Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
Newest first. The raw hash is the SHA-256 of the stored copy exactly as fetched. We keep the copy privately and publish its hash. The text hash is of the text extracted from it, which is what is compared between captures.
| Captured (UTC) | Fetched via | HTTP | Raw sha256 | Text sha256 | Text changed |
|---|---|---|---|---|---|
| firecrawl-web08 | 200 | c92181b6b4e02000c8def58c13e47302fd1d36662f75835937a863a1a6cbd79d | cc08c479f52480018782af83ab64d6636fc9e9d1c67be767bddaa3ae4a80b45f | No |
No text changes detected between captures of this source.
A Binance spokesperson told Cointelegraph on Thursday that the exchange was investigating reports of a potential security issue but had not confirmed any impact on user funds.
Concerns were first raised by blockchain researcher Spreek, who posted on X that assets from a Binance-linked Ethereum wallet had been transferred to a newly created address through a contract call allegedly funded by Tornado Cash.
Blockchain analytics platform Arkham Intelligence later identified a collection of wallets labeled “binance-hacker-1029” holding approximately $5.84 billion in digital assets. The figure represents the wallets’ reported holdings rather than a confirmed estimate of stolen funds.
Binance co-founder Changpeng Zhao said the activity appeared to be a hack, adding that Tether and Circle had frozen approximately $971 million and $823 million, respectively. Zhao said he expected all user funds to be fully covered.
Tether CEO Paolo Ardoino said the company had frozen more than $1.567 billion in USDT linked to the potential exploit.
Binance is investigating a potential multibillion-dollar security breach involving one of its Ethereum wallets, after suspicious transfers prompted stablecoin issuers Tether and Circle to reportedly freeze billions in assets.
Decentralized lending protocol Aave froze markets across its V3 and V4 deployments as a precaution following the Binance hack.
the Binance exploiter deposited 60 million USDT and borrowed 19,762 Wrapped Ether (WETH), worth about $44.6 million at the time.
World Liberty Financial has frozen $27 million in US-dollar-pegged stablecoin USD1 and $2 million worth of WLFI, according to Binance co-founder Yi He. “USD1 has taken proactive steps to freeze the $27 million in USD1 associated with the Binance hack,” said World Liberty Financial co-founder and CEO Zach Witkoff.
Binance said the verified total of assets frozen in connection with the hack had reached $2.54 billion, clarifying differing figures circulating publicly, including references to $1.8 billion.
Ripple is freezing holdings of its dollar-pegged RLUSD stablecoin linked to the Binance hack, according to Jack McDonald, the company’s senior vice president of stablecoins. McDonald said Ripple was “actively freezing affected funds” and coordinating with relevant parties to support the investigation. He did not disclose the amount frozen.
Binance said it has temporarily suspended deposits as it conducts security checks, freezes funds and coordinates with law enforcement.
deposits as it conducts security checks, freezes funds and coordinates with law enforcement. It previously confirmed it had suspended withdrawals.
Chainalysis said its current estimate of the amount stolen from Binance is $5.912 billion at the time of theft, four times the amount stolen from crypto exchange Bybit in 2025.
Binance said the current verified amount of assets frozen from the hack is now $3 billion.
The update came after the Arbitrum Security Council said it executed a transaction to freeze $30.5 million from the Binance exploit, involving 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH). “The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications,” it said. “As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet,” it said.
Binance said withdrawals remain paused while it completes a security revamp of its withdrawal service and related addresses, with service expected to resume within 48 hours.
Chainalysis co-founder and CEO Jonathan Levin said the Binance hack was likely carried out by North Korean hacking group TraderTraitor , citing links to a previous hack. In a post on X, Levin put the theft at $6.4 billion, slightly above Binance’s estimated $6.3 billion impact.
In a separate post, onchain investigator ZachXBT said the stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address on Friday, after arriving via THORChain.
“This indicates the same actor is likely behind both incidents,” he said.
“Our investigation has not attributed responsibility to any individual,” he wrote.
Binance’s investigation into its $6.3 billion hack has uncovered “additional points of breach,” the exchange said , after initially pointing to a potentially compromised laptop. The exchange said it was still gathering facts in coordination with law enforcement. Binance said it remained on track to resume withdrawals in 45 hours, while deposits remained unaffected.
“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” the company said . “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”
Binance has set aside more than $6.34 billion in company funds to cover losses from the hack, the exchange said. The company said $5 billion of those funds were already held in the same tokens affected by the attack.
Binance is buying altcoins in quantities matching those stolen in the hack as it prepares updated proof of reserves,
A Binance spokesperson told Cointelegraph that the $5 billion in matching tokens is held in the exchange’s custody. The spokesperson declined to disclose wallet addresses, citing security reasons.
The exchange also said it submits weekly reports on company funds to Abu Dhabi’s Financial Services Regulatory Authority under a requirement that predated the hack.
The spokesperson declined to disclose wallet addresses, citing security reasons. Binance did not disclose when it acquired the assets.
The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”
Binance is aiming to resume withdrawals within 40 hours and publish a full proof-of-reserves report by Monday, co-CEO Richard Teng [said]
Teng also disclosed that the attacker used a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation.
Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue supporting the investigation.
Blockchain security firm Blockaid said its team had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.