INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Binance hit by largest-ever crypto theft, with $6.3 billion stolen

| 2026-11-01 20:33 CRITICAL HIGH DATA BREACH STATE-SPONSORED & ESPIONAGE FRAUD & CRYPTO THEFT CYBERATTACK (GENERAL)
JSON
Executive Summary
AI-generated
Hackers whom researchers have linked to North Korea stole roughly $6.3 billion in cryptocurrency from Binance, in the largest such theft in history, the exchange said on Thursday. Binance, the world's largest crypto exchange, has linked the theft of about $6.3 billion in cryptocurrency to a DevOps engineer's compromised laptop. Binance has since put the estimated impact at approximately $6.3 billion, making the incident substantially larger than the $1.5 billion Bybit theft in February 2025.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
US
cryptocurrencycryptocurrency
Incident Timeline
‎May 2019
SAFU last covered a major theft in May 2019, when attackers stole 7,000 BTC from Binance.
general_metric 7,000 BTC
SAFU last covered a major theft in May 2019, when attackers stole 7,000 BTC from Binance.
‎February 2025
TraderTraitor hackers linked to North Korea used Tornado Cash to steal approximately $6.3 billion from Binance, surpassing the largest confirmed crypto heist on record.
financial 1,500,000,000 dollars
That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
Binance has since put the estimated impact at approximately $6.3 billion, making the incident substantially larger than the $1.5 billion Bybit theft in February 2025.
If confirmed stolen, the amount would far exceed the $1.5 billion stolen from Bybit  by North Korean hackers in February 2025, the largest confirmed crypto heist on record.
organisation Bybit
If confirmed stolen, the amount would far exceed the $1.5 billion stolen from Bybit  by North Korean hackers in February 2025, the largest confirmed crypto heist on record.
The haul dwarfs the $1.5 billion taken from Bybit in February 2025, which previously held the record.
The development makes it the biggest cryptocurrency heist recorded to date, surpassing the theft of about $1.5 billion from Bybit in February 2025.
general_metric 1.5 Bybit hack
That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025.
That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025," TRM said .
organisation Tornado
The report noted that the fact that the funds were supplied to the wallet through a small amount of Tornado Cash withdrawal, and that the organization had prepared beforehand, and that the signature was secured in advance, were similar features that appeared in the Bybit case in February 2025 and the KelpDAO case in April 2026.
source_region DPRK
If confirmed stolen, the amount would far exceed the $1.5 billion stolen from Bybit  by North Korean hackers in February 2025, the largest confirmed crypto heist on record.
attribution FBI
The Binance hack is about four times the size of the $1.5 billion Bybit theft in February 2025, which the FBI attributed to TraderTraitor .
‎2025/11/01
North Korea was linked to the hack of a Binance DevOps engineer's laptop, which is believed to be connected to previous cryptocurrency thefts and attacks on services like DMM.
organisation DMM
Last year, it was reported that the group had stolen approximately 1,500,000,000 dollars from Bithumb, a South Korean cryptocurrency exchange, and had also been involved in attacks on various cryptocurrency services, including DMM, a Japanese virtual asset trading platform, and Atomic Wallet.
financial 1,500,000,000 dollars
Last year, it was reported that the group had stolen approximately 1,500,000,000 dollars from Bithumb, a South Korean cryptocurrency exchange, and had also been involved in attacks on various cryptocurrency services, including DMM, a Japanese virtual asset trading platform, and Atomic Wallet.
‎the first quarter of 2026
North Korea-linked groups were responsible for approximately three-quarters of all cryptocurrency hack losses reported in the first quarter of 2026.
‎2026/09/30
Chainalysis investigators linked North Korea to a Binance DevOps engineer's laptop hack, where proceeds from last month's Bitget exploit were mixed with funds taken from the exchange.
‎October 28, 2026
Threat actors linked to North Korea targeted a Binance DevOps engineer's laptop, deploying an operator wallet and executing small Tornado Cash withdrawals starting on October 28, 2026.
general_metric 50 approved transactions
…orizations across consecutive nonces Delegated a Binance Ethereum hot wallet to an attacker-controlled sweeper contract at 20:20 UTC Funding pattern Small Tornado Cash withdrawals into a fresh operator wallet Staging that began on the morning of October 28, 2026 Recommendations for Exchanges, Custodians and Crypto Users Engineer and DevOps endpoints are now a direct path to hot wallet funds.
general_metric 14 Binance
…orizations across consecutive nonces Delegated a Binance Ethereum hot wallet to an attacker-controlled sweeper contract at 20:20 UTC Funding pattern Small Tornado Cash withdrawals into a fresh operator wallet Staging that began on the morning of October 28, 2026 Recommendations for Exchanges, Custodians and Crypto Users Engineer and DevOps endpoints are now a direct path to hot wallet funds.
general_metric 971.1 USDT
…orizations across consecutive nonces Delegated a Binance Ethereum hot wallet to an attacker-controlled sweeper contract at 20:20 UTC Funding pattern Small Tornado Cash withdrawals into a fresh operator wallet Staging that began on the morning of October 28, 2026 Recommendations for Exchanges, Custodians and Crypto Users Engineer and DevOps endpoints are now a direct path to hot wallet funds.
general_metric 823 USDC
…orizations across consecutive nonces Delegated a Binance Ethereum hot wallet to an attacker-controlled sweeper contract at 20:20 UTC Funding pattern Small Tornado Cash withdrawals into a fresh operator wallet Staging that began on the morning of October 28, 2026 Recommendations for Exchanges, Custodians and Crypto Users Engineer and DevOps endpoints are now a direct path to hot wallet funds.
‎October 28
Threat actors linked to North Korea staged an operator wallet hack on October 28, 2026.
‎October 29, 2026
North Korea's TraderTraitor group used a DevOps engineer's laptop to target Binance, draining an estimated $6.3 billion from the exchange's hot wallets across roughly 10 blockchains on October 29, 2026.
general_metric 20 minute
“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC.
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
"On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC.
financial $6.3 Korea
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
The Binance hack drained an estimated $6.3 billion from the exchange’s hot wallets across roughly 10 blockchains on the evening of October 29, 2026.
Attackers pushed unauthorized withdrawal transactions through Binance’s hot wallet infrastructure on October 29, 2026, moving an estimated $6.3 billion in crypto to attacker-controlled wallets.
organisation UTC
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
All times are in GMT (UTC) on October 29, 2026.
"On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC.
general_metric 6.36 USD
“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC.
"On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC.
general_metric 10 blockchain platforms
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
The Binance hack drained an estimated $6.3 billion from the exchange’s hot wallets across roughly 10 blockchains on the evening of October 29, 2026.
organisation Ethereum
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
financial 3,000,000,000 dollars
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
financial 6,360,000,000 dollars
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
organisation XRP Ledger
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
organisation Polygon
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
organisation Tron
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
organisation DevOps
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
organisation SAFU
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
organisation Initial Access (Preliminary
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
financial $6.4 Blockchains
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
general_metric 8,426 ETH
Binance and government agencies have not confirmed the attribution. October 30, 2026, 00:08 UTC Response Arbitrum Security Council moves funds out of an attacker wallet The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet. October 29, 2026, 23:05 UTC Attack Second wave hits Avalanche and Polygon Binance wallets on Avalanche and P…
general_metric 74.6 ARB
Binance and government agencies have not confirmed the attribution. October 30, 2026, 00:08 UTC Response Arbitrum Security Council moves funds out of an attacker wallet The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet. October 29, 2026, 23:05 UTC Attack Second wave hits Avalanche and Polygon Binance wallets on Avalanche and P…
financial $30 powers
Binance and government agencies have not confirmed the attribution. October 30, 2026, 00:08 UTC Response Arbitrum Security Council moves funds out of an attacker wallet The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet. October 29, 2026, 23:05 UTC Attack Second wave hits Avalanche and Polygon Binance wallets on Avalanche and P…
organisation 00:08
Binance and government agencies have not confirmed the attribution. October 30, 2026, 00:08 UTC Response Arbitrum Security Council moves funds out of an attacker wallet The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet. October 29, 2026, 23:05 UTC Attack Second wave hits Avalanche and Polygon Binance wallets on Avalanche and P…
general_metric 50 approved transactions
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
general_metric 18,270 BTC
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
organisation Tether
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
organisation USDC
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
organisation RLUSD
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
organisation World Liberty Financial
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
organisation Tron leave Binance
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
general_metric 27.8 USD1
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
financial $1.8 Circle
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
general_metric 40 minutes
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
general_metric 971.1 USDT
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
‎October 29
Threat actors funded an operator wallet on October 28, then deployed and tested code early on October 29 to siphon approximately $6.36 billion from Binance wallets across ten blockchains in roughly 20 minutes starting at 20:05 UTC.
financial 6,360,000,000 dollars
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC.
The company calculated that approximately $6.36 billion left Binance wallets on ten networks, with most transfers occurring within about 20 minutes from 20.05 GMT on October 29.
TRM Labs, which followed each transfer on-chain, calculated about $6.36 billion siphoned from Binance wallets across ten blockchains on October 29.
general_metric 20 minute
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC.
The company calculated that approximately $6.36 billion left Binance wallets on ten networks, with most transfers occurring within about 20 minutes from 20.05 GMT on October 29.
financial 6,244,690,488 dollars
Clonops has estimated the total amount of stolen assets at 6,244,690,488 dollars, based on the closing price of the first received wallet for each chain on CoinMarketCap on October 29.
organisation UTC
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC.
organisation GMT
The company calculated that approximately $6.36 billion left Binance wallets on ten networks, with most transfers occurring within about 20 minutes from 20.05 GMT on October 29.
general_metric 20.05 GMT
The company calculated that approximately $6.36 billion left Binance wallets on ten networks, with most transfers occurring within about 20 minutes from 20.05 GMT on October 29.
‎October 30, 2026
Blockchain analysts attribute the theft of approximately $6.36 billion worth of cryptocurrency to North Korea's TraderTraitor with high confidence as of October 30, 2026.
financial $30 powers
Binance and government agencies have not confirmed the attribution. October 30, 2026, 00:08 UTC Response Arbitrum Security Council moves funds out of an attacker wallet The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet. October 29, 2026, 23:05 UTC Attack Second wave hits Avalanche and Polygon Binance wallets on Avalanche and P…
Froze more than $800 million in USDC, in coordination with law enforcement Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet Where Is the Rest of the Stolen Money Going? Roughly $2.4 billion…
financial 3,000,000,000 dollars
Frozen So Far About $3 billion on-chain (Binance) Loss Coverage Binance to cover all losses from SAFU and company funds Attribution Assessed by blockchain analysts as TraderTraitor (North Korea); not confirmed by Binance or governments Service Status Withdrawals paused; Binance expects to begin resuming them within 48 hours of an October 30, 2026 update Binance Hack Timeline October 30, 20…
How Much of the Stolen Crypto Has Been Frozen? Binance reports about $3 billion frozen on-chain as of October 30, 2026, close to half of the estimated loss.
general_metric 8,426 ETH
Binance and government agencies have not confirmed the attribution. October 30, 2026, 00:08 UTC Response Arbitrum Security Council moves funds out of an attacker wallet The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet. October 29, 2026, 23:05 UTC Attack Second wave hits Avalanche and Polygon Binance wallets on Avalanche and P…
general_metric 74.6 ARB
Binance and government agencies have not confirmed the attribution. October 30, 2026, 00:08 UTC Response Arbitrum Security Council moves funds out of an attacker wallet The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet. October 29, 2026, 23:05 UTC Attack Second wave hits Avalanche and Polygon Binance wallets on Avalanche and P…
organisation 00:08
Binance and government agencies have not confirmed the attribution. October 30, 2026, 00:08 UTC Response Arbitrum Security Council moves funds out of an attacker wallet The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet. October 29, 2026, 23:05 UTC Attack Second wave hits Avalanche and Polygon Binance wallets on Avalanche and P…
organisation TraderTraitor
Frozen So Far About $3 billion on-chain (Binance) Loss Coverage Binance to cover all losses from SAFU and company funds Attribution Assessed by blockchain analysts as TraderTraitor (North Korea); not confirmed by Binance or governments Service Status Withdrawals paused; Binance expects to begin resuming them within 48 hours of an October 30, 2026 update Binance Hack Timeline October 30, 20…
general_metric 48 hour
Frozen So Far About $3 billion on-chain (Binance) Loss Coverage Binance to cover all losses from SAFU and company funds Attribution Assessed by blockchain analysts as TraderTraitor (North Korea); not confirmed by Binance or governments Service Status Withdrawals paused; Binance expects to begin resuming them within 48 hours of an October 30, 2026 update Binance Hack Timeline October 30, 20…
infrastructure 6.4
…rmally. October 30, 2026, early morning UTC Attribution Second firm links the theft to TraderTraitor and a possible Bitget connection emerges Attribution: A second blockchain analytics firm says North Korea’s TraderTraitor likely carried out the hack and raises its loss estimate to about $6.4 billion Bitget link: An independent investigator finds that funds from the Binance hack and the Sep…
organisation Security Incident Update
Binance published a Security Incident Update on October 30, 2026, laying out its preliminary findings and response.
general_metric 420,000 ETH
Froze more than $800 million in USDC, in coordination with law enforcement Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet Where Is the Rest of the Stolen Money Going? Roughly $2.4 billion…
general_metric 18,270 BTC
Froze more than $800 million in USDC, in coordination with law enforcement Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet Where Is the Rest of the Stolen Money Going? Roughly $2.4 billion…
financial $2.4 BTC
Froze more than $800 million in USDC, in coordination with law enforcement Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet Where Is the Rest of the Stolen Money Going? Roughly $2.4 billion…
financial $800 company
Froze more than $800 million in USDC, in coordination with law enforcement Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet Where Is the Rest of the Stolen Money Going? Roughly $2.4 billion…
organisation First Digital froze FDUSD
Froze more than $800 million in USDC, in coordination with law enforcement Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet Where Is the Rest of the Stolen Money Going? Roughly $2.4 billion…
organisation Arbitrum Security Council
Froze more than $800 million in USDC, in coordination with law enforcement Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet Where Is the Rest of the Stolen Money Going? Roughly $2.4 billion…
‎October 30
Threat actors used a compromised Binance DevOps engineer's laptop to access service containers and submit unauthorized withdrawal transactions.
financial 349.46 ETH
The funds were distributed to an Ethereum address '0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7' on October 30, with 349.46 ETH.
organisation Binance
The October 30 updates provide the first explanation of how attackers reached Binance’s internal systems, alongside a commitment to cover all losses.
organisation DevOps
According to a company statement on October 30, its investigation suggested that an attacker's entry point may have been a compromised Binance development and operations (DevOps) engineer's laptop.
organisation UTC
By 00:30 UTC on October 30, TRM tallied around $2.7 billion in frozen assets, including roughly 1.77 billion USDT locked by Tether and about 825 million USDC locked by Circle.
organisation USDC
By 00:30 UTC on October 30, TRM tallied around $2.7 billion in frozen assets, including roughly 1.77 billion USDT locked by Tether and about 825 million USDC locked by Circle.
financial $2.7 TRM
By 00:30 UTC on October 30, TRM tallied around $2.7 billion in frozen assets, including roughly 1.77 billion USDT locked by Tether and about 825 million USDC locked by Circle.
general_metric 1.77 USDT
By 00:30 UTC on October 30, TRM tallied around $2.7 billion in frozen assets, including roughly 1.77 billion USDT locked by Tether and about 825 million USDC locked by Circle.
general_metric 825 USDC
By 00:30 UTC on October 30, TRM tallied around $2.7 billion in frozen assets, including roughly 1.77 billion USDT locked by Tether and about 825 million USDC locked by Circle.
general_metric 48 hour
He said in an update at 04:17 UTC on October 30 that withdrawals should begin resuming within 48 hours and that deposits operate normally.
financial 3,000,000,000 dollars
Binance said in an October 30 update that approximately $3 billion had been verified as frozen.
‎2026/11/01
TraderTraitor, a North Korea-linked hacking group associated with the Lazarus Group, used compromised DevOps engineer's laptop to target Binance.
organisation Binance
North Korea-linked group steals $6.3B from Binance in largest-ever cryptocurrency hack.
The attacker breached Binance's internet-connected hot wallet, executing large-scale withdrawal transactions.
According to AFP, Binance announced on 31st that it would resume withdrawals for major cryptocurrencies including Bitcoin, Ethereum, BNB, Solana, XRP, and Dogecoin.
financial $6.3 Korea
Hackers whom researchers have linked to North Korea stole roughly $6.3 billion in cryptocurrency from Binance, in the largest such theft in history, the exchange said on Thursday.
$6.3 Billion Stolen from Binance in Attack Attributed to North Korea.
$6.3 Billion Stolen from Binance in Attack Attributed to North Korea Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts.
financial 3,000,000,000 dollars
The company has stated that it has cooperated with related companies to freeze approximately 3,000,000,000 dollars worth of assets.
Early Friday, the company said it had managed to freeze just under half of the stolen assets, or around $3 billion.
The exchange says it has frozen around $3 billion with help from blockchain partners.
organisation DevOps
$6.3 Billion Stolen from Binance in Attack Attributed to North Korea Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts.
Binance links $6.3 billion crypto theft to compromised DevOps laptop.
Binance says its investigation into the $6.3 billion cryptocurrency hack and theft has identified several breach points, including a compromised DevOps engineer’s laptop.
threat_actor Lazarus Group
However, the incident comes about a month after Bitget reported a hack and suspected involvement by North Korea’s Lazarus Group.
At the time, the security industry had raised the possibility of a connection between the group and the Lazarus Group, a North Korean state-sponsored hacking group, but it was not officially confirmed.
In the same year, a hacking incident on the domestic Upbit exchange was confirmed to be the work of the Lazarus Group and Andariel, another North Korean state-sponsored hacking group.
organisation TraderTraitor
Three world-leading cryptocurrency analysis firms, TRM Labs , Elliptic and Chainalysis have attributed the attack with “high confidence” to TraderTraitor, a North Korean hacking group.
Blockchain intelligence firms TRM Labs and Chainalysis have linked the theft to TraderTraitor, a North Korean hacking group associated with previous cryptocurrency thefts.
According to Cloont, the FBI has designated the cyber threat as the work of a North Korean linked TraderTraitor, publicly revealing 608 Ethereum addresses, 19 Bitcoin addresses, and 1 Solana address.
organisation ETH
The FBI has indicated that the attackers primarily converted the seized assets to Ethereum (ETH) and are expected to attempt to launder the funds by using decentralized finance (DeFi) services and immediate exchange services.
In just 3 minutes and 24 seconds, 160,0007,464 ETH and 63 types of tokens were transferred to the attacker's address.
Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all.
organisation SAFU
Binance says it will cover all losses using its SAFU fund and its own money, and that customer funds are safe.
The exchange said it would use its Secure Asset Fund for Users, known as SAFU, together with company funds to cover the incident.
The Chinese-founded, Dubai-headquartered and Delaware-registered company said it has frozen $3bn of stolen funds and that it will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds.
organisation Ethereum
The funds were partially transferred to an Ethereum wallet identical to the Bitget hack funds, and the path taken by the funds was confirmed to be moving to a public address by the US Federal Bureau of Investigation (FBI).
TRM Lab, a blockchain analysis firm, analyzed the incident and found that Binance's hot wallet was granted authority to execute code by the attacker, using the EIP-7702 protocol on Ethereum.
Billions transferred from Binance hot wallets The statements follow reports of billions of dollars in cryptocurrency being transferred from multiple Binance hot wallets to a newly created Ethereum address.
organisation BTC
As of 00:30 UTC, about $2.4 billion remains under attacker control, mostly more than 420,000 ETH and 18,270 BTC.
In 2019, it was reported that the group had stolen 7,000 BTC from a hot wallet on the Bitcoin network, resulting in an estimated loss of approximately 40,000,000 dollars.
It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.
financial $5.8 amount
Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion Frozen.
“Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”
Coinbase executive Conor Grogan initially estimated that the total value of the movements could reach $5.8 billion.
organisation Secure Asset Fund for Users
The exchange said it would use its Secure Asset Fund for Users, known as SAFU, together with company funds to cover the incident.
The Chinese-founded, Dubai-headquartered and Delaware-registered company said it has frozen $3bn of stolen funds and that it will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds.
Binance has halted withdrawals and pledged to reimburse all losses using company funds and its Secure Asset Fund for Users (SAFU).
threat_actor APT38
It attributes the attack to TraderTraitor , a North Korean state-backed unit also tracked as Lazarus Group and APT38 , and Chainalysis says it’s highly confident in that finding.
Crypto theft linked to North Korean hackers Although the company didn't link the incident to a hacking group or threat actor, blockchain analysis firm TRM attributed the attack to TraderTraitor , a North Korean state-backed hacking unit also tracked as Lazarus Group and APT38 .
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Binance) facebook linkedin twitter APT38 Binance Bitcoin Cybercrime Hacking hacking news information security news IT Information Security Lazarus Group North Korea Pierluigi Paganini Security Affairs Security News TraderTraitor
financial $2.4 BTC
As of 00:30 UTC, about $2.4 billion remains under attacker control, mostly more than 420,000 ETH and 18,270 BTC.
It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.
TRM says they still hold over 420,000 ETH and 18,270 BTC, about $2.4 billion in assets that no issuer can freeze.
financial 6,360,000,000 dollars
The hackers began removing funds from Binance wallets Thursday, with assets worth roughly $6.36 billion moving across 20 blockchains, including Bitcoin, Ethereum, Tron, the XRP Ledger and Solana, in about 20 minutes.
TRM Labs estimates that about $6.36 billion left Binance wallets across ten blockchains, with most of it moving within about 20 minutes.
Hackers stole approximately 6,360,000,000 dollars from Binance wallets spread across 10 blockchain platforms.
organisation Coinbase
Market makers Wintermute and GSR disclosed exposure to Binance of less than 20% and less than 5% of net equity, respectively, while Coinbase said it is blocking transfers to compromised wallets.
“Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”
Coinbase executive Conor Grogan placed the amount as high as $5.8 billion.
organisation BleepingComputer
In a statement to BleepingComputer, a Binance spokesperson confirmed that the exchange was investigating reports of a potential security issue while reassuring customers that their funds were safe.
Binance co-CEO Richard Teng told BleepingComputer the attacker did not simply use one engineer’s permissions.
" The company confirmed the breach in a statement shared with BleepingComputer on Thursday and reassured customers that their funds were safe.
organisation USDT
…hop wallets to Uniswap, where 30 million was frozen Stablecoin dumping: About 48 million RLUSD was sold on decentralized exchanges between 21:42 and 22:01 UTC, until Ripple froze the remaining 40.5 million Later reporting shows some funds moving through THORChain, a cross-chain swap protocol, an early sign of the cross-chain laundering stage seen after earlier North Korea-linked thefts.
To stay ahead of the issuers, the attackers sold USDT for ETH at more than 10% below market price.
organisation Chainalysis
Blockchain analytics firms Chainalysis and TRM Labs both said they had a high degree of confidence that North Korean hackers were behind the heist and that they are tracking the funds.
Three world-leading cryptocurrency analysis firms, TRM Labs , Elliptic and Chainalysis have attributed the attack with “high confidence” to TraderTraitor, a North Korean hacking group.
organisation DeFi
The FBI has indicated that the attackers primarily converted the seized assets to Ethereum (ETH) and are expected to attempt to launder the funds by using decentralized finance (DeFi) services and immediate exchange services.
Enforce velocity limits and anomaly-based holds on hot wallet outflows, especially simultaneous drains across chains Screen counterparties: Exchanges, market makers and DeFi protocols should screen deposits and fills against addresses labeled as linked to the Binance theft Train for recruiter lures:
organisation Bitcoin, Ethereum
According to AFP, Binance announced on 31st that it would resume withdrawals for major cryptocurrencies including Bitcoin, Ethereum, BNB, Solana, XRP, and Dogecoin.
The hackers began removing funds from Binance wallets Thursday, with assets worth roughly $6.36 billion moving across 20 blockchains, including Bitcoin, Ethereum, Tron, the XRP Ledger and Solana, in about 20 minutes.
organisation BNB
According to AFP, Binance announced on 31st that it would resume withdrawals for major cryptocurrencies including Bitcoin, Ethereum, BNB, Solana, XRP, and Dogecoin.
Bitcoin slid below $77,000, BNB dropped about 7% and ether lost about 5% over 24 hours.
organisation Billions
Billions transferred from Binance hot wallets The statements follow reports of billions of dollars in cryptocurrency being transferred from multiple Binance hot wallets to a newly created Ethereum address.
Billions had moved out of wallets linked to the exchange.
organisation Arbitrum’s Security Council
Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all.
Ripple and World Liberty Financial froze smaller amounts, and Arbitrum’s Security Council used its emergency powers to move about $30 million out of an attacker wallet.
organisation Tron
The hackers began removing funds from Binance wallets Thursday, with assets worth roughly $6.36 billion moving across 20 blockchains, including Bitcoin, Ethereum, Tron, the XRP Ledger and Solana, in about 20 minutes.
The chain-wise losses are estimated as follows: Ethereum approximately 3,690,000,000 dollars, Bitcoin approximately 1,420,000,000 dollars, Tron approximately 630,000,000 dollars, and XRP approximately 290,000,000 dollars.
financial 6,000,000,000 dollars
Earlier, Binance revealed on 29th that it had been targeted by a 6,000,000,000 dollars worth of hacking attack on an engineer's notebook and the approval system for transactions.
$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor.
financial $3.55 Spreek
“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.”
According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet.
financial $1.567 company
Tether CEO Paolo Ardoino said on X that the company had frozen more than $1.567 billion in USDT associated with the potential Binance hack.
Tether: Froze more than $1.567 billion in USDT tied to the theft Circle:
organisation USDC
Circle CEO Jeremy Allaire also confirmed that the company had frozen more than $800 million in USDC linked to the incident, adding that Circle was coordinating with law enforcement and would continue supporting the investigation.
21.04 Circle froze approximately $823 million in USDC.
organisation The Arbitrum Security Council
The Arbitrum Security Council is said to have executed a transaction to freeze about $30.5 million from the Binance Exploit.
The Arbitrum Security Council also reportedly executed a transaction to freeze about $30.5 million connected to the Binance exploit .
‎2026/11/01
The FBI attributed the theft of over $6 billion in virtual assets from Binance to North Korea.
attribution FBI
The FBI released a statement today, stating that "North Korea is believed to be responsible for the incident in which more than 6,000,000,000 dollars' worth of virtual assets were stolen from the world's largest virtual asset trading platform, Binance, on or around October 29th."
financial 6,000,000,000 dollars
The FBI released a statement today, stating that "North Korea is believed to be responsible for the incident in which more than 6,000,000,000 dollars' worth of virtual assets were stolen from the world's largest virtual asset trading platform, Binance, on or around October 29th."
‎November 2
Cloaint released an analysis report on the Binance Hack Incident, which analyzed the contents of a report related to North Korea's alleged involvement in hacking the laptop of a Binance DevOps engineer.
organisation the Binance Hack Incident'
Cloaint has released an 'Analysis Report on the Binance Hack Incident' on November 2, which analyzed the contents of the report.
Tactical Metrics
Metrics
financial
1,500,000,000
Dollars
Last year, it was reported that the group had stolen approximately 1,500,000,000 dollars from Bithumb, a South Korean cryptocurrency exchange, and had also been involved in attacks on various cryptocurrency services, including DMM, a Japanese virtual asset trading platform, and Atomic Wallet.
Until the Binance hack, the largest cryptocurrency theft on record was North Korea’s $1.5 billion breach of the ByBit exchange .
That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
Binance has since put the estimated impact at approximately $6.3 billion, making the incident substantially larger than the $1.5 billion Bybit theft in February 2025.
If confirmed stolen, the amount would far exceed the $1.5 billion stolen from Bybit  by North Korean hackers in February 2025, the largest confirmed crypto heist on record.
The haul dwarfs the $1.5 billion taken from Bybit in February 2025, which previously held the record.
Key Takeaways Record loss: Binance estimates the impact of the October 29, 2026 hot wallet theft at around $6.3 billion, about four times the $1.5 billion Bybit theft and the largest crypto heist on record Highly prepared operation:
The Binance hack is about four times the size of the $1.5 billion Bybit theft in February 2025, which the FBI attributed to TraderTraitor .
If the upper estimates are confirmed as stolen funds, the incident would exceed the approximately $1.5 billion Bybit theft in February 2025.
Metrics
financial
40,000,000
Dollars
In 2019, it was reported that the group had stolen 7,000 BTC from a hot wallet on the Bitcoin network, resulting in an estimated loss of approximately 40,000,000 dollars.
Metrics
financial
3,000,000,000
Dollars
The company has stated that it has cooperated with related companies to freeze approximately 3,000,000,000 dollars worth of assets.
Early Friday, the company said it had managed to freeze just under half of the stolen assets, or around $3 billion.
The exchange says it has frozen around $3 billion with help from blockchain partners.
Binance says approximately $3 billion has been frozen on-chain, while blockchain analysts have reported somewhat different totals.
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
Frozen So Far About $3 billion on-chain (Binance) Loss Coverage Binance to cover all losses from SAFU and company funds Attribution Assessed by blockchain analysts as TraderTraitor (North Korea); not confirmed by Binance or governments Service Status Withdrawals paused; Binance expects to begin resuming them within 48 hours of an October 30, 2026 update Binance Hack Timeline October 30, 20…
How Much of the Stolen Crypto Has Been Frozen? Binance reports about $3 billion frozen on-chain as of October 30, 2026, close to half of the estimated loss.
About $3 billion has been blocked through on-chain freezes, and Binance has committed to paying for the rest.
With about $3 billion frozen, that commitment means Binance absorbs the unfrozen remainder itself.
Binance said in an October 30 update that approximately $3 billion had been verified as frozen.
Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion Frozen.
Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen.
The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.
Binance Security Incident Affects $6.3 Billion in Crypto Assets, $3 Billion Frozen.
It is one of the largest security events in the crypto industry so far, though the exchange said close to $3 billion of the affected funds had already been frozen on-chain.
Metrics
financial
6,000,000,000
Dollars
The FBI released a statement today, stating that "North Korea is believed to be responsible for the incident in which more than 6,000,000,000 dollars' worth of virtual assets were stolen from the world's largest virtual asset trading platform, Binance, on or around October 29th."
Earlier, Binance revealed on 29th that it had been targeted by a 6,000,000,000 dollars worth of hacking attack on an engineer's notebook and the approval system for transactions.
$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor.
Metrics
financial
6,360,000,000
Dollars
Hackers stole approximately 6,360,000,000 dollars from Binance wallets spread across 10 blockchain platforms.
TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC.
The company calculated that approximately $6.36 billion left Binance wallets on ten networks, with most transfers occurring within about 20 minutes from 20.05 GMT on October 29.
The hackers began removing funds from Binance wallets Thursday, with assets worth roughly $6.36 billion moving across 20 blockchains, including Bitcoin, Ethereum, Tron, the XRP Ledger and Solana, in about 20 minutes.
TRM Labs estimates that about $6.36 billion left Binance wallets across ten blockchains, with most of it moving within about 20 minutes.
TRM Labs, which followed each transfer on-chain, calculated about $6.36 billion siphoned from Binance wallets across ten blockchains on October 29.
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
Metrics
financial
ETH 608
Financial Impact
According to Cloont, the FBI has designated the cyber threat as the work of a North Korean linked TraderTraitor, publicly revealing 608 Ethereum addresses, 19 Bitcoin addresses, and 1 Solana address.
Metrics
financial
₿19
Financial Impact
According to Cloont, the FBI has designated the cyber threat as the work of a North Korean linked TraderTraitor, publicly revealing 608 Ethereum addresses, 19 Bitcoin addresses, and 1 Solana address.
Metrics
financial
$6.2B
Financial Impact
Digital intelligence company Cloaint (Kloint) has estimated the damage from the Binance Hot Wallet hack at approximately 6,244,690,000 dollars.
Metrics
financial
ETH 1.6B
Financial Impact
In just 3 minutes and 24 seconds, 160,0007,464 ETH and 63 types of tokens were transferred to the attacker's address.
Metrics
financial
$6.2B
Stolen Funds
Clonops has estimated the total amount of stolen assets at 6,244,690,488 dollars, based on the closing price of the first received wallet for each chain on CoinMarketCap on October 29.
Metrics
financial
$3.7B
Financial Loss
The chain-wise losses are estimated as follows: Ethereum approximately 3,690,000,000 dollars, Bitcoin approximately 1,420,000,000 dollars, Tron approximately 630,000,000 dollars, and XRP approximately 290,000,000 dollars.
Metrics
financial
$1.4B
Financial Impact
The chain-wise losses are estimated as follows: Ethereum approximately 3,690,000,000 dollars, Bitcoin approximately 1,420,000,000 dollars, Tron approximately 630,000,000 dollars, and XRP approximately 290,000,000 dollars.
Metrics
financial
$630M
Financial Impact
The chain-wise losses are estimated as follows: Ethereum approximately 3,690,000,000 dollars, Bitcoin approximately 1,420,000,000 dollars, Tron approximately 630,000,000 dollars, and XRP approximately 290,000,000 dollars.
Metrics
financial
$290M
Financial Impact
The chain-wise losses are estimated as follows: Ethereum approximately 3,690,000,000 dollars, Bitcoin approximately 1,420,000,000 dollars, Tron approximately 630,000,000 dollars, and XRP approximately 290,000,000 dollars.
Metrics
financial
ETH 349
Financial Impact
The funds were distributed to an Ethereum address '0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7' on October 30, with 349.46 ETH.
Metrics
financial
ETH 575
Financial Impact
The address received a total of 574.90 ETH through Tor, and 550.55 ETH were sent to five addresses publicly disclosed by the FBI.
Metrics
financial
ETH 551
Financial Impact
The address received a total of 574.90 ETH through Tor, and 550.55 ETH were sent to five addresses publicly disclosed by the FBI.
Metrics
financial
ETH 259
Financial Impact
In particular, the first 259 ETH sent from the address was a swap payment from the Bitcoin's swap fund at Bitget, which was confirmed by Clontrik as a Bitcoin swap fund.
Metrics
financial
ETH 5.2K
Financial Impact
Over the next 3 hours and 50 minutes, with delegation maintained, an additional 5,160.16 ETH was withdrawn.
Metrics
financial
₿100M
Financial Impact
The main assets include 10,0008,270.2 BTC, 612,720,0009,468 USDT, 46,390,0004,098 TRX, 233,460,0001,943.1 XRP, 970,000521.9 SOL, 12,410,00067.6 NEAR, etc.
Metrics
financial
USDT 6.1T
Financial Impact
The main assets include 10,0008,270.2 BTC, 612,720,0009,468 USDT, 46,390,0004,098 TRX, 233,460,0001,943.1 XRP, 970,000521.9 SOL, 12,410,00067.6 NEAR, etc.
Metrics
financial
ETH 38
Financial Impact
Binance's Tron received from the first wallet was also distributed through hubs and 2nd and 3rd wallets and then exchanged to ThorChain, arriving at the same Ethereum address with 37.58 ETH.
Metrics
financial
6,300,000,000
Financial Impact / Stolen Funds
Hackers whom researchers have linked to North Korea stole roughly $6.3 billion in cryptocurrency from Binance, in the largest such theft in history, the exchange said on Thursday.
$6.3 Billion Stolen from Binance in Attack Attributed to North Korea.
$6.3 Billion Stolen from Binance in Attack Attributed to North Korea Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts.
Binance says its investigation into the $6.3 billion cryptocurrency hack and theft has identified several breach points, including a compromised DevOps engineer’s laptop.
Binance, the world's largest cryptocurrency exchange, confirmed Thursday that it had been hacked in a $6.3 billion cyber heist that blockchain investigators are blaming on North Korea.
Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds.
In this article Attackers stole $6.3 billion from the Binance cryptocurrency exchange Binance says user funds are safe, but watch out for fake support or recovery offers from scammers Users should check their accounts and use official Binance channels.
Binance says a security incident affected approximately $6.3 billion in cryptocurrency.
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
…acker reach a service container and submit unauthorized withdrawal transactions Keys: Binance has found no evidence of any wallet private key leak Impact: The estimated total impact is around $6.3 billion, with about $3 billion frozen on-chain through blockchain partners Coverage: Binance will cover all losses from the SAFU fund and company funds, and says user funds are safe Containm…
The Binance hack drained an estimated $6.3 billion from the exchange’s hot wallets across roughly 10 blockchains on the evening of October 29, 2026.
Attackers pushed unauthorized withdrawal transactions through Binance’s hot wallet infrastructure on October 29, 2026, moving an estimated $6.3 billion in crypto to attacker-controlled wallets.
Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen.
 Ravie Lakshmanan  Oct 30, 2026 Cyber Attack / Cryptocurrency Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets.
Binance Security Incident Affects $6.3 Billion in Crypto Assets, $3 Billion Frozen.
Binance, the world’s largest cryptocurrency exchange, said on Thursday that a “security incident” on its platform affected roughly $6.3 billion worth of assets.
Binance links $6.3 billion crypto theft to compromised DevOps laptop.
Metrics
financial
2,000,000,000
Financial Impact / Stolen Funds
Chainalysis said last December that North Korea stole $2 billion in cryptocurrency in 2025, roughly 50% more than its 2024 total.
Metrics
financial
3,550,000,000
Financial Impact / Stolen Funds
“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.”
According to The Block, blockchain analyst Spreek identified approximately $3.55 billion in incoming transfers to an initially unidentified wallet.
Metrics
financial
900,000,000
Financial Impact / Stolen Funds
“Onchain data flagged by analyst Spreek shows about $3.55 billion in incoming transfers to the unlabeled wallet, with nearly $900 million subsequently moved across other wallets.”
Metrics
financial
5,800,000,000
Financial Impact / Stolen Funds
“Conor Grogan, a senior director and product leader at Coinbase, says the amount is up to $5.8 billion.”
Coinbase executive Conor Grogan initially estimated that the total value of the movements could reach $5.8 billion.
Binance probes potential $5.8 billion crypto-theft hack.
Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, in what could become the largest cryptocurrency hack in history.
Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion Frozen.
Metrics
financial
2,670,000,000
Financial Impact / Stolen Funds
Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all.
Metrics
financial
2,400,000,000
Btc
It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.
TRM says they still hold over 420,000 ETH and 18,270 BTC, about $2.4 billion in assets that no issuer can freeze.
As of 00:30 UTC, about $2.4 billion remains under attacker control, mostly more than 420,000 ETH and 18,270 BTC.
Froze more than $800 million in USDC, in coordination with law enforcement Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet Where Is the Rest of the Stolen Money Going? Roughly $2.4 billion…
Metrics
financial
1,790,000,000
Financial Impact / Stolen Funds
The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports.
Metrics
infrastructure
‎3.48
Software Version
A later update claimed that a third Binance hot wallet transferred another 780 million USDC to the same Ethereum address , bringing the reported total to approximately $3.48 billion.
Metrics
financial
1,567,000,000
Financial Impact / Stolen Funds
Tether CEO Paolo Ardoino said on X that the company had frozen more than $1.567 billion in USDT associated with the potential Binance hack.
Tether: Froze more than $1.567 billion in USDT tied to the theft Circle:
Metrics
financial
800,000,000
Financial Impact / Stolen Funds
Circle CEO Jeremy Allaire also confirmed that the company had frozen more than $800 million in USDC linked to the incident, adding that Circle was coordinating with law enforcement and would continue supporting the investigation.
Froze more than $800 million in USDC, in coordination with law enforcement Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet Where Is the Rest of the Stolen Money Going? Roughly $2.4 billion…
Metrics
financial
2,530,000,000
Financial Impact / Stolen Funds
According to blockchain transaction analysis shared on X by crypto journalist StarPlatinum, a Binance hot wallet known as "Binance 14" transferred approximately $2.53 billion across 64 cryptocurrency tokens, followed 24 seconds later by another $174.4 million from a second Binance wallet.
Metrics
financial
1,770,000,000
Financial Impact / Stolen Funds
The tracked assets include approximately $1.77 billion in USDT, $1.44 billion in Bitcoin, $876 million in Ethereum, and $823 million in USDC.
Metrics
financial
2,300,000,000
Financial Impact / Stolen Funds
The suspected breach has already prompted stablecoin issuers Tether and Circle to freeze more than $2.3 billion in assets associated with the incident.
Metrics
financial
2,270,000,000
Financial Impact / Stolen Funds
Etherscan labels suspected Binance exploiter wallet holding $2.27 billion.
Metrics
financial
86,000,000
Crypto Heist
Related : $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant Related : Crypto Scammers Hijack Microsoft’s Official X Account Related : North Korea Suspected in $351 Million Bitget Crypto Heist
Metrics
financial
351,000,000
Bitget Crypto Heist
Related : $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant Related : Crypto Scammers Hijack Microsoft’s Official X Account Related : North Korea Suspected in $351 Million Bitget Crypto Heist
Metrics
financial
2,700,000,000
Financial Impact / Stolen Funds
By 00:30 UTC on October 30, TRM tallied around $2.7 billion in frozen assets, including roughly 1.77 billion USDT locked by Tether and about 825 million USDC locked by Circle.
While stablecoin issuers Tether, Circle, Ripple, and others have frozen roughly $2.7 billion since the incident, the attackers still have control of about $2.4 billion that can't be frozen.
Metrics
financial
30,000,000
Financial Impact / Stolen Funds
Ripple and World Liberty Financial froze smaller amounts, and Arbitrum’s Security Council used its emergency powers to move about $30 million out of an attacker wallet.
Binance and government agencies have not confirmed the attribution. October 30, 2026, 00:08 UTC Response Arbitrum Security Council moves funds out of an attacker wallet The council forces 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s Arbitrum wallet. October 29, 2026, 23:05 UTC Attack Second wave hits Avalanche and Polygon Binance wallets on Avalanche and P…
Froze more than $800 million in USDC, in coordination with law enforcement Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet Where Is the Rest of the Stolen Money Going? Roughly $2.4 billion…
Metrics
financial
6,400,000,000
Blockchains
…ained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution Binance Hack at a Glance Incident Unauthorized hot wallet withdrawals at Binance Date October 29, 2026, start…
Blockchain intelligence firm Chainalysis confirmed TRM Labs' findings , stating with "a high degree of confidence" that TraderTraitor is responsible for the Binance $6.4 billion hack.
Metrics
infrastructure
‎6.4
Software Version
…rmally. October 30, 2026, early morning UTC Attribution Second firm links the theft to TraderTraitor and a possible Bitget connection emerges Attribution: A second blockchain analytics firm says North Korea’s TraderTraitor likely carried out the hack and raises its loss estimate to about $6.4 billion Bitget link: An independent investigator finds that funds from the Binance hack and the Sep…
Metrics
financial
2,350
Financial Impact / Stolen Funds
…hop wallets to Uniswap, where 30 million was frozen Stablecoin dumping: About 48 million RLUSD was sold on decentralized exchanges between 21:42 and 22:01 UTC, until Ripple froze the remaining 40.5 million Later reporting shows some funds moving through THORChain, a cross-chain swap protocol, an early sign of the cross-chain laundering stage seen after earlier North Korea-linked thefts.
Metrics
infrastructure
40,500,000
Ripple
…hop wallets to Uniswap, where 30 million was frozen Stablecoin dumping: About 48 million RLUSD was sold on decentralized exchanges between 21:42 and 22:01 UTC, until Ripple froze the remaining 40.5 million Later reporting shows some funds moving through THORChain, a cross-chain swap protocol, an early sign of the cross-chain laundering stage seen after earlier North Korea-linked thefts.
Metrics
infrastructure
‎6.3
Software Version
…acker reach a service container and submit unauthorized withdrawal transactions Keys: Binance has found no evidence of any wallet private key leak Impact: The estimated total impact is around $6.3 billion, with about $3 billion frozen on-chain through blockchain partners Coverage: Binance will cover all losses from the SAFU fund and company funds, and says user funds are safe Containm…
Metrics
financial
387,000,000
Loss
Bitget had already said it suspected North Korean attackers in its roughly $387 million loss.
Metrics
financial
1,800,000,000
Financial Impact / Stolen Funds
October 29, 2026, 22:01 to 22:26 UTC Response Ripple and World Liberty Financial freeze stablecoins Ripple freezes the RLUSD the attacker had not yet sold, and World Liberty Financial freezes 27.8 million USD1 in the attacker’s main receiving wallet. October 29, 2026, 21:01 to 21:04 UTC Response Tether and Circle freeze about $1.8 billion Within about 40 minutes of the main Ethereum sweep, T…
Metrics
financial
1,000,000,000
Financial Impact / Stolen Funds
The SAFU fund was created in 2018 to protect users in extreme cases and reportedly holds about $1 billion in bitcoin, so it cannot absorb a loss of this size alone; Binance says company funds will cover the rest.
Metrics
financial
1,340,000,000
Long Positions
Leveraged traders took the brunt, with about $1.55 billion in liquidations over the same period, $1.34 billion of them long positions.
Metrics
financial
3,300,000,000
Financial Impact / Stolen Funds
Blockchain security company Blockaid said in a tweet it was investigating approximately $3.3 billion in suspicious outflows involving Ethereum, Arbitrum and Avalanche.
Metrics
financial
823,000,000
Financial Impact / Stolen Funds
21.04 Circle froze approximately $823 million in USDC.
Metrics
financial
30,500,000
Financial Impact / Stolen Funds
The Arbitrum Security Council is said to have executed a transaction to freeze about $30.5 million from the Binance Exploit.
The Arbitrum Security Council also reportedly executed a transaction to freeze about $30.5 million connected to the Binance exploit .
Metrics
financial
5,912,000,000
Financial Impact / Stolen Funds
"Our current estimate on the amount stolen is approximately $5.912 billion at time of theft, nearly 4x the amount stolen in the next largest crypto heist," blockchain intelligence firm Chainalysis said in an X post.
Intelligence Sources
BleepingComputer 2026-10-30
The Cyber Express 2026-10-30
The Hacker News 2026-10-30
HackRead 2026-10-30
SecurityWeek 2026-10-30
Malware Bytes 2026-10-30
Infosecurity-Magazine 2026-10-30
TheRecord 2026-10-30
BleepingComputer 2026-10-29
HackRead 2026-10-30