Binance $6.3 Billion Hack: North Korean Hackers Identified, Stolen Bitcoin Tracked and Latest Updates

More than $6.3 billion in cryptocurrency disappeared from Binance-controlled wallets in minutes on October 29, 2026, making it the largest reported cryptocurrency theft in history.

The FBI has identified North Korea's TraderTraitor hacking operation as responsible for the attack, while blockchain investigators continue tracking thousands of transactions involving stolen Bitcoin, Ethereum, and other digital assets. The hackers reportedly stole 18,270 Bitcoin worth approximately $1.48 billion, along with billions in other cryptocurrencies. Although roughly $3 billion in affected assets has been frozen or restricted, investigators are still tracing much of the remaining cryptocurrency.

Binance has since resumed some withdrawals and committed billions of dollars in company resources to replace the stolen assets.

The incident has also raised questions among cryptocurrency users about how the hackers gained access, whether customer funds are safe, and why the world's largest cryptocurrency exchange could lose so much money in such a short time.

How the Binance Hack Started on October 29

The attack did not begin when the first billions disappeared.

According to blockchain intelligence firms TRM Labs and Elliptic, the attackers had been preparing their infrastructure before October 29.

Investigators identified cryptocurrency wallets that received small amounts of Ethereum through Tornado Cash, a cryptocurrency mixing service, on October 28 and 29.

These transactions appear to have helped prepare wallets used during the attack. At approximately 3:59 p.m. UTC on October 29, the attackers deployed malicious smart-contract code that would later be used to control a Binance wallet.

Several hours later, the major unauthorized transfers began. At approximately 8:05 p.m. UTC, equivalent to 4:05 a.m. Philippine time on October 30, five Binance wallets on the XRP Ledger transferred approximately 233 million XRP to an attacker-controlled address.

Over the following minutes, other Binance wallets began transferring assets across multiple networks, including Bitcoin, Ethereum, Tron, and Solana. At around 8:20 p.m. UTC, the attackers submitted a transaction involving 50 pre-signed authorizations to gain control of a Binance Ethereum hot wallet known as Binance 14.

Approximately three and a half minutes later, the compromised wallet was drained of 167,464 ETH and numerous other tokens. A second wave of suspicious transactions followed later that evening. Investigators estimate that most of the $6.3 billion theft happened within approximately 20 minutes.

Timeline of the attack

The timeline is based on blockchain transaction records and public investigation updates. It does not establish the exact moment the attackers first entered Binance's internal systems.

Who Hacked Binance? FBI Names North Korea's TraderTraitor

On October 31, the FBI officially attributed the attack to TraderTraitor, a North Korean state-sponsored hacking operation.

TraderTraitor has previously been associated with major cryptocurrency thefts, including the approximately $1.5 billion Bybit hack in February 2025.

The FBI said it was working with the U.S. Secret Service and IRS Criminal Investigation to identify and disrupt the movement of the stolen cryptocurrency.

However, no individual hackers have been publicly named as confirmed perpetrators of the October 29 Binance attack. TraderTraitor is the name of the operation, not the name of an individual hacker. Investigators have identified technical similarities between this incident and earlier North Korean cryptocurrency attacks, including the preparation of wallets, compromised transaction-signing systems, and rapid movement of stolen assets. 

Binance co-CEO Richard Teng has also indicated that the attack involved more than one person. The investigation has not publicly established the identities or precise roles of the individuals involved.

How Did Hackers Gain Access to Binance's Wallets?

Binance initially identified a compromised laptop belonging to a DevOps engineer as a possible entry point. According to the exchange's preliminary findings, the attackers may have used the compromised device to access internal systems and submit unauthorized withdrawal transactions.

Further investigation revealed that the breach was more complicated. The attackers appear to have compromised systems responsible for authorizing cryptocurrency transactions, allowing transfers that appeared to carry valid signatures.

On Ethereum, investigators identified the use of EIP-7702, a blockchain feature that allows a regular wallet to temporarily delegate certain functions to a smart contract.

The attackers abused this functionality to give their own malicious contract control over Binance 14. Once that access was established, the contract could automatically transfer cryptocurrency out of the affected wallet. Elliptic reported that the attackers also used the compromised wallet's ownership permissions to move assets from another Binance wallet.

The malicious authorization remained active long enough for additional incoming deposits to be transferred. Binance has stated that it found no evidence that its private keys were directly leaked.

The investigation instead points toward compromised internal infrastructure capable of instructing Binance's systems to authorize transactions.

The company has not yet published a complete technical explanation of every breach point.

How Did Binance Users Find Out About the Hack?

The first public warning signs came from blockchain activity.

Because cryptocurrency transactions are recorded on public blockchains, analysts could see unusually large transfers leaving Binance-controlled wallets.

Blockchain monitoring services and cryptocurrency researchers began identifying transactions that appeared inconsistent with ordinary exchange activity.

As the suspicious transfers spread across multiple networks, reports circulated through cryptocurrency news outlets and social media.

Binance subsequently acknowledged a potential security issue and temporarily suspended deposits and withdrawals on affected networks.

The company said the suspension was a precaution while its security teams investigated the unauthorized transactions.

For customers, the incident became particularly noticeable when withdrawal services were interrupted. The news also spread quickly through cryptocurrency communities, where users questioned whether their assets remained accessible and whether Binance could cover the losses.

Importantly, the public blockchain records revealed the movement of funds, but they did not immediately explain how the attackers gained access or who was responsible.

Those findings emerged through subsequent investigations.

How Much Bitcoin and Cryptocurrency Was Stolen?

The theft affected several cryptocurrency networks and involved both major digital currencies and stablecoins. According to TRM Labs, approximately $6.36 billion was stolen across ten blockchain networks. Elliptic's separate investigation estimated approximately $6.43 billion across eleven networks.

The difference reflects how each company identified and valued affected transactions.

These values are estimates from the time of the attack and may change with cryptocurrency prices. The incident exceeded the $1.5 billion Bybit theft from February 2025, making it the largest reported cryptocurrency hack on record.

Where Did the Hackers Send the 18,270 Bitcoin?

The stolen Bitcoin was not kept in one wallet. According to CoinDesk's October 30 blockchain analysis, the attackers distributed approximately 18,270 BTC across 19 wallets. Seventeen of those wallets reportedly held exactly 1,000 BTC each. At the time of CoinDesk's analysis, none of the 19 wallets had sent the Bitcoin onward.

That observation was a snapshot from October 30, not a confirmation that the Bitcoin remains unmoved as of November 2. Bitcoin presents a particular challenge for investigators because there is no central issuer capable of freezing ordinary BTC directly on the blockchain.

Unlike certain stablecoins, Bitcoin can continue moving between addresses unless an intermediary such as an exchange blocks or seizes it.

The attackers have also been converting other stolen assets into Ethereum and moving funds between different cryptocurrency networks. Investigators continue monitoring these transactions.

Where Can You Track the Hacker's Crypto Wallets?

The FBI has published an official list of cryptocurrency addresses associated with the TraderTraitor operation and the Binance theft.

These addresses can be searched using public blockchain explorers, allowing readers to inspect balances, transfers and transaction histories.

The most reliable starting point is the FBI's official address list:

FBI: North Korea Responsible for $6 Billion+ Binance Attack

For example, the FBI identified this Ethereum address as associated with the attack:

0x8532FA14ACAf483729C449b8458aedDb900543D4

Its public transaction history can be viewed here:

View the FBI-listed address on Etherscan

Readers can also use the following blockchain explorers:

• Etherscanfor Ethereum addresses and transactions
• Mempool.spacefor Bitcoin addresses and transfers
• Solscanfor Solana transactions
• Tronscanfor Tron addresses and transfers

To track a wallet, copy an address from the FBI's published list and paste it into the explorer for the corresponding blockchain.

The explorer will show publicly recorded transactions and balances, which may change as new transactions are confirmed. However, the address shown above is only one of many addresses associated with the investigation. It should not be treated as a complete view of the stolen funds.

An address appearing in a transaction history also does not automatically establish that its owner participated in the attack. Investigators must distinguish attacker-controlled wallets from intermediaries, exchanges, and other recipients.

How Much of the Stolen Cryptocurrency Has Been Frozen?

Cryptocurrency companies moved quickly to restrict some of the stolen assets.

According to TRM Labs, Tether, Circle, Ripple and World Liberty Financial froze approximately $2.67 billion in stablecoins associated with the theft.

Additional action involving Arbitrum increased the early reported total to roughly $2.7 billion. Elliptic later verified approximately $2.85 billion in frozen or seized assets, representing around 44% of its estimated total theft.

Binance also reported that approximately $3 billion in affected cryptocurrency had been identified for freezing. The amounts vary because the reports cover different stages of the investigation and use different verification methods. Freezing an asset does not necessarily mean it has been recovered.

A freeze may prevent the cryptocurrency from being transferred or redeemed, but additional steps are generally required before the assets can be returned.

Meanwhile, investigators have observed the attackers converting stablecoins into assets such as Ethereum, which cannot be frozen directly by a central token issuer. Some transactions involved decentralized exchanges, cross-chain services, and automated trading activity.

The full amount that authorities will ultimately recover remains uncertain.

What Did Binance's CEOs Say About the Attack?

Binance co-CEOs Richard Teng and Yi He have publicly addressed the incident and reassured customers that the company intends to cover the financial losses. Following the breach, Binance announced that it had allocated more than $6.34 billion in company resources to replace the affected assets. The funds included resources from its corporate treasury, the Secure Asset Fund for Users (SAFU) and other reserves.

On October 31, Teng reported that approximately 90% of the stolen assets had already been replaced.

By November 1, Binance reported that the figure had increased to approximately 95%.

Teng also explained that the investigation had uncovered additional breach points beyond the initially suspected compromised employee laptop. He described the attack as a coordinated operation involving techniques intended to remove evidence and interfere with normal wallet approval procedures. Yi He also addressed concerns about the company's ability to absorb the losses.

Binance has maintained that customers will not be required to bear the direct financial impact of the breach. The executives have committed to restoring withdrawals, strengthening internal security, and publishing additional information about the incident.

However, the exchange's full technical investigation remains ongoing.

Binance Customers Withdraw Billions After Services Resume

Binance began restoring cryptocurrency withdrawals on November 1, starting with selected major assets and networks. The reopening allowed customers to transfer cryptocurrency out of the exchange after services had been suspended during the investigation.

According to Reuters' November 2 reporting, Binance experienced approximately $4.72 billion in net customer withdrawals after services resumed. The company said the outflow represented approximately 2.8% of platform assets and was beginning to stabilize. Reuters also reported approximately $2.7 billion in incoming funds during the period. These customer withdrawals are separate from the cryptocurrency stolen during the October 29 attack.

The figures suggest that some customers responded by moving assets elsewhere, although the available data does not establish that all withdrawals were motivated by fear of the breach. Analysts cited by Reuters said the outflows did not indicate widespread panic. Binance continues working to restore normal operations and provide updated information about its reserves.

What Are Cryptocurrency Users Saying About the Hack?

The attack has triggered significant discussion among cryptocurrency traders, particularly on Reddit and X. Reactions range from concerns about exchange security to confidence that Binance has sufficient resources to cover the losses.

One discussion on Reddit's r/CryptoCurrency community urged users to withdraw their funds following the initial reports. Several commenters questioned whether Binance's assurances about customer funds were enough, while others pointed to the company's reserves and history of reimbursing users. The discussion highlighted three recurring concerns. Trust in centralized exchanges.

Some users argued that the incident reinforces the risks of leaving cryptocurrency on an exchange rather than storing it in a wallet they control. Whether Binance can cover the losses. Other users believed the exchange had enough financial resources to absorb the theft, particularly after billions in stablecoins were frozen.

The possibility of further market declines. Traders also discussed whether stolen Bitcoin might eventually be sold, potentially adding pressure to cryptocurrency prices.

Some users viewed the market decline as a buying opportunity, while others preferred to wait for more information. There have also been online theories suggesting the hack was staged or involved insiders. However, there is currently no publicly established evidence supporting those allegations. The FBI has attributed the theft to North Korea's TraderTraitor operation.

The available discussions do not provide a representative survey of cryptocurrency users, so they cannot establish a single majority opinion. What is clear is that the incident has renewed debate about exchange custody, transparency and the security of cryptocurrency holdings.

Was Bitcoin Hacked, or Was Binance Hacked?

Despite headlines describing the incident as a Bitcoin hack, Bitcoin's blockchain itself was not compromised. The attackers stole Bitcoin from wallets controlled by Binance.

The Bitcoin and cryptocurrency exchanges operate differently. Bitcoin is a decentralized blockchain network that records and validates transactions. Binance is a centralized cryptocurrency exchange that manages digital assets and processes transactions on behalf of customers.

Investigators believe the attackers compromised Binance's internal wallet infrastructure, allowing unauthorized transfers to be approved. The incident therefore represents a failure involving exchange security rather than a successful attack on Bitcoin's underlying cryptography.

For users, the case illustrates the risks of relying on a third party to hold cryptocurrency, even when the underlying blockchain remains operational.

Latest Binance Hack Update as of November 2, 2026

Four days after the attack, the investigation has produced several significant developments. The FBI has formally attributed the theft to North Korea's TraderTraitor operation and published wallet addresses connected to the stolen cryptocurrency.

Blockchain investigators have reconstructed the initial transactions, identified compromised wallet infrastructure and continued tracking funds across multiple networks.

Cryptocurrency issuers and industry partners have frozen billions of dollars in affected assets, although much of the stolen Bitcoin and Ethereum remains outside the reach of direct issuer freezes.

Binance has begun restoring withdrawals and says it has replaced approximately 95% of the affected assets using company resources. Meanwhile, customers have withdrawn billions of dollars following the reopening of services. The full technical explanation of the attack has not yet been released, and the identities of the individual hackers remain undisclosed.

The investigation continues as authorities work to trace the remaining stolen cryptocurrency and determine how much can ultimately be recovered.

For Binance customers and the wider cryptocurrency industry, the incident has raised a question that extends beyond the value of the stolen assets: how can exchanges protect the systems that authorize transactions when attackers do not necessarily need to break the blockchain itself?

Next: The Cornell Sexual Assault Case Explained