Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
An independent, source-backed record. Every statement here is a quote from a named source, with a link, a time and an archived copy, or a calculation you can reproduce from public chain data. Where sources disagree, the figures are shown side by side.
Each tile is the most recent approved figure for that measure, with who published it and when. It is not a consensus. Different sources can publish different values: see all of them on Numbers.
Only claims we reproduced from archived chain data appear here. What parties and media have said is under Claims, attributed to them.
No approved claims on this topic yet.
Credible sources conflict. Each claim links the sources that disagree.
No approved claims on this topic yet.
About $3B was frozen within hours, while most of the ETH and other native assets stayed with the attacker.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Eleven Binance hot-wallet keys signed transfers to an address created minutes earlier, and one of them signed an EIP-7702 authorization that turned its wallet into standing infrastructure for the attacker.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Attacks on signing infrastructure, where an attacker makes an organization’s own keys sign for them, remain the largest source of losses onchain, and at Binance’s estimate of $6.3B this is the largest theft on record, more than four times the roughly $1.5B taken from Bybit in February 2025.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Blockaid relays Binance's estimate; the 'largest theft on record' wording is Blockaid's.
On October 31, the FBI attributed the theft to TraderTraitor, its name for a North Korean state-sponsored hacking group. This confirms Elliptic's earlier assessment.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Elliptic reports the FBI attribution of 31 October. The FBI alert itself is captured separately.
In a video update on October 30, Binance co-CEO Richard Teng said he was hopeful that withdrawals would resume before Sunday, October 31.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Binance has said it will cover all losses using its SAFU fund and company funds, and that it has reserved more than $6.34 billion of company funds to do so. Around $5 billion of this is already held in the same tokens that were stolen, and Binance is buying the rest through the market and OTC trades. It plans to publish a full Proof of Reserves report by Monday.
November 1, 06:00 UTC: Binance announced it has begun reopening withdrawals, starting with $BTC Bitcoin network.
Reviewer note: The 06:00 UTC time is as written in Elliptic's update log, not a time stated by Binance.
Elliptic has verified $2.85 billion of frozen or seized funds, 44% of the theft, almost all of it USDT and USDC. The attacker is swapping the rest into ETH and other assets that cannot be frozen, and moving funds between blockchains, using automated scripts that run around the clock.