Binance Hack (Oct 29, 2026): How North Korea Stole $6.3B, Traced On-Chain

As of Nov 1, 2026, 17:41 UTC. Figures are still changing, and this post will be updated as Binance and the tracing firms publish more.

On October 29, 2026, attackers the FBI ties to North Korea's TraderTraitor unit took between $6.3 billion and $6.43 billion from Binance hot wallets on 11 blockchains in roughly three hours (Binance, Elliptic, FBI). Binance says it is paying for the loss itself, and withdrawals began reopening in phases on November 1 (Reuters). About $2.8 billion to $3 billion, almost all of it stablecoins, is frozen, while the bitcoin, ether and XRP the attacker kept can't be frozen by anyone.

I didn't trace this one myself. Elliptic, Chainalysis, TRM Labs and ZachXBT had the main wallets mapped within hours, and their work is linked throughout. What follows is the theft as it appears on public block explorers, one transaction at a time, with every hash linked so you can open it yourself. All times are UTC, as shown on Etherscan.

How big it was, depending on who's counting

The totals differ because each firm prices tokens at a different moment and counts different wallets. Elliptic, for example, leaves out $169 million that it says appears to be Binance moving its own funds after it suspended withdrawals.

20:05 UTC: the XRP went first

The first funds to move weren't on Ethereum. Between Oct 29, 2026 20:05:00 UTC and 20:09:20 UTC, five Binance wallets on the XRP Ledger sent 233,461,943 XRP to a brand-new account, rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx. XRPSCAN now flags it “Reported as hacked.” As of November 1 the account hadn't sent a single transaction. XRP has no issuer that can freeze it, so that balance just sits there.

20:20 UTC: one transaction handed Binance 14 to the attacker

At Oct 29, 2026 20:20:59 UTC, a wallet funded days earlier with three 0.1 ETH withdrawals from Tornado Cash (0x7C86…5CA0) sent transaction 0xad99…298b. Binance's Ethereum hot wallet “Binance 14” didn't lose any money in this transaction. It lost control.

The transaction is type 4, the format added by EIP-7702 in Ethereum's 2025 Pectra upgrade. EIP-7702 lets an ordinary wallet point to smart-contract code, so the wallet then behaves like that contract, provided the wallet's owner has signed an authorization. This transaction carried 50 authorizations signed for Binance 14, each one for a different upcoming nonce, so whichever matched the wallet's next nonce would take effect (Elliptic). One did. From that block on, Binance 14 ran the attacker's sweeper contract, 0x63e8…6fAe.

No Ethereum bug was involved. The authorizations carry valid Binance 14 signatures. Binance's first explanation was a compromised DevOps engineer's laptop that gave the attacker access to a service container able to submit withdrawals, with no evidence of a private-key leak (Binance). Binance later said on X that its follow-up investigation had uncovered additional “points of breach,” which it hasn't described yet (AP). In an Oct 30 video, co-CEO Richard Teng said, “This was not carried out by one person” (BBC), and that the delegation “did not pass through our normal approval controls” (Elliptic, quoting Teng).

Bybit is the obvious comparison, and the two differ in how the signature was obtained. In February 2025 the same FBI-named group took about $1.5 billion from Bybit (FBI). At Bybit, signers approved a tampered transaction. It reached them through a compromised Safe{Wallet} interface, which we went through step by step in our Bybit hack forensic walkthrough. At Binance, the on-chain evidence points to the attacker getting Binance's own signing systems to sign (TRM Labs, via Bitcoin.com). How they got that access isn't public yet.

20:24 UTC: the sweep

Three and a half minutes later, at Oct 29, 2026 20:24:23 UTC, transaction 0x53bd…e2f3 called sweep() on Binance 14. It moved 167,464 ETH, 1,615,409,498 USDT and more than 60 other tokens to 0x5227…2f8c. Elliptic puts that single transaction at $2.53 billion.

Twenty-four seconds later, at 20:24:47 UTC, a second hot wallet, Binance 16, sent 28,005.6 ETH to the same address in an ordinary signed transfer (0x51f2…d39f). At 20:41:23 UTC, the first 780 million of the 823 million USDC now frozen in the attacker's wallet was pulled out of Binance Hot Wallet 34 through the hijacked Binance 14 (0xdc10…7481). Wallets on Solana, Tron, Bitcoin, Arbitrum, Avalanche and several other chains were drained in the same window, and a second wave hit Avalanche and Polygon after 23:00 UTC (Elliptic).

Why $2 billion froze within the hour and the bitcoin can't be

Tether froze the attacker's main wallet at Oct 29, 2026 21:01:35 UTC, 37 minutes after the sweep landed (Etherscan, tx 0x7bab…8659). Circle blacklisted the same wallet in USDC at Oct 29, 2026 21:04:59 UTC, three and a half minutes later (Etherscan, tx 0xc954…fc5f). You can see the result on Etherscan: 0x5227…2f8c still holds 1,175,464,712 USDT and 823,000,000 USDC that can't be moved. Ripple, World Liberty Financial, Paxos and First Digital froze their own stablecoins too, and the Arbitrum and Optimism governance bodies moved funds out of the attacker's reach (Elliptic).

Thirty-seven minutes is fast, and it isn't what most people should expect. In my cases, Tether freezes have sometimes taken days. That's mostly because the work I've done has been freezing older funds, not a theft that happened that afternoon. For an event this size, Tether acts in minutes or hours. When a fresh theft reaches me soon after it happens, the freeze request can go out quickly too, but Tether, as the issuer, makes the final call on whether and when to freeze. Our guide to stolen USDT recovery explains how that freeze process works for individual victims.

Bitcoin, ether and XRP have no issuer to call. The FBI’s list includes 19 Bitcoin addresses. On mempool.space they hold 18,270.2 BTC between them, most in round 1,000 BTC lots, and none of it had moved as of November 1. Elliptic estimates the attacker still controls about $3.21 billion in assets that can't be frozen.

Where the rest went

The attacker raced to convert USDT before more of it could be frozen. Elliptic counts 434 million USDT swapped into 160,451 ETH through Uniswap, 1inch and RFQ market makers, at a loss of 12% to 26%. Chainalysis saw $325 million in stablecoins become $285 million in ETH in about 20 minutes. On Tron, 234 million USDT became 638 million TRX on SunSwap. Elliptic counts 546 transfers from the main Tron laundering wallet, with a median gap of 96 seconds, a pattern it reads as automated.

Some of the ETH went through THORChain. On October 30, 0x1510…feb7 received several deposits from THORChain's router. Early on Oct 30 UTC, ZachXBT posted that stolen Binance funds and funds from the $388 million Bitget exploit had been commingled at one address after arriving via THORChain, and that this “indicates the same actor is likely behind both incidents” (ZachXBT on X). Coverage of his post identifies that address as 0x1510…feb7 (Crypto Economy). Chainalysis also cites commingling with Bitget funds, a theft already attributed to North Korea, as its strongest evidence for TraderTraitor (Chainalysis). Shared wallets are a strong signal, but they don't prove the same people ran both operations. On Oct 30, 2026 06:11:59 UTC, 0x1510…feb7 sent 166.87 ETH (tx 0xa4b5…38a3) to 0x3912…912F, one of the 608 Ethereum addresses on the FBI’s block list. For another theft attributed to North Korea, see our write-up of the Kelp DAO restaking hack.

Sweepers aren't only an exchange problem

The tool at the center of this theft, a sweeper, is something I run into a lot in individual cases. A sweeper is code that empties a wallet as soon as funds arrive. In the Binance case it was a contract that Binance 14 was delegated to. With EIP-7702, any ordinary Ethereum wallet whose owner signs a delegation can end up running someone else's sweeper (CoinDesk explainer).

Once a wallet is compromised, any ETH or tokens sent to it will likely be swept too. Don't top it up with ETH for gas to “rescue” what's left. Our guide to what to do after a crypto scam covers the first steps.

Is your money on Binance safe?

Binance says customers won't bear the loss. By November 1 it had replenished about 95% of the stolen assets, up from 90% the day before, using its SAFU fund, part of its futures insurance fund and corporate treasury money (Reuters, CNBC). “Replenished” means Binance bought replacement tokens with its own money. It doesn't mean the stolen funds came back. The frozen stablecoins are still sitting in the attacker's wallets, and the rest is with the attacker or being laundered.

Binance has said it will publish an updated Proof of Reserves once remediation is finished. For how exchange losses usually play out for customers, see our guide to what happens to your funds in a cryptocurrency exchange hack.

If you have a Binance account

• Check your balance only in the Binance app or at a binance.com address you type yourself (BBC). As of Oct 30, Binance hadn't announced any claims process (McAfee).
• Withdrawals are reopening in phases, starting with 15 assets, and some may fail at first under heavy traffic (TokenPost). A retry from the app is fine. A “priority withdrawal” link in a DM is not.
• Treat any unsolicited “Binance support,” refund or recovery offer as hostile. The FBI has warned that fake law firms and recovery services target people who've lost crypto and charge fees for help that never comes (IC3).
• If you have information about the attacker's addresses, the FBI asks for it at ic3.gov.

If your money was on Binance, you don't need to hire anyone. Binance says it is covering customer losses itself. If you lost crypto in a separate theft, the timing point above applies to you. We offer a free case assessment. We can't promise a freeze or a recovery.