Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
Binance co-CEO Yi He said Ripple helped stop about USD 200 million from moving; TRM has confirmed the 40.5 million RLUSD freeze onchain.
Reviewer note: Yi He's figure is Binance's side of a disagreement: TRM confirmed 40.5 million RLUSD frozen on-chain.
Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.
Early indicators on the Ethereum activity suggested the attacker had phished the authorizations. That explanation covers Ethereum and leaves the other chains unexplained.
North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.
Preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from, starting the morning of October 28.
Binance said it was investigating a potential security issue, then said it had temporarily suspended withdrawals on multiple networks as a precaution. Binance has said user funds are safe.