Back crystalintelligence.com

Binance Hack What We Know What Teams Should Do Now

crystalintelligence.com • November 12, 2026

Updated November 2, 2026: This article now includes Crystal’s analysis of how the attacker converted $995M of stolen funds from the Binance hack into ETH and TRX in under 11 hours, where those funds sit now, the FBI’s attribution of the attack to North Korea, and updated guidance for compliance teams. Figures reflect a final data check that reclassified two transfers as issuer recoveries.

On October 29, 2026, starting at 20:20 UTC, wallets that Crystal attributes to Binance sent billions of dollars in crypto assets out on Bitcoin, Ethereum, and other chains in the Binance hack. Binance said on X that its teams are “aware of reports of a potential security issue and are actively investigating”, and in an updated post that “User funds are completely safe.”

In a later post at 22:15 UTC, Binance said its team was “conducting security checks” and that “Withdrawals will resume as soon as the security issue is fully resolved.” At 02:25 UTC on October 30, Binance published its preliminary findings : a possibly compromised laptop of a DevOps engineer gave access to a service container, from which the unauthorized withdrawals were made; Binance found no evidence that a private key leaked, puts the impact at $6.3B, says $3B has been frozen, and will cover all losses.

Crystal has labeled the receiving cluster as a potential Binance thief, in the stolen-coins category, and our analysts are following the onward flow as reports come in from industry partners. This article sets out what Crystal data shows so far, where the stolen funds went before the freezes took effect, and what compliance teams at exchanges, payment firms, and banks should do now, including how Crystal customers can raise their alerting in Crystal Expert .

We will keep updating this article as verified information comes in.

Before most freezes took effect, the attacker swapped $995M of stolen funds into ETH and TRX in under 11 hours. Stablecoins made up 73% of what was swapped.

The FBI has attributed the attack to North Korea’s TraderTraitor activity and published the related wallet addresses. It says the stolen assets were converted mainly into ETH, which matches Crystal’s tracing.

Crystal’s rebuilt graph traces $6.2B leaving wallets attributed to Binance in 140 transactions: $3.68B on EVM chains, $1.48B on Bitcoin, $628M on Tron, $299M on XRP Ledger, and $97M on Solana.

On Ethereum, the attacker installed an EIP-7702 delegation on a Binance hot wallet with one of fifty pre-signed authorizations, a pattern that points to compromised signing access rather than a stolen key. Binance’s preliminary findings, with no evidence of a private key leak, point the same way.

Tether and Circle have frozen large stablecoin balances and Binance puts the frozen total at $3B, but part of the funds has already moved on to wallets that partners have reported, and 60M USDT went into Aave to borrow ETH that no issuer can freeze.

36% of swap volume went to market makers, aggregators, and contracts with no public owner.

More than 505,000 ETH sits untouched in six holding wallets. The rest of the holdings have started to move: 638.2M TRX on October 30, all 233.5M XRP on November 2, and 557,000 SOL.

Industry partners are reporting downstream wallets as they find them, so alerts may show “victim report” labels. Review the fund flow behind every such alert before deciding.

Attribution keeps changing as more wallets are reported. Recheck recent deposits, not just new ones.

Crystal customers can add a custom group for services used in large attacks and alert on it in Crystal Expert.

What happened in the Binance hack?

What is confirmed comes from the companies involved and from Crystal data:

Time (UTC, Oct 29 unless stated)

18,270.2 BTC ( $1.48B) leaves a Binance wallet in 11 transactions to one address that partners have since reported

The main Ethereum transfer: one transaction moves more than 60 assets worth $2.40B, including 1.615B USDT and 167,464 ETH; nine more follow within 24 seconds

500M USDT moves to a new attacker wallet. 325M is sold for 122,316 ETH through intent and RFQ settlement before 175M is frozen

Four transfers on Arbitrum, $32.2M

10M USDT sold on Uniswap from a second attacker wallet

Of the 612.7M USDT taken on Tron, 300M moves to a second wallet, which sells 234M on SunSwap for 638.2M TRX. Tether then freezes the remaining 378.7M USDT across both wallets

100M USDT sold through Uniswap V3 and V4 pools before the remaining 30M is frozen

Binance 14 is swept twice more ($8.2M at 21:04 and $201.4M at 21:44), including 200.4M USDT that arrived from Binance’s own top-up wallet 72 seconds before the second sweep

Binance: investigating “a potential security issue”

Circle: “frozen more than 800M USDC associated with the incident”

88.5M RLUSD moves through two relay wallets; 48M is sold for ETH between 21:42 and 22:00. Ripple pauses the account at 22:00, freezing the remaining 40.5M RLUSD

Tether: froze “more than 1.567B USDT related to a potential Binance exchange hack”

Binance (edited post): “User funds are completely safe”

Binance: “Our team is conducting security checks. Withdrawals will resume as soon as the security issue is fully resolved. User funds remain safe.”

Synthetix pulls 8.4M SNX ( $1.5M) back from the attacker’s wallet

The Sandbox pulls 58.4M SAND ( $2.7M) back from the attacker’s wallet

Circle freezes 1.56M USDC that the attacker had swapped from AVAX and bridged to Ethereum

Binance suspends deposits

Binance publishes its preliminary findings: a possibly compromised DevOps engineer’s laptop, a service container, unauthorized withdrawals; no evidence of a private key leak; impact $6.3B, $3B frozen; all losses to be covered

Oct 30, 10:15 to 10:20

The 638.2M TRX from the SunSwap sales moves to five new wallets

The FBI attributes the attack to North Korea (TraderTraitor), says the stolen assets were converted mainly into ETH, and publishes hundreds of Ethereum addresses, 19 Bitcoin addresses, and one Solana address for firms to block

Binance begins resuming withdrawals in phases

Nov 2, 03:50 to 04:00

All 233.5M XRP moves to six accounts, small test payments first, then 10M to 40M chunks

On Ethereum, the funds left through an EIP-7702 delegation installed on a Binance hot wallet, as the section shows. Binance puts the impact at $6.3B and the frozen total at $3B, and says it will cover all losses. Crystal’s first graph snapshot, at 22:30 UTC on October 29, traced $5.14B. The rebuilt graph now traces $6.2B in 140 transactions, close to Binance’s figure. Until Binance publishes a final figure, treat every total, including ours, as provisional.

How did the attacker take control of the Binance hot wallet?

No smart contract was exploited and no one was tricked into an approval. Crystal’s analysis of the on-chain records shows that the attacker used EIP-7702, an Ethereum feature live since the Pectra upgrade. It lets an ordinary wallet delegate its execution to a smart contract’s code while it keeps its address and balances.

Address 0x7C86…5CA0 receives three 0.1 ETH withdrawals from Tornado Cash, enough to pay for gas

The attacker deploys a first contract (0x19beE294…)

A dry run: a throwaway wallet (0x8378…FBc3) is funded and delegated to that contract with two authorizations, one valid (nonce 0) and one not (nonce 1)

The attacker deploys the real sweeper contract (0x63e842…)

A type-0x04 transaction (0xad99264d…) sent by 0x7C86 installs a delegation on the Binance 14 hot wallet (0x28C6…1d60), pointing it at the sweeper. From then on, Binance 14 runs the attacker’s code

Binance 14 itself sends 167,464 ETH, 1.615B USDT, and more than 60 other tokens to a fresh address that Etherscan labels “Binance Hot Wallet Exploiter 2” (0x5227…2f8c)

A delegation is installed only if the wallet’s own private key signs the authorization. The sender, 0x7C86, only paid the gas and broadcast the transaction. So the attacker either held the key to Binance 14 or had access to the signing infrastructure, such as an HSM or an MPC signer, that produced the signature.

Fifty signatures point to signing access, not a stolen key. The delegation transaction did not carry one authorization. It carried fifty, signed over consecutive nonces, and only one of them was valid. A type-0x04 transaction skips any authorization whose nonce does not match the wallet’s current nonce, so the other 49 cost nothing but gas. The attacker apparently could not know the hot wallet’s live nonce and covered a range instead. Binance 14 has more than 31 million transactions, so its nonce moves by the minute, and fifty slots buy a window of a few minutes at most.

Anyone holding the key would have signed one authorization with the correct nonce seconds before sending it, or skipped EIP-7702 and sent ordinary transfers. Pre-signing fifty variants fits someone who could use the signer once, under conditions they did not control. The four hours between deploying the sweeper (15:59 UTC) and installing the delegation (20:20 UTC) fit the same picture: the signatures were already in hand.

The explanation most consistent with the on-chain data is therefore a compromised signing path rather than a leaked key: an HSM proxy, an MPC node, or a signing service that signed fifty arbitrary hashes, either because it signs blind or because its checks did not recognize an EIP-7702 authorization as something that can move funds. Binance’s preliminary findings, published at 02:25 UTC on October 30, fit this reading: a possibly compromised DevOps engineer’s laptop gave access to a service container from which the unauthorized withdrawals were made, and Binance found no evidence of a private key leak. A service container that can ask the wallet’s signer for signatures is the kind of signing path the fifty authorizations describe: usable once, without the key.

EIP-7702 exists only on Ethereum and other EVM networks, so it explains the Ethereum legs. How the Bitcoin outflows, which began in the same minute, and the Tron, Solana, and XRP outflows were authorized is not yet known. For custodians and exchanges, the lesson is signing policy: a signer that does not decode what it signs can hand over a wallet without moving a single coin itself.

What does Crystal data show the funds that left Binance?

Crystal labels the receiving cluster on Ethereum as a potential Binance thief, in the stolen-coins category, with a risk score of 100. Crystal data shows:

$6.2B left wallets attributed to Binance in 140 transactions on EVM chains, Bitcoin, Tron, Solana, and XRP Ledger (the split by network is in the key points above). The first snapshot, at 22:30 UTC on October 29, traced $5.14B in 97 transactions; the rebuilt graph adds transfers traced since, including the two later sweeps of Binance 14 in the timeline above.

Bitcoin came first. 18,270.2 BTC left a Binance wallet at 20:20 UTC in 11 transactions, four minutes before the Ethereum transfers. Two onward transfers of 1,000 BTC each followed by 22:30 UTC. By October 30, all 18,270.2 BTC had been split across 11 wallets.

One Ethereum transaction carried $2.40B. At 20:24:23 UTC a single transaction moved more than 60 different assets to the labeled cluster, including 1.615B USDT ($1.61B), 167,464 ETH ($391M), RLUSD, and tokenized gold (XAUT). Nine more transfers followed within 24 seconds, among them 28,005.6 ETH ($65.4M), and four more on Arbitrum ($32.2M) by 20:34 UTC.

Tron, Solana, and XRP legs. On Tron, 612.7M USDT and 46.4M TRX went to an address the graph marks as banned, and 300M USDT has moved on from there. On Solana and XRP, 970,522 SOL and 233.5M XRP went to an address partners have reported.

The stablecoin freezes are visible on-chain. Crystal tags the cluster’s Ethereum address as banned by the token contract, which is consistent with Tether’s freeze.

Part of the funds has moved on, some of it into assets no issuer can freeze. The graph shows onward transfers from the cluster to wallets that partners have reported, among them 190M USDT, and further hops between reported wallets, among them 130M USDT. At 21:35 UTC, 57,891.8 ETH ($130.8M) moved from one reported wallet to another. Between 20:58 and 21:01 UTC, 60M USDT from the cluster was deposited into Aave as collateral and 19,762 WETH was borrowed against it: USDT can be frozen by its issuer; the borrowed ETH cannot.

Above: Outflows from Binance to the thief clusters in the Crystal graph, all chains combined and by network. Screenshots from Crystal Expert, November 2, 2026.

One point matters for anyone screening against this data. Binance itself remains a licensed exchange with a low risk score in Crystal, and the graph links only the transfers above to this event, not ordinary withdrawals from Binance.

How was $995M converted before the freezes?

Stablecoin freezes stopped most of the Binance theft, but $995M was swapped first. Crystal’s analysis shows the attacker converted it into ETH and TRX in under 11 hours, between 20:34 UTC on October 29 and 07:13 UTC on October 30.

Observed transfers into swap venues total $997.6M across three chains: Ethereum ($761.9M), Tron ($234.0M), and Avalanche ($1.7M). Uniswap and SunSwap handled 63% of it. The rest went to counterparties nobody can publicly name.

Above: Swap volume by receiving counterparty, October 29 to 30, 2026. Excludes issuer recoveries. Source: Crystal Intelligence analysis of public blockchain data.

Why did the first 90 minutes matter most?

Stablecoins made up $729M, or 73%, of everything swapped. Most of it moved within 90 minutes of the theft. By the time Tether’s blacklists took effect, 435M USDT on Ethereum and 234M on Tron had already been sold.

The pattern is consistent with an attacker who sold anything an issuer could freeze (USDT, RLUSD, and other ERC-20 tokens) for assets with no issuer freeze function (ETH and TRX). We read this as the most likely motive. The on-chain data shows the sequence; the motive is our reading.

Freezes were not limited to stablecoins. Synthetix and The Sandbox pulled $4.2M of SNX and SAND back from the attacker’s wallet before it could sell them. The Avalanche leg shows the reverse: converting AVAX into USDC put it straight back in reach of an issuer, and Circle froze it.

What this means for you: a freeze only works on funds that are still in the freezable asset. The first hour after a major theft is when screening matters most.

Who received the stolen USDT?

Four market maker and RFQ (request for quote) counterparties absorbed $274.8M of stolen USDT in just eight transfers. None of them carries a public label. Add unlabeled aggregators and contracts, and 36% of all swap volume went to counterparties with no known owner.

For most of this, the attacker did not send USDT into a public pool. It signed orders through intent-based settlement layers, mainly UniswapX and 1inch Fusion. A professional filler took the USDT and the settlement contract paid the attacker ETH: 105,593 ETH through UniswapX and 16,723 ETH through 1inch Fusion.

We identified these counterparties by behavior only, including delegated smart wallets and payments to block builders. We do not assert who operates them, and nothing here suggests they knew the funds were stolen. Fillers often quote and settle automatically.

What this means for you: if you run a trading desk, provide liquidity, or onboard market makers as clients, your exposure may sit one step away from the pools everyone is watching. Banks and stablecoin issuers that serve these firms should expect information requests.

What happened to the altcoins?

The attacker sold every unit of the major altcoins it kept control of. For UNI, ENA, LINK, PEPE, AAVE, USDe, and WBTC, the amount sent to swap venues matches the amount taken from Binance exactly.

Each token went to its own seller wallet, which the main wallet funded with gas. That wallet then sold into individual Uniswap, SushiSwap, PancakeSwap, and ShibaSwap pools. The largest positions were UNI ($48.7M), PEPE ($41.2M), ENA ($41.2M), and LINK ($28.5M).

Together with the Aave borrow described above, this left the attacker holding mostly ETH and BTC, followed by XRP and TRX. None of these has an issuer freeze function.

Where are the stolen funds now?

The swap phase is largely over and the laundering phase is under way. The ETH has not moved, but the TRX, the XRP, and part of the SOL have.

Status as of November 2, 2026

505,617.7 ETH across six holding wallets

12,270.2 BTC in 11 wallets

Split from the original holder; 6,000 more BTC has moved beyond these wallets

Moved on November 2, 03:50 to 04:00 UTC, to six accounts: small test payments first, then 10M to 40M chunks

Moved on October 30, 10:15 to 10:20 UTC, to five new wallets

Peeled off in 0.2M to 2.7M chunks through fresh wallets; the source wallet is now empty

413,000 SOL with the original holder

557,000 SOL has moved; timing not yet established

Held in two attacker wallets

ETH borrowed from Aave

60M USDT collateral still in place; debt now 19,767 WETH with interest

Stablecoins and other assets

of each stolen-asset holding that has moved, as of November 2, 2026. Source: Crystal Intelligence analysis of public blockchain data.

For how the $3.45B of stolen stablecoins moved before the freezes landed, see our follow-up on how the market absorbed the stolen stablecoins.

The attacker made no swaps on Bitcoin, Solana, XRP Ledger, Optimism, Polygon, or Base as of October 30. Crystal data shows the Arbitrum Security Council moved 8,426 ETH and 74.6M ARB into a restricted wallet on October 30, before any conversion.

The balances still in place, and those already moving, will most likely pass through bridges, mixers, peel chains, OTC desks, and exchange deposits. That is where screening comes in.

Is North Korea behind the Binance hack?

Yes, according to the FBI. On October 31, 2026, the FBI attributed the attack to North Korea, naming the activity “TraderTraitor,” and published the wallet addresses linked to the theft. The alert lists hundreds of Ethereum addresses, 19 Bitcoin addresses, and one Solana address, and asks firms to block them. The FBI said the attackers converted the stolen assets mainly into ETH and expects them to be laundered further through DeFi and instant swap services.

Crystal’s own tracing points the same way. Our analysis of public blockchain data shows the attacker swapped $995M of stolen funds into ETH and TRX in under 11 hours. 505,617.7 ETH still had not moved as of November 2. The pattern, with gas funded through Tornado Cash, rapid conversion of freezable assets, and large balances held ahead of onward moves, matches the FBI’s description and the 2025 Bybit theft, which the FBI also attributed to North Korea .

What this means for you: load all the addresses published in the FBI alert into your screening now, including the Bitcoin and Solana addresses, and recheck deposits you have already accepted against them. The FBI is urging exchanges and other service providers to block transactions linked to the stolen funds. Expect the laundering to run through the DeFi and instant swap services the FBI names, and through the bridges and services in the custom group above. North Korean state-linked funds can also raise sanctions questions, so involve your sanctions team in any exposure you find.

Why are alerts showing “victim report” labels?

As industry partners find wallets connected to the incident, they report them to Crystal. These reports can appear in alerts as “victim report” entities in the stolen-coins category.

The label tells you that a partner has reported the wallet. It does not tell you the role your customer played. A deposit that touches a reported wallet may come from the laundering path, from a service the funds passed through, or from a user who received a small amount further downstream. Review the fund flow for every such alert before you freeze, reject, or file: open the transfer in the graph, follow it back to the labeled cluster, and record the path you relied on.

What should compliance teams do now?

Large thefts follow a familiar pattern: the proceeds are swapped into assets that are harder to freeze, moved across chains, and broken into smaller amounts before they reach a service that pays out. In this incident, the swaps and the Aave borrow above are the first stage. Every step creates exposure for whoever sits in line. We recommend that compliance teams:

Screen against the FBI’s published addresses. Load the wallet addresses in the FBI alert into your screening and recheck recent deposits against them.

Review large incoming transactions from bridges, instant swap services, and mixing services. These are the services the funds need .

Watch account behavior. Flag large volumes and sudden changes in a customer’s activity, especially new accounts and dormant accounts that wake up.

Look out for rapid deposits and withdrawals , where funds arrive and leave again within minutes.

Recheck funds continually. Attribution keeps changing as more wallets are reported. A deposit that screened clean this morning can carry exposure by tomorrow.

Review the fund flow behind every “victim report” alert , as set out above, and keep the evidence with your decision.

Which patterns should you screen for?

The stolen value now sits mostly in ETH and BTC, followed by XRP and TRX, so screening for stolen USDT alone will miss most of it.

ETH, BTC, TRX, XRP, or SOL deposits linked, in any number of hops, to incident wallets

Part of the holdings in the table above has already moved, and the rest will follow. When it does, it will reach someone’s platform

VASPs, banks with crypto exposure

TRX arriving in chunks of 0.2M to 2.7M from wallets created on October 29 or 30

46.4M TRX has already been peeled off this way

VASPs, OTC desks, law enforcement

BTC arriving from wallets that received roughly 1,000 BTC chunks from a single holder on October 29 or 30

All 18,270.2 BTC was split this way, and 6,000 BTC has moved further

VASPs, OTC desks, law enforcement

XRP arriving in 10M to 40M chunks from accounts that first received small test payments on November 2

All 233.5M XRP moved this way

VASPs, law enforcement

Fresh wallets funded only with gas by one other wallet, then selling a single token

The attacker used this setup for every altcoin sale

Large USDT fills through intent or RFQ settlement between 20:36 and 20:50 UTC on October 29

Fillers on these orders received stolen USDT, likely without knowing

Market makers, solvers, and the banks that serve them

Stablecoin collateral used to borrow ETH from incident-linked addresses

Lending gave the attacker ETH without a sale

DeFi-facing compliance teams

Look-alike addresses and fake tokens with spoofed names

We found 24 address-poisoning look-alikes and tokens posing as ETH, USDT, and LINK. They create false alerts and false totals

Everyone screening this incident

What should each team prioritize?

VASPs and exchanges: hold and review deposits that match the peel-chain or seller-wallet patterns above. Review who can sign EIP-7702 delegation authorizations for your own Ethereum hot wallets.

Banks and stablecoin issuers: check whether any client is a market maker, solver, or OTC desk that filled orders on October 29. Prepare for information requests from law enforcement and Binance.

Market makers and liquidity providers: review fills for the 20:36 to 20:50 UTC window against your counterparty records. Early disclosure helps attribution and protects your banking relationships.

Regulators and law enforcement: the gap between theft and freeze, and the of value that passed through unlabeled intermediaries, are both measurable. They are a useful basis for questions on freeze response times and counterparty transparency.

How can Crystal customers raise their alerting in Crystal Expert?

Screening that uses Crystal attribution reflects new labels as they are added, so check that your rules alert on the stolen-coins category. On top of that, we strongly advise customers to use custom groups to create higher-risk signals for services used to move the proceeds of large attacks . These include:

Swaps, bridges and stablecoins

Swaps, bridges and mixers

Swaps, bridges and privacy tools

Wasabi and other CoinJoin services

Their use is not evidence of wrongdoing, which is why the right response is a stronger signal and a human review, not a block. Large or unexpected volumes from these services in the coming days deserve a closer look.

A quick setup guide in Crystal Expert:

Create a custom group that contains the services listed above.

Include the group in your monitoring rule , with the alert grade set to high or severe. A custom group raises the alert grade; it does not change the risk score, which the risk score profile sets per entity type.

Turn on recheck notifications for changed or increased risk, so transfers already in your monitoring alert again when attribution updates.

Investigate each alert in the graph before you decide, and keep the path with your case notes.

Detailed configuration advice is in the product documentation on custom entity groups, and your Crystal account manager can help you set it up.

This is what decision intelligence for digital assets means on a day like this one. Decision intelligence for digital assets is the discipline of putting verified evidence in front of every decision an organization makes digital assets. Here, that evidence is the label on the cluster, the reported wallets, and the path that connects them to a deposit in front of you. Crystal surfaces; humans decide.

How we measured the swap flows

All swap figures come from public blockchain data on Ethereum, Tron, Avalanche, Arbitrum, Bitcoin, Solana, and XRP Ledger, covering activity to 09:20 UTC on October 30, 2026.

What counts: a transfer counts once, when it leaves an attacker-controlled wallet and reaches a swap venue, market maker, lending protocol, or unidentified contract. Moves between attacker wallets and routing steps inside a single swap are not counted. Lending deposits are reported separately and are not included in the $997.6M.

No double counting: $2.65M of swap output came back to the attacker as tokens and was sold again. We removed it from the $997.6M of observed volume to arrive at the unique figure used throughout this article. Two transfers where Synthetix and The Sandbox pulled back $4.2M of SNX and SAND are recoveries and are excluded.

Attribution: we name a venue only when it has a public label, verified contract code, or a factory contract that confirms the pool. Everything else is reported by behavior, with no owner named.

Pricing: stablecoins on Tron and Avalanche are valued at par; all other amounts, including stablecoins on Ethereum, use DefiLlama prices at 11:30 UTC on October 30, not execution prices.

Naming a protocol in this analysis does not suggest wrongdoing. Permissionless pools and settlement contracts execute any valid order.

Is North Korea behind the Binance hack?

Yes, according to the FBI, which attributed the attack to North Korea’s TraderTraitor activity on October 31, 2026, and published the related wallet addresses. Binance has not named the attacker.

Has Binance confirmed the hack?

Yes. At 02:25 UTC on October 30, 2026, Binance published its preliminary findings on X: a possibly compromised laptop of a DevOps engineer gave access to a service container, from which the unauthorized withdrawals were made; no evidence of a private key leak; an impact of $6.3B, of which $3B has been frozen; and a commitment to cover all losses. Its earlier posts, from 21:16 to 22:15 UTC on October 29, said the team was investigating, user funds were safe, and withdrawals would resume after security checks. Binance began resuming withdrawals in phases on November 1. We will update this article as Binance publishes more.

How much left Binance?

Binance’s preliminary figure for the impact is $6.3B, with $3B frozen. Crystal’s rebuilt graph traces $6.2B in 140 transactions: $3.68B on EVM chains, $1.48B on Bitcoin, $628M on Tron, $299M on XRP Ledger, and $97M on Solana. Tether and Circle have frozen part of the stablecoins involved.

How much of the stolen funds did the attacker swap?

$995M, in under 11 hours. Crystal traced $997.6M of transfers into swap venues on Ethereum, Tron, and Avalanche. After removing $2.65M that was swapped twice, $995M of unique stolen value was converted, mostly into ETH and TRX.

Who received the stolen USDT?

Mostly professional market makers and public pools. Of the $669.2M of USDT the attacker swapped, four market maker and RFQ counterparties with no public label received $274.8M (41%), SunSwap $234.0M (35%), Uniswap $110.3M (16%), and an aggregator route through LI.FI $50.0M (7%). We identified the market makers by behavior only, and nothing suggests they knew the funds were stolen.

Has the attacker moved the stolen funds yet?

Some of it. As of November 2, 505,617.7 ETH sat untouched in six holding wallets. The 638.2M TRX moved to five new wallets on October 30, all 233.5M XRP moved on November 2, and 557,000 SOL has left the main Solana holder. Of the 18,270.2 BTC, 6,000 BTC has moved beyond the 11 wallets it was first split into.

Are funds from Binance now high risk?

No. Binance remains a licensed exchange with a low risk score, and Crystal data does not link ordinary Binance withdrawals to this event. The risk sits with the labeled cluster and the wallets downstream of it.

What does a “victim report” alert mean?

It means an industry partner has reported a wallet in connection with the incident. Review the fund flow before acting, because the alert alone does not show your customer’s role.

Should we block THORChain, Chainflip, or mixers?

We do not recommend a blanket block. Raise the alert grade for them, alert on large or unusual volumes, and review those transfers by hand for the few days.

The freeze window has closed. $3B was frozen or seized, and the funds swapped before issuers could act are set out above. What happens depends on the ETH that has not moved yet, and where the TRX, XRP, and SOL already on the move end up.

When those balances move, they will most likely pass through bridges, mixers, peel chains, OTC desks, and exchange deposits. Every exchange and payment firm that screens deposits against current attribution, and rechecks what it has already accepted, narrows the routes to cash. Crystal will keep labeling wallets as they are reported and will update this article as the funds move or Binance publishes its post-mortem.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean TraderTraitor Group Hacks Binance for $6.3 Billion On October 29, 2026, Binance, the largest cryptocurrency exchange, suffered a massive hack resulting in the theft of approximately $6.3 billion in crypto assets. The FBI attributed the attack to the North Korean hacking group TraderTraitor, which reportedly gained access to Binance's internal systems eight weeks prior to the theft. The attackers used social engineering tactics, including fake job offers, to compromise employee devices and harvest credentials. The breach allowed them to manipulate wallet-signing services and execute unauthorized transactions across multiple blockchains. As of November 5, about $2.8 billion of the stolen funds had been frozen, but significant amounts remain in circulation. The incident has raised alarms about the security of cryptocurrency exchanges and the potential for further state-sponsored cyber operations. 75 sources 78

Extracted Entities

Binance Hack What We Know What Teams Should Do Now

The full story

Extracted Entities

Companies (4)

Countries (1)

Domains (1)

Malware (1)

Platforms (4)