Binance disclosed a security incident on Oct. 29, 2026. Reports put the loss at about $6.3B, taken from wallets on 10 blockchains, mostly within about 20 minutes. Binance's preliminary findings reportedly point to a compromised DevOps engineer's laptop used to authorize withdrawals, with no evidence of a private-key leak. TRM Labs attributes the theft to North Korea's TraderTraitor with high confidence. Binance suspended withdrawals and deposits, says user funds are safe, and has pledged to cover all losses.
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
Per Foreign Policy (reporting dated Oct. 30, 2026), Binance said it restored withdrawals about 45 hours after the Oct. 29 incident, and it reiterated that it found no evidence of private-key exposure. Per Arkansas Online (Oct. 31, 2026), attackers split the stolen funds across multiple addresses, and Chainalysis is reported to have also attributed the attack with high confidence to TraderTraitor, alongside TRM Labs. Issuer and partner freezes are reported at roughly $2.7B to $3.0B, a wider range than the $2.7B to $2.85B in the report.
Per the research, the FBI said investigators saw the attackers converting stolen funds primarily into Ethereum. Reuters, via Business Standard, reported Binance had covered about $6B of the $6.3B stolen, using corporate treasury funds, the SAFU reserve, and part of its futures insurance fund. Binance said it is working with partners and law enforcement to recover frozen assets. The research found no confirmed arrests, criminal charges, or lawsuits through 2026-11-02.
As of 2026-11-01 22:33 UTC (latest point in the research), analysts cited a total haul of about $6.3B to $6.43B across 10 or 11
As of 2026-11-01 18:52 UTC (the latest point verified in the research), Binance said it had reserved more than $6.34B in company funds to cover stolen assets and had begun recovering assets for users. Stablecoin issuers reportedly froze about $2.7B to $2.85B, and one report said Binance had refilled about 80% of stolen assets, which conflicts with the 90% figure noted in the report. Reporting says stolen Binance funds have commingled on-chain with assets from the earlier Bitget exploit, which complicates tracing. No verified arrests, lawsuits, or formal compensation claims were found in the material reviewed.
On 2026-11-01, the FBI publicly attributed the roughly $6 billion-plus theft to North Korea and identified TraderTraitor, per Yahoo Finance and Cybersecurity News. Circle and Tether reportedly froze about $2.37B–$2.4B of the stolen assets, and Binance and partners put total frozen value near $3B (Finance Magnates, CNBC). Binance said by 2026-10-31 it had replenished about 90% of affected assets from company funds and that customers would bear no losses (Cryptonomist, StepSecurity). Binance began reopening withdrawals in phases on 2026-11-01, starting with USDC, USDT and ETH on Ethereum and USDC, USDT and BNB on BNB Smart Chain (Cryptoticker, Tech-ish). Reports also say the attacker moved abo
On 2026-10-31 (updated 2026-11-01), the FBI reportedly tied the theft to TraderTraitor, the same actors behind the Bybit hack. Binance-posted material says about $2.8B was frozen within 54 minutes, above the roughly $2.7B TRM Labs reported as frozen, and that the attacker rushed about $500M in stablecoins into a trading wallet and swapped $325M into about $285M of ETH, taking a roughly $40M trading loss to avoid freezes. Reports distinguish frozen funds from recovered funds, and no final returned amount has been confirmed.
Per one report, the bulk of the theft began around 20:05 UTC on 2026-10-29 and took about 20 minutes. Per a Cryptotimes report dated 2026-10-30, the FBI and U.S. Secret Service joined the probe, and Binance was reported to be buying back stolen coins. TRM-linked reporting says the attacker still held more than 420,000 ETH and 18,270 BTC, worth about $2.4B, as of the latest cited on-chain snapshot. A Pulse Kenya headline dated 2026-10-30 says Binance restored withdrawals, which conflicts with the suspension noted in the report and is unconfirmed.
Coindesk reported on Oct. 30, 2026 that Binance arranged about $6.34B to cover losses from the hack, a funding figure rather than a confirmed loss total. A Binance post reportedly said the attacker's 18,270 BTC remained untouched, and Binance said deposits were unaffected while only withdrawals were suspended. As of Nov. 1, 2026 (08:02 UTC), the research found no verified events after that time and no confirmed arrests or lawsuits.
As of 2026-11-01, Binance reportedly said it had replaced about 95% of affected assets, up from about 90% the day before, per a report citing the exchange's update (The Statesman). Binance also said it was preparing to resume withdrawals, starting with the Bitcoin network, while rebuilding withdrawal infrastructure (CBS News, Cryptobriefing). TRM Labs' detailed accounting reportedly put frozen funds at about $2.7B, while Binance's update cited about $3B; frozen does not mean recovered. As of the research, no confirmed arrests or lawsuits were found, and attacker funds were reportedly commingled with assets from the earlier Bitget exploit (SecureWorld, Yahoo Finance).
Per research, the FBI publicly attributed the attack to North Korea's TraderTraitor on 2026-11-01. Binance said its investigation found "additional points of breach" beyond the single laptop compromise and that customer balances were not touched. Binance reportedly said losses would be covered from its S
As of Oct. 31, 2026, one report said Binance replaced about 90% of the stolen assets with company funds and that customers would not bear losses, though another report claimed 80% recovered or refilled with phased withdrawal resumption within about 34 hours, and neither is confirmed by a primary Binance filing. Coverage on Oct. 31 also said the FBI attributed the incident to North Korea's TraderTraitor, and Finance Magnates reported that the US Secret Service joined Circle and Tether in freezing about $2.37B. Wallet-tracing reporting (undated in the research) said the attacker converted about 434M USDT into 160,451 ETH, split 18,270 BTC across 19 addresses, and moved about 217.5M ENA and 29,
Research gives the attack start time as about 4:05 p.m. ET on Oct. 29, 2026, with the theft spread across about 10 blockchains in roughly 20 minutes. One report says stablecoin issuers Circle and Tether froze about $2.4 billion within an hour of the attack; this is a single-source claim and differs from Binance's later figure of about $3 billion frozen. Axios reported North Korean attribution on Oct. 31, 2026. No newer verified updates after Oct. 31, 2026 20:02 UTC were found.
As of 2026-10-30 00:30 UTC, TRM Labs reported about $2.7 billion frozen, and Binance later said roughly $3 billion had been frozen. On 2026-10-30 Binance said the stolen funds had been moved into an intermediary frozen wallet, which keeps the original address from accessing them. TRM-linked reporting says the attacker spread funds across at least 10 chains and still held over 420,000 ETH and 18,270 BTC (about $2.4 billion), partly in assets that stablecoin issuers cannot directly freeze. The research found no verified arrests, lawsuits, or customer compensation terms as of 2026-10-31.
As of 2026-10-31 16:05 UTC, Newsweek reported that Binance had set aside $6.34B to cover losses, a company reserve rather than a revised loss estimate. Brandefense and TRM-linked reporting put the frozen total at about $2.7B to $2.85B, against the roughly $3B cited elsewhere. The research also reports, without independent confirmation, that Binance had secured over $5B in replacement assets. No arrests, lawsuits, or public user-compensation payout details were confirmed.
A report dated Oct. 31, 2026 said Binance had recovered 80% of the stolen funds and planned phased withdrawal resumption within about 34 hours, while also reporting about $3B frozen on-chain and no evidence of a private-key leak so far. Separately, one report said Binance had re
Per a Binance on-chain post cited in the research, about 214,700 ETH (roughly $480M) sits in two attacker wallets, and the attacker's main Ethereum address made 500+ Uniswap trades and about 90 other router swaps, selling tokens including PEPE, SHIB, ENA, RSR and SAND. Binance said it has begun recovering affected assets and is working with law enforcement, issuers and blockchain intelligence firms. Reporting cited by CBS puts frozen value at about $2.4B within an hour (Circle and Tether), with later figures of $2.7B to $3.0B as of Oct. 30–31, 2026. These attacker-holdings and frozen figures conflict with the earlier report that the attacker still held over 420,000 ETH and 18,270 BTC (~$2.4B
Per Reuters (reported 10/30/2026), Binance promised to cover all losses from company funds and said clients would be able to trade again within days. TRM Labs estimated about $6.36B moved out of Binance wallets across 10 blockchains, mostly within about 20 minutes. As of 10/31/2026 12:27 UTC, the gathered sources did not confirm any arrests, lawsuits, or recoveries beyond the roughly $3B frozen on-chain.
As of Oct. 30, 2026, TRM Labs reportedly put about $2.7 billion frozen on-chain, a figure not in the report. Chainalysis also attributed the hack to TraderTraitor in reporting published Oct. 30, adding a second firm to TRM's attribution. AFP reported that customer balances were not touched, while withdrawals stayed suspended. The research found no new wallet addresses and still no confirmed arrests, lawsuits, or compensation payouts as of Oct. 31.
Binance attributed the breach to a compromised DevOps engineer's laptop and unauthorized withdrawal transactions, per its initial investigation reported on 10/30/2026 [15]. Reuters and Axios reported on 10/31/2026 that the breach likely began with manipulation of transaction-approval controls and that Binance said customer funds were safe [2][11]. Later reporting said the attacker still held more than 420,000 ETH and 18,270 BTC, worth roughly $2.4B [1][7]. No new arrest, lawsuit, or compensation announcement was verified after 2026-10-31 09:04 UTC.
CBS reported that within an hour of the attack, Circle and Tether froze $2.4 billion in assets (date not specified in the research). One report cited in the research said Binance had refilled 80% of the stolen amount and expected phased withdrawal resumption within about 34 hours; the research does not give a date for this claim. TRM Labs reportedly said the attacker sold USDT to market makers and borrowed ETH against USDT via Aave to move part of the funds into assets that stablecoin issuers cannot freeze directly.
Binance said it was working with the FBI to recover the frozen assets, per a Binance Square post with no date given in the research. Reporting gathered by the research also said the U.S. Secret Service was helping track the stolen funds, per BBC live coverage (undated in the research). The research found no verified arrest, indictment, lawsuit, or confirmed compensation payout as of its cutoff of Oct. 31, 2026, 08:15 UTC.
As of Oct. 30, 2026, Binance said it had reserved over $6.34B of company funds to cover the incident, with about $5B of that reportedly held in the same token assets that were impacted (per TechTarget and LCX). Reporting from Oct. 30 said withdrawals were temporarily suspended, deposits were unaffected, and withdrawals were expected to resume within a day or two (LA Times, charter97). A Binance Square post from Oct. 30 said the attacker still held more than 420,000 ETH and 18,270 BTC, which it valued at about $2.4B; that valuation looks inconsistent with those holdings and is unverified. Binance also said it had begun recovering assets for users after freezing about $3B.
Research reports a later breakdown of the attacker's Bitcoin movements, in which about 18,270 BTC was split across 19 wallets: 17 holding 1,000 BTC each, plus one with 832.5 BTC and one with 437.7 BTC. Binance's statement, as cited in the research, described unauthorized withdrawals from a service container in addition to the compromised engineer laptop. The research confirms no verified developments after Oct. 31, 2026, 05:29 UTC, so the recovery total, arrests, and compensation outcome remain unconfirmed.
As of Oct. 30, 2026 (00:30 UTC), TRM reportedly said about $2.7B had been frozen, and other reporting said Circle and Tether froze about $2.4B within an hour of the theft. TRM-linked coverage reported that the attacker's main Ethereum address received 197,169.8 ETH, 1.875B USDT and 823M USDC from Binance, with about $480M in Ether in two attacker-controlled wallets. Reporting said the funds moved across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon, and that Chainalysis reportedly also judged TraderTraitor the likely perpetrator. Binance said it would cover losses using its SAFU fund and company funds. No new attacker wallet addresses were ident
As of Oct. 31, 2026 (03:49 UTC), Aju Press reported Binance said about $3 billion in stolen assets had been frozen and that losses would be covered from its emergency protection fund and corporate reserves. By 04:44 UTC, Reuters and CNBC reported the same roughly $3 billion frozen figure alongside TRM Labs' high-confidence TraderTraitor attribution. SBS reported specific early transfers of 233.46 million XRP between 4:05 and 4:09 p.m. ET on Oct. 29, followed by wallet hijacks on Solana
As of Oct. 30, 2026, Crypto Times reported in a headline that Binance was buying back stolen coins while the FBI and U.S. Secret Service joined the probe; the article body was not available to confirm terms or amounts. The research found no confirmed developments after its cutoff of Oct. 31, 2026, 01:26 UTC, so the incident remains active with no confirmed recovery total, arrests, lawsuits, or compensation outcome.
As of Oct. 30, 2026, reports said the FBI and U.S. Secret Service had joined the probe (Crypto Times). Binance said it had reserved more than $6.34B of company funds to cover the stolen assets and that customer account balances were not touched, with withdrawals still suspended (Binance posts; research summary). Binance also said it had begun recovering affected assets with law enforcement, issuers, and blockchain intelligence firms, though no confirmed arrests, lawsuits, or compensation payouts were reported.
As of Oct. 30, 2026, Chainalysis reportedly published analysis pointing to TraderTraitor and estimated the unauthorized transfers at about $6.4B, and said an operational wallet funded through Tornado Cash on Ethereum was used before assets were swept to attacker-controlled addresses. TRM Labs reportedly said the attackers still held over 420,000 ETH and 18,270 BTC, roughly $2.4B that issuers could not freeze. Research found no source confirming full recovery, and it did not verify arrests, lawsuits, or a compensation program.
Per Economic Times and Straits Times coverage dated Oct. 30, 2026, the frozen-funds figure may be closer to $2.7B, though the $3B figure from Binance and other outlets is also still cited, so the amount frozen is unsettled. Chainalysis is reported to agree with TRM Labs that TraderTraitor is the likely perpetrator, and Binance says it is working with blockchain partners and law enforcement. Coverage dated Oct. 30 says the amount actually returned to Binance or customers had not been established. The research did not verify arrests, lawsuits, or a compensation program, and it did not identify specific attacker wallet addresses.
As of 2026-10-30 09:20 UTC, Binance said its verified frozen amount was about $3B and could rise, and Tether and Circle froze large stablecoin balances (one report cites about $1.79B). Follow-on on-chain moves reportedly included about 217.5M ENA and 29,934 WBETH sent to a fresh address, plus about 122,310 ETH moved to a new address, after the initial sweep. A report also described a sweep from a wallet labeled 'Binance 14' of about 167,000 ETH and 1.6B USDT into a new address, and Binance said it had revoked the affected authorizations. No confirmed arrests, lawsuits, or customer compensation plan were reported, and one headline says withdrawals were restored while the body text still descr
Binance publicly acknowledged a 'security incident' on Oct. 29, 2026. According to TRM Labs, the attacker moved funds out of Binance wallets on 10 blockchains, with most of the activity in about 20 minutes. One report mentions a second wave about three hours later.
Most outlets put the loss at about $6.3B. TRM Labs reportedly estimated about $6.36B, and Chainalysis was cited at about $5.9B at the time of the theft. The totals differ and none is confirmed by Binance in the material available.
According to CoinDesk, the attacker drained 18,270 BTC (about $1.4B at early Friday prices) and split it into 19 wallets. Seventeen wallets reportedly hold exactly 1,000 BTC each, one holds 832.5 BTC and one holds 437.7 BTC. The coins had reportedly not moved again as of early Friday.
Binance reportedly said user funds are safe, temporarily suspended withdrawals and deposits, and worked with partners to freeze affected assets. Some coverage says withdrawals could resume within about 48 hours, after a security revamp and a technical post-mortem.
According to Binance's reported preliminary findings, attackers appear to have compromised a laptop belonging to a DevOps engineer. They then used that access to submit unauthorized withdrawal transactions. Binance reportedly said there was no evidence of a wallet private-key leak. This is an initial finding, not a final post-mortem.
After the theft, the BTC was fragmented into 19 wallets within minutes, likely to hinder freezing and tracing, according to the reporting. Investigators reportedly linked part of the flow to THORChain routing. Some reports say the stolen funds were commingled at the same address with funds from an earlier Bitget exploit. How the attackers first compromised the laptop has not been published.
Reported flows: funds left Binance wallets on 10 chains and the stolen BTC (18,270 BTC) sits in 19 wallets, idle as of early Friday per CoinDesk. Investigators reportedly linked part of the flow to THORChain, and some reports say it was commingled with earlier Bitget exploit funds. No named mixer or confirmed exchange destination appears in the available reporting. A reported ~$3B is frozen, but the sources do not cleanly separate Binance-specific freezes from ecosystem-wide defensive freezes (Aave on Avalanche, $30.5M locked on Arbitrum), so treat that figure cautiously. The amount actually recovered is unknown.
| Address | Chain | Role | Source |
|---|---|---|---|
0x7C8601d4645b93cea45F71e118A729332e6B5CA0 | Ethereum (presumed from the EIP-7702 context; chain not explicit in the source) | attacker (operator wallet, per Odaily) | source |
0x63e842B054Bd624a465454D533C33F573e9c6fAe | Ethereum (presumed from the EIP-7702 context; chain not explicit in the source) | attacker (sweeper contract, per Odaily) | source |
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 | Ethereum | laundering (reportedly an address where funds passed into ET | source |
0x0000000000000000000000000000000000000DA0 | Arbitrum One | recipient (intermediary frozen wallet, as reported) | source |
0x28c6c06298d514db089934071355e5743bf21d60 | Ethereum | reported attacker-linked address (single secondary report, u | source |
0xdfd5293d8e347dfe59e90efd55b2956a1343963d | Ethereum | reported attacker-linked address (single secondary report, u | source |
0x8532FA14ACAf483729C449b8458aedDb900543D4 | Ethereum | attacker (reported as investigator-identified; not independe | source |
Every address is from a public source. Check any wallet in the dirty wallet checker.
Binance reportedly said user funds are safe, suspended withdrawals and deposits, and worked with partners to freeze affected assets. It pledged to cover all losses from its SAFU/emergency fund and company funds, and said it engaged law enforcement and blockchain intelligence partners. It also reportedly plans a security revamp and technical post-mortem, with withdrawals possibly resuming within about 48 hours. No regulator order or police action was identified in the available coverage.
The hack was described as a major shock to crypto markets and, in one outlet's phrasing, the 'largest bank heist in human history'. Bitcoin reportedly slid below $77,000 per The National, though no verified price move is available. Binance users face suspended withdrawals and deposits, though the exchange says funds are safe and losses will be covered. Contagion reportedly reached beyond Binance: the headline coverage says India's largest crypto exchange curbed futures trading, Aave froze Avalanche markets and Arbitrum locked $30.5M.
75% negative · 5% positive · the rest neutral · themes: scale of the theft, North Korea attribution, reassurance that user funds are safe, frozen funds and recovery hopes, insider/endpoint security risk
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice.
VaultX