ReportedattributionClaim 200
Elliptic said it publishes a free CSV of every address its investigators have linked to the Binance hack.
Download every address our investigators have linked to the Binance hack as a single CSV file.
Claims
Each claim is one attributed statement with a verbatim quote from a stored copy of the source. Only claims a person has approved are shown.
Official means the party said it, not that it is true.
- Verified on-chain. Reproduced by us from raw chain data archived in our own storage. The method is shown.
- Official. Stated by the party concerned (an exchange, an agency, a token issuer or similar), attributed to them. Official means the party said it, not that it is true.
- Reported. Stated by news media or an analytics firm, attributed to them.
- Disputed. Credible sources conflict. The claim links the sources that disagree.
- Debunked. Contradicted by primary evidence, which is linked.
- Theory. Speculation, attributed to whoever proposed it, shown with the evidence for and against.
170 claims.
ReportedamountClaim 198
Elliptic said that about $6.43 billion was stolen from Binance across 11 blockchains on October 29.
On October 29, about $6.43 billion was stolen from Binance across 11 blockchains.
Reviewer note: TRM and Hacken count ten blockchains.
ReportedotherClaim 197
Elliptic said swaps into THORChain use the same amounts repeatedly, with one value appearing 19 times, which it read as evidence of software-driven laundering.
Swaps into THORChain use the same amounts again and again, with one value appearing 19 times.
ReportedotherClaim 196
Elliptic said the main Tron distribution wallet had sent funds every hour for 31 hours straight, with a longest pause of 46 minutes and no overnight break.
The main Tron distribution wallet has sent funds every hour for 31 hours straight.** The longest pause was 46 minutes, and there was no overnight break.
OfficialattributionClaim 188
The FBI said in its alert that the addresses it lists (ETH, BTC and SOL) are holding or have held assets from the theft and are operated by or closely connected to North Korean TraderTraitor actors.
The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:
Reviewer note: The FBI list has 608 ETH, 19 BTC and 1 SOL addresses. They are in the alert; the Wallets page lists them with this claim as provenance.
OfficialattributionClaim 187
The FBI said in its alert that it, the USSS and IRS-CI urge private sector entities to block transactions with or derived from the addresses TraderTraitor actors are using to launder the stolen assets.
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
OfficialattributionClaim 186
The FBI said in its alert that, together with the USSS and IRS-CI, it had observed TraderTraitor actors converting stolen assets primarily into Ethereum, and expected them to be laundered further through DeFi and instant swap services.
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
OfficialattributionClaim 185
The FBI said in an alert dated October 31, 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, and that it refers to this North Korean activity as TraderTraitor.
The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
OfficialwithdrawalsClaim 181
Binance said in Recovery Update #4 that it was preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 UTC.
Binance is preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 (UTC).
Reviewer note: 06:00 UTC is the start of the window Binance announced, not a time at which withdrawals were confirmed open.
ReportedwithdrawalsClaim 58
Binance announced it has begun reopening withdrawals, starting with the Bitcoin network.
November 1, 06:00 UTC: Binance announced it has begun reopening withdrawals, starting with $BTC Bitcoin network.
Reviewer note: The 06:00 UTC time is as written in Elliptic's update log, not a time stated by Binance.
OfficialresponseClaim 184
Binance said in Recovery Update #4 that deposit services remain open and are not affected by the incident.
Deposit services remain open and are not affected by the incident.
Officialroot causeClaim 183
Binance said in Recovery Update #4 that it will publish a post-incident report with further details once the investigation is complete.
Once the investigation is complete, we will publish a post-incident report with further details on the incident.
OfficialrecoveryClaim 182
Binance said in Recovery Update #4 that it had now covered approximately 95% of the impacted amount, up from 90% in the prior update, with the outstanding 5% in less liquid tokens outside the top ten.
Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update. The outstanding 5% are tokens outside the top ten listed above, and are less liquid in the market and take longer time to source at the required scale.
ReportedotherClaim 199
Elliptic said at 22:41 UTC on October 31 that about $196 million had been sent out of the main Tron distribution wallet to around 200 wallets.
October 31, 22:41 UTC.** About $196 million has been sent out of the main Tron distribution wallet to around 200 wallets,
ReportedrecoveryClaim 11
The US Secret Service stated that it is working around the clock with private sector partners to identify, freeze, trace, and recover funds stolen from Binance.
The US Secret Service said on Friday it is "working around the clock" with private sector partners "to identify, freeze, trace, and recover funds" stolen from Binance.
ReportedfreezeClaim 10
Binance stated that it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms, and partners.
On Friday, the company said it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms and partners.
Reportedroot causeClaim 9
Richard Teng, Binance's co-chief executive officer, stated that the hack was carried out by more than one person using sophisticated methods to hide their tracks.
Richard Teng, Binance's co-chief executive officer, said the hack was carried out by more than one person, and the hackers used sophisticated methods to hide their tracks, such as a "self-destruct mechanism".
Reportedroot causeClaim 8
Binance's initial investigation suggested an engineer's laptop was compromised, allowing access to unauthorised withdrawals, but a later update said they had uncovered additional points of breach.
Binance's initial investigation suggested an engineer's laptop was compromised, which allowed access to unauthorised withdrawals, but a later update said they had uncovered "additional points of breach".
ReportedrecoveryClaim 7
Binance stated that all holdings of bitcoin, Ethereum, and Tether, along with seven other widely-traded crypto assets, are covered.
All holdings of the cryptocurrencies bitcoin, Ethereum and Tether are covered, along with seven other widely-traded crypto assets, the company said.
ReportedrecoveryClaim 6
Binance stated that it had replenished the stolen assets using various funds and its own corporate treasury.
Binance said it had replenished the stolen assets using various funds and its own corporate treasury.
ReportedattributionClaim 5
The FBI stated that it observed hackers converting stolen assets into Ethereum and expected further conversion using decentralised finance and instant swap services.
The FBI said it had observed hackers converting stolen assets into a type of cryptocurrency called Ethereum and that it is expected that the assets will then be converted again using decentralised finance and instant swap services.
ReportedattributionClaim 4
The FBI stated that North Korea was responsible for the attack.
The Federal Bureau of Investigation (FBI) said on Saturday that North Korea was responsible for the attack.
ReportedwithdrawalsClaim 3
Binance stated that withdrawals had been restored on several of its networks after being suspended following the hack.
In an update on Sunday, Binance said withdrawals had been restored on several of its networks, after they were suspended following the hack.
ReportedresponseClaim 2
Binance stated that it will absorb the financial impact of the stolen funds rather than its users.
"Binance will absorb the financial impact of these stolen funds, not our users," the company said in a statement on Saturday.
ReportedrecoveryClaim 1
Binance stated that it has set aside more than $6.34bn in company funds to cover the losses.
Binance has consistently pledged to cover 100% of the losses from what is suspected to be crypto's biggest hack on record and said it has set aside more than $6.34bn in company funds to do so.