Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
Newest first. The raw hash is the SHA-256 of the stored copy exactly as fetched. The text hash is of the text extracted from it, which is what is compared between captures.
| Captured (UTC) | Fetched via | HTTP | Raw sha256 | Text sha256 | Text changed |
|---|---|---|---|---|---|
| firecrawl-web08 | 200 | 0b00778cbe0c272df4861285b4349fd8f1b981ee6e853e96a6fa6d0339019c32 | b0db3b235db845f62dd8205adbdc88d0ea751206303ae6aad5a65b51cc1807e0 | No |
No text changes detected between captures of this source.
Elliptic's analysis shows that $6.43 billion in cryptoassets was stolen from Binance on October 29, 2026, more than four times the $1.46 billion stolen from Bybit in 2025.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
The stolen USDT reached the attacker's main Ethereum wallet at 20:24 UTC. Tether froze that wallet 37 minutes later, locking 1.18 billion USDT in place, and then followed the funds, freezing four more attacker addresses within 17 minutes. Circle froze the 823 million USDC in the same wallet three minutes after that.
In a video update on October 30, Binance co-CEO Richard Teng said he was hopeful that withdrawals would resume before Sunday, October 31.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
On October 30, the attacker began moving funds between blockchains. Between 11:38 and 12:29 UTC, they sold all of the stolen AVAX for USDC, bridged it to Ethereum using Circle's Cross-Chain Transfer Protocol (CCTP), and swapped it for 7,242.8 ETH.
Binance initially linked the breach to a compromised DevOps engineer's laptop, but now says it has uncovered additional points of breach in a complex attack that "was not carried out by one person".
Elliptic has verified $2.85 billion of frozen or seized funds, 44% of the theft, almost all of it USDT and USDC. The attacker is swapping the rest into ETH and other assets that cannot be frozen, and moving funds between blockchains, using automated scripts that run around the clock.
Binance has said it will cover all losses using its SAFU fund and company funds, and that it has reserved more than $6.34 billion of company funds to do so. Around $5 billion of this is already held in the same tokens that were stolen, and Binance is buying the rest through the market and OTC trades. It plans to publish a full Proof of Reserves report by Monday.
The Arbitrum Security Council took emergency action to move assets out of the attacker's reach, and on October 31 Optimism's governance appears to have done the same, moving 44 million OP (around $5 million) out of the attacker's address.
Stablecoins make up 94% of the frozen funds, almost entirely on Ethereum and Tron. Arbitrum and Optimism are the only blockchains where everything stolen has been secured, in both cases by the network's own governance. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because native assets have no issuer that can freeze them.
Before the freezes landed, the attacker converted around $786 million of stablecoins into ETH and TRX.
On Ethereum, 434 million USDT was swapped for 160,451 ETH through Uniswap, 1inch and market makers' request-for-quote systems. The swaps implied a loss of 12% to 26% against the market price, suggesting the attacker was prioritizing speed over value.
A second attacker wallet deposited 59.9 million USDT into Aave as collateral and borrowed 19,762 ETH, before Aave froze the affected markets. The loan is still open and close to the point of liquidation.
On Tron, 234 million USDT was swapped for 638 million TRX on SunSwap. On Ethereum, 48 million RLUSD was sold before Ripple froze the remainder, and around 150 other tokens were dumped for ETH on decentralized exchanges.
The 18,270 BTC has been split through a short peel chain into 19 addresses, most holding 1,000 BTC each. None of it has yet been sent to a service.
At current prices, the attacker now controls around $3.25 billion of assets that cannot be frozen by an issuer, spread across more than 800 addresses. This includes around 584,000 ETH ($1.32 billion), 18,327 BTC ($1.42 billion) and 233 million XRP.
On October 31, the FBI attributed the theft to TraderTraitor, its name for a North Korean state-sponsored hacking group. This confirms Elliptic's earlier assessment.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Elliptic reports the FBI attribution of 31 October. The FBI alert itself is captured separately.
November 1, 06:00 UTC: Binance announced it has begun reopening withdrawals, starting with $BTC Bitcoin network.
Reviewer note: The 06:00 UTC time is as written in Elliptic's update log, not a time stated by Binance.