Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
This line is our short summary of the quote below. The quote is the evidence.
On October 31, the FBI attributed the theft to TraderTraitor, its name for a North Korean state-sponsored hacking group. This confirms Elliptic's earlier assessment.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Elliptic reports the FBI attribution of 31 October. The FBI alert itself is captured separately.
At current prices, the attacker now controls around $3.25 billion of assets that cannot be frozen by an issuer, spread across more than 800 addresses. This includes around 584,000 ETH ($1.32 billion), 18,327 BTC ($1.42 billion) and 233 million XRP.
The 18,270 BTC has been split through a short peel chain into 19 addresses, most holding 1,000 BTC each. None of it has yet been sent to a service.
On Tron, 234 million USDT was swapped for 638 million TRX on SunSwap. On Ethereum, 48 million RLUSD was sold before Ripple froze the remainder, and around 150 other tokens were dumped for ETH on decentralized exchanges.
A second attacker wallet deposited 59.9 million USDT into Aave as collateral and borrowed 19,762 ETH, before Aave froze the affected markets. The loan is still open and close to the point of liquidation.
On Ethereum, 434 million USDT was swapped for 160,451 ETH through Uniswap, 1inch and market makers' request-for-quote systems. The swaps implied a loss of 12% to 26% against the market price, suggesting the attacker was prioritizing speed over value.