Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.

All claims

Chainalysis said funds began leaving Binance hot wallets around 4:20 p.m. ET on October 29, 2026, and that unauthorized transfers totaled approximately $6.4 billion.

This line is our short summary of the quote below. The quote is the evidence.

ReportedamountClaim 189

Around 4:20 p.m. ET on October 29, 2026, funds began leaving Binance hot wallets across multiple blockchains. Unauthorized transfers totaled approximately $6.4 billion, the largest theft in crypto history.

Speaker
Chainalysis
Publisher
Chainalysis (Analytics firm)
Original
The $6.4 Billion Binance Hack: Tracing the North Korea Link
Captured
Archived copy
sha256 5eb4d1d5e510
Event time
Published

Reviewer note: Chainalysis states the time as 4:20 p.m. ET. Converted to UTC at UTC-4 (US daylight time was in effect on 29 October 2026).

On the timeline

Figures from this claim

Other claims from the same source

ReportedamountClaim 298

Chainalysis said unauthorized transfers totaled approximately $6.4 billion.

Unauthorized transfers totaled approximately $6.4 billion, the largest theft in crypto history.

Speaker
Chainalysis
Publisher
Chainalysis (Analytics firm)
Original
The $6.4 Billion Binance Hack: Tracing the North Korea Link
Captured
Archived copy
sha256 5eb4d1d5e510
Published
ReportedattributionClaim 297

Chainalysis said its strongest evidence for TraderTraitor was seeing Binance funds commingle in real time with funds stolen in the Bitget exploit.

The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors.

Speaker
Chainalysis
Publisher
Chainalysis (Analytics firm)
Original
The $6.4 Billion Binance Hack: Tracing the North Korea Link
Captured
Archived copy
sha256 5eb4d1d5e510
Published
ReportedotherClaim 296

Chainalysis said many addresses receive exactly 1 TRX, then more funds, then forward them, and that this repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.

This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.

Speaker
Chainalysis
Publisher
Chainalysis (Analytics firm)
Original
The $6.4 Billion Binance Hack: Tracing the North Korea Link
Captured
Archived copy
sha256 5eb4d1d5e510
Published
ReportedotherClaim 195

Chainalysis said many addresses receive exactly 1 TRX, then additional funds, then forward the funds, which it said suggests a programmatic process.

Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses.

Speaker
Chainalysis
Publisher
Chainalysis (Analytics firm)
Original
The $6.4 Billion Binance Hack: Tracing the North Korea Link
Captured
Archived copy
sha256 5eb4d1d5e510
Published
ReportedotherClaim 194

Chainalysis said the attacker swapped $325 million in stablecoins into $285 million in ETH over nearly 20 minutes to try to stay ahead of the freezes.

Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH.

Speaker
Chainalysis
Publisher
Chainalysis (Analytics firm)
Original
The $6.4 Billion Binance Hack: Tracing the North Korea Link
Captured
Archived copy
sha256 5eb4d1d5e510
Published