Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
21:01 | Tether freezes 971.1M USDT, 37 minutes after the Ethereum transaction.
Reviewer note: The Speaker field names the party that acted. The timing and the amount are as stated by Hacken, not by Tether. Hacken adds that another count dates the first freezes at 21:14.
Stablecoin issuers began freezing funds 56 minutes after the first transfer. Tether acted first, at 21:01, about 37 minutes after the big Ethereum transaction, and Circle followed three minutes later. Binance suspended deposits and withdrawals that night and published a [written update](https://x.com/binance/status/2115993361517891592) at 02:23 UTC, a little over six hours after the first transfer.
Binance hasn't named a culprit. Teng said the investigation has not attributed responsibility to any individual, and Binance says it is working with law enforcement to confirm who is behind it.
Reviewer note: The speaker named is Richard Teng, shown in the page only as Teng.
The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster.
Stolen Binance funds were seen mixing, in real time, with funds from last month's Bitget theft, which had already been attributed to North Korean actors, and one firm calls that its strongest evidence. Funds from both thefts reached [the same Ethereum address](https://etherscan.io/address/0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7) , as ZachXBT first reported.
Three analytics firms think so: two [attribute the theft to TraderTraitor](https://thenextweb.com/news/binance-hack-6-3bn-north-korea-tradertraitor) , a North Korean hacking unit, and the third [calls it likely](https://www.elliptic.co/insights/binance-largest-hack-in-history/) .