase shares −4.8%, Strategy (MSTR) about −6%.

What changes now at exchanges and for you

After the 2025 Bybit hack exchanges tightened their rules. After a theft four times bigger we expect the same, only harder. This is our assessment based on past cases and TRM's advice, not official exchange decisions.[1]

Tougher deposit screening

Impact on youHigh

Exchanges run every deposit through databases of labelled addresses. If coins ever passed near a hacker wallet, the deposit can be held and you may be asked to prove where the money came from. P2P buyers will feel this most.

More USDT and USDC freezes

Impact on youHigh

Tether and Circle showed they can block $2.6B within an hour. Regulators will now expect this every time. If someone sends you tainted stablecoins, they can be frozen in your own wallet even if you did nothing wrong.

Slower withdrawals

Impact on youMedium

Less money in hot wallets, more manual checks on large amounts and delays for new addresses. A withdrawal that took minutes may take hours.

More KYC questions

Impact on youMedium

Source-of-funds questions (SOF/SOW) will come more often, especially for large withdrawals and accounts from high-risk countries.

More caution with EIP-7702

Impact on youLow

Wallets and exchanges will flag and limit "delegation" signatures more strictly. For ordinary users this is mostly good: fewer chances to sign a trap.

More transparency

Impact on youLow

Expect more proof-of-reserves reports and talk of insurance funds like SAFU. A plus for users: exchanges get easier to check. Our exchange rating takes this into account.

What to do now

  • Don't panic-withdraw: Binance promises to cover losses and withdrawals are due back within 48 hours.
  • Keep proof of where your money came from: statements, contracts, trade history. You may be asked.
  • On P2P buy only from verified sellers with a track record, and don't accept stablecoins from unknown wallets.
  • Turn on the withdrawal whitelist now: new addresses may face longer waits later.

How to protect yourself

Binance says its customers will not lose money: the exchange will cover the losses itself. But every big hack is followed by a wave of scammers. Here is what actually helps.

1. Don't keep everything on an exchange

An exchange is for trading, not storage. Keep long-term coins on a hardware wallet whose keys only you hold.

2. Withdrawal whitelist

Turn on withdrawals only to pre-approved addresses, with a delay for new ones. Even with your password and 2FA stolen, money can't go to a stranger's wallet.

3. A security key, not SMS

Use a passkey or hardware key (YubiKey) instead of SMS codes. Turn on the anti-phishing code in the exchange's emails.

4. Don't sign what you don't understand

This hack went through EIP-7702 signatures. If your wallet asks you to sign a "delegation", "account upgrade" or "authorization" for a site you don't know, say no. Revoke old approvals regularly (revoke.cash).

5. A work laptop is for work only

It all started with one laptop. No pirated software, no "test assignments" or PDFs from strangers: North Korea often gets in through fake job offers.

6. Beware of "refunds"

Binance never DMs you first on Telegram or WhatsApp and never asks for keys or "verification for compensation". "We recover stolen crypto for a fee" services are almost always a second theft.

If you were hacked: what to do

  1. Stop the bleeding

    Move what is left to a new wallet with a new seed phrase. Change passwords, revoke approvals.

  2. Save the evidence

    Transaction hashes, addresses, screenshots, chats. Delete nothing.

  3. Contact the exchange

    Only via the official app or site. If the money went to an exchange, it can freeze it on its side.

  4. Report to police

    Without it Tether, Circle and exchanges will not return money. You need the case number for every next step.

  5. Move fast

    Here the first freeze came after 33 minutes, and ~$3B was frozen in total. It is a matter of hours.

Who to contact

SEAL 911A free 24/7 emergency line of vetted crypto security researchers. They help during an active hack.
t.me/seal_911_bot · [email protected]
Use only this bot; verify anyone "from SEAL" through it.[18]
USA: FBI IC3The FBI's official site for cybercrime reports, crypto included.
ic3.gov
UK: Action FraudThe national reporting centre for fraud and cybercrime.
actionfraud.police.uk
Other countriesYour local police cybercrime unit. In the EU the police pass the case to Europol.
Tether (USDT)Freezes on police requests: [email protected]
Give this address to your investigator along with the transaction hashes.
Tracing the moneyChainalysis, TRM Labs and Elliptic work with police and exchanges, usually through your investigator rather than with individuals.
No honest party charges upfront to "recover crypto". Anyone who contacts you first promising to get your money back is almost certainly a scammer.

Sources

  1. TRM Labs. North Korea steals USD 6.36 billion from Binance in the largest hack in history
  2. Binance on X. Root cause: a compromised employee laptop, 30 Oct 02:25 UTC
  3. Bitquery. Binance Hack: $6.3B drained on 9 chains, $2.7B frozen
  4. Reuters. Tether, Circle freeze $2.38 billion after Binance reports security incident
  5. Reuters. Blockchain analysis firm TRM says North Korea behind Binance crypto theft
  6. CNBC. Billions in crypto frozen in Binance hack: here's what happens next
  7. Paolo Ardoino (Tether) on X. Tether froze more than 1.5B USDT
  8. Arbitrum on X. Arbitrum Security Council recovered ~$30M
  9. Etherscan. USDT contract: isBlackListed(0x5227…2f8c) = true; USDC: isBlacklisted = true
  10. Etherscan. EIP-7702 transaction on Binance 14, 20:20:59 UTC
  11. Etherscan. Main sweep: 167,464 ETH and 63 tokens, 20:24:23 UTC
  12. Chainalysis on X. High confidence: DPRK
  13. Binance on X. $2.54B verified frozen, 23:22 UTC
  14. Binance on X. Binance will cover all losses, 00:13 UTC
  15. CZ on X. "It does look like a hack on Binance", 21:15 UTC
  16. Tether. Legal: law enforcement requests
  17. Tether. Release 23 Apr 2026: 2,300+ cases, $4.4B frozen
  18. Security Alliance. SEAL 911
  19. Euronews / AFP. US DOJ and FBI did not immediately respond
  20. Whale Alert on X. 28,005 ETH out of Binance, 29 Oct 20:26 UTC
  21. @spreekaway on X. First post calling it a hack, 29 Oct 20:32 UTC
  22. Binance on X. First statement, 29 Oct 21:29 UTC
  23. ZachXBT on X. Binance and Bitget funds at the same address, 30 Oct 04:51 UTC
  24. Binance on X. More breach points found, 30 Oct 08:47 UTC
  25. CZ on X. The ~$2B gap, 30 Oct 09:33 UTC
  26. CNBC. Bitget 'not expecting to recover a lot' from $388 million hack
  27. Chainalysis on X. Never-seen-before laundering patterns, 30 Oct 10:09 UTC

Our own checks were made via public Ethereum nodes and Blockscout. Not investment advice. If you see a mistake, write to [email protected].