Binance Hack

Billions in crypto left the world's biggest exchange in a single evening. We followed every coin, chain by chain, to see how it got out and where it went.

$6.3B Left 17 Binance hot wallets on nine chains between 20:04 and 23:56 UTC on 29 October.

Left 17 Binance hot wallets on nine chains between 20:04 and 23:56 UTC on 29 October.

50 approvals Signed by Binance's system let the attacker's code run its busiest Ethereum hot wallet for 3 hours 50 minutes.

Signed by Binance's system let the attacker's code run its busiest Ethereum hot wallet for 3 hours 50 minutes.

$2.7B Locked by Tether, Circle, Arbitrum's Security Council and four smaller issuers. Six of Tether's 11 freezes hit wallets already emptied.

Locked by Tether, Circle, Arbitrum's Security Council and four smaller issuers. Six of Tether's 11 freezes hit wallets already emptied.

$729M Of stolen USDT was swapped into ETH and TRX before Tether's freezes landed.

Of stolen USDT was swapped into ETH and TRX before Tether's freezes landed.

525,201 ETH now held by the attacker, 2.6x the 200,630 ETH it took. The rest was bought with stolen stablecoins, tokens and TRX.

ETH now held by the attacker, 2.6x the 200,630 ETH it took. The rest was bought with stolen stablecoins, tokens and TRX.

$3.1B Still with the attacker at 16:51 UTC. We found none of it sent to an exchange's deposit address or a mixer.

Still with the attacker at 16:51 UTC. We found none of it sent to an exchange's deposit address or a mixer.

01 · What happened What happened in the Binance hack

On Thursday night, Binance stopped letting its users take money out. The world's biggest crypto exchange said it was looking into a security problem. By then, most of the money was already gone.

Binance is where millions of people buy and sell crypto. Like any exchange, it keeps its customers' coins in wallets it controls, and it pays out withdrawals from a few of those wallets that stay online all the time.

That evening, in under four hours, those wallets sent coins worth $6.3 billion to new addresses on nine blockchains. Ethereum, Bitcoin and TRON took the biggest hits. Binance says a hacker got in through an engineer's laptop and used Binance's own withdrawal system to send the money out.

Bitquery traced each transfer with its blockchain data . We matched every drain to a Binance wallet and followed the money to where it sits now. Tether, Circle, Arbitrum and four smaller token issuers locked $2.7 billion. Most of the rest sits in wallets that have never sent a transaction. Dollar values are at the prices of the moment the coins left, and holdings are as of 16:51 UTC on 31 October.

02 · The setup Where an exchange keeps your coins

An exchange does not keep every coin online. Most sit in cold wallets, which are kept offline and are slow to reach on purpose. A smaller amount sits in hot wallets. These stay online, so the exchange's systems can sign a withdrawal from them in seconds, at any hour, without anyone touching a cold wallet.

Binance publishes the addresses of its wallets in a proof-of-reserves list, a public record that lets anyone check the exchange holds what its customers own. Each wallet drained that night carries the Binance proof-of-reserves label in Bitquery's address data.

A hot wallet moves only when the exchange's withdrawal system signs a transfer. That system is what the hacker reached.

03 · The night Nine chains in under four hours

The first coins left on the XRP Ledger. Five Binance accounts there sent 233.5 million XRP to an account that had not existed a minute earlier. Solana followed five minutes later, then Base and Optimism, two networks built on top of Ethereum.

A quarter of an hour later, the three biggest drains began within minutes of each other. Binance's TRON hot wallet sent out 613 million USDT. Its main Bitcoin hot wallet sent 18,270 BTC, all in one block. On Ethereum, the hacker set a trap inside Binance's busiest hot wallet and sprang it four minutes later.

Ethereum lost the most by far, $3.8 billion from three Binance wallets. Nothing else came close. Drains there kept coming for three and a half hours, and the last one landed after Tether's first freeze and after Binance had paused withdrawals.

The XRP Ledger account shares no address with the rest of the attack. But its transfers were built in the same unusual way as the others, with a higher fee than Binance's own payments that day. Binance's own estimate of the damage, around $6.3 billion, only adds up if those coins are counted.

04 · The break-in How the hacker got in

Early on 30 October, Binance said its first look points to "a compromised DevOps engineer's laptop". That gave the hacker a way into one of Binance's internal services, where the hacker could "submit unauthorized withdrawal transactions". Binance said it found "no evidence of any wallet private key leak".

The chain fits that account. Every drain carries a valid signature from a Binance wallet. On 16 of the 17 wallets, Binance's system simply signed ordinary transfers to the hacker. Those transfers were built differently from Binance's normal ones, though. On Bitcoin they paid twice the usual fee. On TRON and the XRP Ledger they used settings we did not see on any of Binance's own transfers that night. The signing was Binance's. The software asking for it was not.

On Ethereum the hacker went further. Since the Pectra upgrade last year, an Ethereum wallet can sign a note called an EIP-7702 authorization. It lets the wallet borrow a smart contract's code, a program that lives on the chain, and run it as its own. Four minutes before the main drain, the hacker's wallet sent in a batch of these notes for Binance 14, Binance's busiest Ethereum hot wallet. Each note only works when the wallet's transaction count hits one exact value, so the hacker brought 50, one for each count in a row. One of them matched.

From that moment the wallet ran the hacker's code. The hacker called it seven times over the three and a half hours. The first call alone took 167,000 ETH, 1.6 billion USDT and 62 other tokens in one transaction. Seconds later, a second Binance hot wallet signed nine transfers of its own.

Binance cancelled the note just after midnight UTC, almost four hours after it was set. More than an hour and a half of that came after withdrawals were paused.

The chain cannot show who asked Binance's system to sign. ZachXBT and the security firm Blockaid said North Korea was likely behind it, CoinDesk reported . Binance has named nobody and says it is working with law enforcement.

The hacker's Ethereum wallet got its first gas money, the coin that pays network fees, from Tornado Cash, a mixer that breaks the link between where coins come from and where they go. 1 ETH came out of the mixer five and a half hours before the Ethereum drain, and smaller amounts the day before.

05 · The freezes The race against the freezes

Stablecoins like USDT and USDC have an off switch. Their issuers, Tether and Circle, can freeze an address so that the tokens sitting in it cannot move until the issuer lifts the freeze. The hacker moved fast to stay ahead of that switch.

Tether's first freeze hit the main Ethereum receiver 37 minutes after the big drain, and by then 700 million USDT had already left it for two new wallets. From there the money ran down a chain of fresh wallets. At each step some of it was swapped, and the rest was passed on before the freeze arrived. Back at the start, later drains still sent another 204 million USDT into the frozen main wallet, where it is stuck too. Of that, 200 million USDT came from Binance itself. At 21:42 UTC, 78 minutes after the main drain, a wallet that Binance lists in its proof of reserves sent that money to Binance 14. Binance 14 still ran the hacker's code, and 72 seconds later the hacker moved the money on to the frozen main wallet.

Tether froze 11 of the hacker's wallets on Ethereum and TRON. Six were already empty when the freeze landed. One wallet passed on 130 million USDT less than a minute before its freeze. On Polygon, a smaller amount of USDT was frozen later that night.

Circle froze the 823 million USDC in the main Ethereum wallet three minutes after Tether's first freeze, before any of it moved. Smaller issuers acted too. World Liberty froze its WLFI token in the main receiver at 20:57, before anyone else, and later its USD1 stablecoin, as Zach Witkoff confirmed on X . Tether's gold token, Paxos, Ripple and First Digital followed. Together these six token freezes locked $132 million.

Just after midnight, Arbitrum's Security Council moved the hacker's ARB and ETH on that network into a locked wallet. The council is a group that can act for the network in an emergency.

In all, 1.76 billion USDT is locked, 71% of what was taken. The other $729 million got out first. On Ethereum it went through UniswapX and 1inch Fusion, swap apps where market makers fill big orders, and through Uniswap's own pools. Some went into Aave, a lending app, as collateral for a loan paid out in ETH. On TRON it was swapped on SunSwap, TRON's main swap app. Our audit of Tether's freezes explains how the blacklist works.

06 · The swap How stolen dollars became ETH

The hacker took 200,000 ETH from Binance. Hours later, it held more than twice as much. The extra was bought with stolen stablecoins and the other tokens it took, and later with TRX. Many of those tokens went to a fresh wallet first and were then sold on Uniswap and other DEXes.

Speed cost money. On the stablecoins it sold through UniswapX and 1inch Fusion, the hacker paid 16% over the market price for its ETH.

In all, the rushed swaps cost the hacker $119 million against market prices. Traders on the other side of those swaps kept $60 million after their costs. Our follow-up on who profited from the hacker's swaps tracks that money wallet by wallet.

The swaps also explain two figures that went round on X , $875 million in ETH and $234 million in TRX. Both counted coins the hacker had bought with stolen stablecoins, which is why they run well above what Binance lost in those coins.

07 · The money Where the money sits now

When we last read the chains, at 16:51 UTC on 31 October, the hacker held $3.1 billion. ETH and BTC make up most of it.

Seven big Ethereum wallets that have never sent a transaction hold almost all the ETH. The Bitcoin sits in 19 addresses, most of them holding 1,000 BTC each. The XRP and the Solana coins have not moved. On TRON, one wallet holds 158 million TRX and has never sent a transaction. The payout wallet holds the rest.

The hacker spent the early hours of 30 October pulling its ETH together. At 05:15 UTC the main receiving wallet sent 17,260 ETH to a new wallet. Between 05:27 and 05:36, four wallets the hacker had used to sell stolen tokens such as LINK and USDe sent 14,540 ETH into one of the stash wallets. At 06:36 the second receiving wallet sent 7,647 ETH into another. All of that ETH stayed in wallets we track.

Later that morning the biggest TRON wallet moved. Between 10:15 and 10:20 UTC on 30 October, it sent out all 638 million TRX it held, in five lots. Three new wallets got 398 million. The other 240 million went through two more new wallets to the wallet that pays out TRX in small lots. On 31 October, two of the three new wallets sent their 240 million TRX to the payout wallet too. The third has not moved.

From the morning of 30 October to the afternoon of 31 October, the payout wallet sent 427 million TRX to 171 addresses. At least six of those addresses sent TRX straight into a swap router. On 30 October we followed that route through SunSwap to two wallets we could not then name. They belong to a cash desk, a service that pays out USDT for crypto. The same desk took stolen money in the Ledger and CryptoBilis hack . Many other people use it too, so we do not count its payouts as the hacker's.

Another part of the TRX went through THORChain, a service that swaps coins between blockchains. On 30 and 31 October, 43 of those addresses sent THORChain 64 million TRX, $20 million, after refunds. Each payment carries a note that tells THORChain what to send back and where. We read the notes on one of those wallets. Every note asks for ETH, paid to one Ethereum address. That address, and a second one that paid into it, have received 3,600 ETH from THORChain, $8 million. They passed almost all of it on to 35 new wallets. None of those wallets has sent a transaction, and we count their ETH as the hacker's. We have not yet found where the rest of the THORChain swaps paid out.

From midday on 31 October the hacker also used Relay, a bridge that pays out on another blockchain. After 12:27 UTC, the five THORChain vaults it had paid took no more TRX from anyone. One of the payout addresses put 57 million TRX into a TRON contract that passes coins through, and took most of it back out to nine new wallets. Those wallets swapped most of the TRX for USDT on SunSwap. By 16:01 UTC, seven of them had sent Relay $16 million in USDT and TRX. Relay refunded a few of those deposits. Relay's own records show its payouts landing on Ethereum, in eight new wallets. Those wallets swapped their USDT for ETH, mostly on CoW Swap, a trading app, and moved most of the ETH to 16 more new wallets. When we last read the chains, those 16 wallets held 7,352 ETH and had not sent a transaction, and one Relay wallet still held 718 ETH. The bridging went on after that, so these balances include some later payouts. We count all of that ETH as the hacker's.

The main receiving wallet has kept selling the smaller tokens it took. On 30 and 31 October it sold DAR, CTSI and PROM into Uniswap pools that held almost no ETH, and got $490 for all three. The 908,793 PROM in that sale were worth $4.6 million at that day's trading price. In the same block as each sale, trading bots bought the tokens out of the pools and sold them on. Larger sales went through new wallets. One sold 1.69 billion SOPH for 932 ETH, and others sold ZAMA, RE, BLUR and ROBO. On the morning of 31 October, those wallets sent 4,003 ETH into one of the stash wallets. That ETH includes 1,187 ETH from the VIRTUAL tokens the hacker took on Base. A new wallet swapped the VIRTUAL for ETH on Base and sent the ETH to Ethereum through Stargate, another bridge.

We found no transfer to an exchange's deposit address or to a mixer. Some TRX reached the cash desk. THORChain, Relay and Stargate all move value from one blockchain to another. On each of those routes, the ETH we found sits in new wallets that we count as the hacker's. Anyone can watch these wallets with the Bitquery MCP . The addresses are listed at the end.

08 · The scale The biggest crypto hack on record

CoinDesk called it the largest crypto theft on record, and the numbers back that up. The record, the Bybit hack of February 2025, took $1.5 billion. This one took four times as much. Even now, what the hacker still holds is more than twice what Bybit lost.

It is not the only exchange hack this autumn. Last month, $387 million left Bitget on nine blockchains, and our Bitget hack trace followed it out. Last week, CoinDCX lost $16 million from wallets it was still using, as our CoinDCX hack report showed. Two smaller drains this week, at Polymarket and Predict.fun , also used valid signatures to move the money.

09 · What to do If you use Binance

Binance says user funds are safe. It says it will cover all losses from its SAFU fund, an emergency pot it keeps for hacks, and from its own money. Deposits and withdrawals stay paused until its security checks are done, and it says it will publish an updated proof of reserves.

Rely only on Binance's official channels for updates. Scams follow big hacks.

Do not sign anything or send coins to anyone who contacts you the hack.

When withdrawals reopen, check the address you withdraw to before you confirm.

10 · The method How we traced the Binance hack

We started from every wallet that carries the Binance proof-of-reserves label in our address data. We looked for large transfers to new addresses that night, then followed each one hop by hop. We timed each freeze against the moment the money moved on, and read the final balances straight from each chain at 16:51 UTC. Dollar values use the price at the time of each transfer.

The full histories are also sold as files on the Bitquery Data Store, as the Ethereum , Bitcoin , TRON , Solana and XRP Ledger datasets.

Transfers were read in full up to 02:10 UTC on 30 October on Ethereum and 02:40 on the other chains. Later moves were followed up to 16:01 UTC on 31 October, and holdings were read from each chain at 16:51 UTC. Anything later is not covered.

TRX paid out by the attacker's TRON payout wallet was followed to the 171 addresses it paid, then through THORChain and, for one address, through a TRON contract and Relay to Ethereum. Much of that TRX was not followed further, and TRX still in those addresses is not counted in the holdings. THORChain swap notes were read on one of those wallets. Notes on the others may name other Ethereum addresses, so the THORChain ETH we count is a floor.

One of those addresses passed 57 million TRX through a TRON contract to nine new wallets. We read Relay's public records for the deposits of seven of them. For one wallet we could read only its latest requests. Relay deposits from other addresses, if any, are not counted.

Dollar values use the price at the time of each transfer: ETH and major tokens every five minutes, other tokens once a day, BTC and XRP hourly. Three small Ethereum tokens had no price and count as zero.

The XRP Ledger and Solana drains no address with the rest of the attack. They are tied to it by timing, by how the transfers were built and, for the XRP Ledger, by Binance's own total.

Freezes count only where we found the freeze on-chain: Tether, Circle, World Liberty, Paxos, Ripple, First Digital and the Arbitrum rescue.

The record shows that each drain was validly signed. It does not show who asked Binance's system to sign, or how.

Wallet owners come from address labels and on-chain behaviour, and may be incomplete.

11 · The record The addresses behind the Binance hack

Follow the Binance hack money in plain English

Every transfer in this story comes from Bitquery's blockchain data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which labels an address carries, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Ethereum dataset and the Bitcoin dataset .

This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any exchange, wallet, bridge, protocol or service.

The findings describe transactions and balances observed on Ethereum, Bitcoin, TRON, the XRP Ledger, Solana, Arbitrum, Polygon, Optimism and Base from 29 to 31 October 2026. Attributions come from address labels and from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.

References to Binance, Tether, Circle, World Liberty Financial, Paxos, Ripple, First Digital, Arbitrum, Uniswap, 1inch, Aave, SunSwap, THORChain, Relay, CoW Swap, Stargate, Ledger, CryptoBilis, Tornado Cash, Bybit, Bitget, CoinDCX, Polymarket, Predict.fun, CoinDesk, Blockaid, ZachXBT or any other named project, company, service or person describe what the public record shows addresses and transactions linked to them, and what those parties have said in public. They are not statements any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently. The wallets that received the funds are described by their behaviour and attributed to nobody.

Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.

Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.

How much was stolen in the Binance hack?

$6.3 billion, at the prices of the moment it left. The coins came from 17 Binance hot wallets on nine blockchains on the evening of 29 October, in under four hours. Binance's own estimate is the same.

How did the Binance hack happen?

Binance says a hacker got into its systems through a compromised engineer's laptop and used its withdrawal service to send money out. No private key leaked, Binance says. On Ethereum, the hacker also used EIP-7702 authorizations, signed by Binance's system, to make Binance's busiest hot wallet run the hacker's code.

Is Binance safe after the hack?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and its own money. Deposits and withdrawals were paused while it checks its systems. It has promised an updated proof of reserves and a full report on what went wrong.

How much of the stolen crypto was frozen?

$2.7 billion. Tether locked 1.76 billion USDT and Circle locked 823 million USDC. Tether's gold token and four smaller issuers froze $132 million in other tokens, and Arbitrum's Security Council moved the hacker's ARB and ETH on its network into a locked wallet.

Where is the stolen money now?

At 16:51 UTC on 31 October, the hacker held $3.1 billion, mostly ETH and BTC. The biggest wallets have never sent a transaction. Part of the TRX went through THORChain until midday on 31 October, and then through the Relay bridge. It came out as ETH in new wallets. We found none of the money sent to an exchange's deposit address or a mixer.

Is the Binance hack the biggest crypto hack ever?

Run the investigation in minutes

Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets , or query the chain directly with the Bitquery API .