Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
Newest first. The raw hash is the SHA-256 of the stored copy exactly as fetched. We keep the copy privately and publish its hash. The text hash is of the text extracted from it, which is what is compared between captures.
| Captured (UTC) | Fetched via | HTTP | Raw sha256 | Text sha256 | Text changed |
|---|---|---|---|---|---|
| firecrawl-web08 | 200 | 2ee17a31d7909edc93a8abcf17f725f315e7108125beec3c2503e0c5919fd606 | 9f8f5749580bbd0a43994ed43357e8a155c53b42b2bdefd5dd8289f4b959675f | No |
No text changes detected between captures of this source.
Estimates of the loss run from about $6.3B to $6.36B and $6.43B , which makes this the largest crypto theft on record.
Between $2.7B and $2.84B was frozen within hours , almost all of it stablecoins that issuers such as Tether and Circle can block.
Three analytics firms link the attack to North Korean state actors.
On the evening of 29 October 2026, an attacker emptied Binance hot wallets on 10 blockchains
The first transfers came at 20:05 UTC on the XRP Ledger, where five Binance wallets sent 233 million XRP to a single address.
At 20:20 a Bitcoin hot wallet sent out 18,270 BTC, and a Tron wallet sent more than 600 million USDT right after that.
Ethereum sits in the middle of this sequence: at 20:24, one transaction moved about $2.53B out of a single wallet.
21:01 | Tether freezes 971.1M USDT, 37 minutes after the Ethereum transaction.
21:04 | Circle freezes 823M USDC.
Another count dates the first freezes at 21:14.
22:01 | Ripple freezes 40.5M RLUSD.
22:10 | World Liberty Financial freezes 27.8M USD1.
23:05 | Second wave: Binance wallets on Avalanche and Polygon send funds.
23:35 | Binance states that the verified frozen total is $2.54B.
co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action."
30 Oct, 00:08 | The Arbitrum Security Council moves 8,426 ETH and 74.6M ARB out of the attacker's reach.
at 00:10:35 UTC on 30 October, Binance 14 signed a new authorization that reset its delegation, 3 hours 46 minutes after the sweep.
Binance says it will cover all losses from its SAFU reserve and company funds, and that user funds are safe.
Binance's update of 02:23 UTC, Oct 30 , says its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," and that it has "found no evidence of any wallet private key leak."
04:30 | First public attribution to TraderTraitor.
08:00 | Verified frozen total reaches $2.84B, 44% of the theft.
Ripple and World Liberty Financial froze their tokens inside the compromised wallet, which stopped new deposits of those tokens from being taken.
Three analytics firms think so: two attribute the theft to TraderTraitor , a North Korean hacking unit, and the third calls it likely .
Stolen Binance funds were seen mixing, in real time, with funds from last month's Bitget theft, which had already been attributed to North Korean actors, and one firm calls that its strongest evidence. Funds from both thefts reached the same Ethereum address , as ZachXBT first reported.
The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster.
Binance hasn't named a culprit. Teng said the investigation has not attributed responsibility to any individual, and Binance says it is working with law enforcement to confirm who is behind it.
Stablecoin issuers began freezing funds 56 minutes after the first transfer. Tether acted first, at 21:01, about 37 minutes after the big Ethereum transaction, and Circle followed three minutes later. Binance suspended deposits and withdrawals that night and published a written update at 02:23 UTC, a little over six hours after the first transfer.
Most of the money left in about 20 minutes, and a smaller second wave hit Avalanche and Polygon around 23:05 UTC.
Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.
At Binance the delegation stayed for 3 hours 46 minutes after the sweep and later deposits were swept again
Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true.
Cap value and rate per wallet at the signer and hold new destinations for a second approval
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.
None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing."
Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days .