Binance disclosed a security incident on Oct. 29, 2026. Reports put the loss at about $6.3B, taken from wallets on 10 blockchains, mostly within about 20 minutes. Binance's preliminary findings reportedly point to a compromised DevOps engineer's laptop used to authorize withdrawals, with no evidence of a private-key leak. TRM Labs attributes the theft to North Korea's TraderTraitor with high confidence. Binance suspended withdrawals and deposits, says user funds are safe, and has pledged to cover all losses.
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
Binance said it was working with the FBI to recover the frozen assets, per a Binance Square post with no date given in the research. Reporting gathered by the research also said the U.S. Secret Service was helping track the stolen funds, per BBC live coverage (undated in the research). The research found no verified arrest, indictment, lawsuit, or confirmed compensation payout as of its cutoff of Oct. 31, 2026, 08:15 UTC.
As of Oct. 30, 2026, Binance said it had reserved over $6.34B of company funds to cover the incident, with about $5B of that reportedly held in the same token assets that were impacted (per TechTarget and LCX). Reporting from Oct. 30 said withdrawals were temporarily suspended, deposits were unaffected, and withdrawals were expected to resume within a day or two (LA Times, charter97). A Binance Square post from Oct. 30 said the attacker still held more than 420,000 ETH and 18,270 BTC, which it valued at about $2.4B; that valuation looks inconsistent with those holdings and is unverified. Binance also said it had begun recovering assets for users after freezing about $3B.
Research reports a later breakdown of the attacker's Bitcoin movements, in which about 18,270 BTC was split across 19 wallets: 17 holding 1,000 BTC each, plus one with 832.5 BTC and one with 437.7 BTC. Binance's statement, as cited in the research, described unauthorized withdrawals from a service container in addition to the compromised engineer laptop. The research confirms no verified developments after Oct. 31, 2026, 05:29 UTC, so the recovery total, arrests, and compensation outcome remain unconfirmed.
As of Oct. 30, 2026 (00:30 UTC), TRM reportedly said about $2.7B had been frozen, and other reporting said Circle and Tether froze about $2.4B within an hour of the theft. TRM-linked coverage reported that the attacker's main Ethereum address received 197,169.8 ETH, 1.875B USDT and 823M USDC from Binance, with about $480M in Ether in two attacker-controlled wallets. Reporting said the funds moved across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon, and that Chainalysis reportedly also judged TraderTraitor the likely perpetrator. Binance said it would cover losses using its SAFU fund and company funds. No new attacker wallet addresses were ident
As of Oct. 31, 2026 (03:49 UTC), Aju Press reported Binance said about $3 billion in stolen assets had been frozen and that losses would be covered from its emergency protection fund and corporate reserves. By 04:44 UTC, Reuters and CNBC reported the same roughly $3 billion frozen figure alongside TRM Labs' high-confidence TraderTraitor attribution. SBS reported specific early transfers of 233.46 million XRP between 4:05 and 4:09 p.m. ET on Oct. 29, followed by wallet hijacks on Solana
As of Oct. 30, 2026, Crypto Times reported in a headline that Binance was buying back stolen coins while the FBI and U.S. Secret Service joined the probe; the article body was not available to confirm terms or amounts. The research found no confirmed developments after its cutoff of Oct. 31, 2026, 01:26 UTC, so the incident remains active with no confirmed recovery total, arrests, lawsuits, or compensation outcome.
As of Oct. 30, 2026, reports said the FBI and U.S. Secret Service had joined the probe (Crypto Times). Binance said it had reserved more than $6.34B of company funds to cover the stolen assets and that customer account balances were not touched, with withdrawals still suspended (Binance posts; research summary). Binance also said it had begun recovering affected assets with law enforcement, issuers, and blockchain intelligence firms, though no confirmed arrests, lawsuits, or compensation payouts were reported.
As of Oct. 30, 2026, Chainalysis reportedly published analysis pointing to TraderTraitor and estimated the unauthorized transfers at about $6.4B, and said an operational wallet funded through Tornado Cash on Ethereum was used before assets were swept to attacker-controlled addresses. TRM Labs reportedly said the attackers still held over 420,000 ETH and 18,270 BTC, roughly $2.4B that issuers could not freeze. Research found no source confirming full recovery, and it did not verify arrests, lawsuits, or a compensation program.
Per Economic Times and Straits Times coverage dated Oct. 30, 2026, the frozen-funds figure may be closer to $2.7B, though the $3B figure from Binance and other outlets is also still cited, so the amount frozen is unsettled. Chainalysis is reported to agree with TRM Labs that TraderTraitor is the likely perpetrator, and Binance says it is working with blockchain partners and law enforcement. Coverage dated Oct. 30 says the amount actually returned to Binance or customers had not been established. The research did not verify arrests, lawsuits, or a compensation program, and it did not identify specific attacker wallet addresses.
As of 2026-10-30 09:20 UTC, Binance said its verified frozen amount was about $3B and could rise, and Tether and Circle froze large stablecoin balances (one report cites about $1.79B). Follow-on on-chain moves reportedly included about 217.5M ENA and 29,934 WBETH sent to a fresh address, plus about 122,310 ETH moved to a new address, after the initial sweep. A report also described a sweep from a wallet labeled 'Binance 14' of about 167,000 ETH and 1.6B USDT into a new address, and Binance said it had revoked the affected authorizations. No confirmed arrests, lawsuits, or customer compensation plan were reported, and one headline says withdrawals were restored while the body text still descr
Binance publicly acknowledged a 'security incident' on Oct. 29, 2026. According to TRM Labs, the attacker moved funds out of Binance wallets on 10 blockchains, with most of the activity in about 20 minutes. One report mentions a second wave about three hours later.
Most outlets put the loss at about $6.3B. TRM Labs reportedly estimated about $6.36B, and Chainalysis was cited at about $5.9B at the time of the theft. The totals differ and none is confirmed by Binance in the material available.
According to CoinDesk, the attacker drained 18,270 BTC (about $1.4B at early Friday prices) and split it into 19 wallets. Seventeen wallets reportedly hold exactly 1,000 BTC each, one holds 832.5 BTC and one holds 437.7 BTC. The coins had reportedly not moved again as of early Friday.
Binance reportedly said user funds are safe, temporarily suspended withdrawals and deposits, and worked with partners to freeze affected assets. Some coverage says withdrawals could resume within about 48 hours, after a security revamp and a technical post-mortem.
According to Binance's reported preliminary findings, attackers appear to have compromised a laptop belonging to a DevOps engineer. They then used that access to submit unauthorized withdrawal transactions. Binance reportedly said there was no evidence of a wallet private-key leak. This is an initial finding, not a final post-mortem.
After the theft, the BTC was fragmented into 19 wallets within minutes, likely to hinder freezing and tracing, according to the reporting. Investigators reportedly linked part of the flow to THORChain routing. Some reports say the stolen funds were commingled at the same address with funds from an earlier Bitget exploit. How the attackers first compromised the laptop has not been published.
Reported flows: funds left Binance wallets on 10 chains and the stolen BTC (18,270 BTC) sits in 19 wallets, idle as of early Friday per CoinDesk. Investigators reportedly linked part of the flow to THORChain, and some reports say it was commingled with earlier Bitget exploit funds. No named mixer or confirmed exchange destination appears in the available reporting. A reported ~$3B is frozen, but the sources do not cleanly separate Binance-specific freezes from ecosystem-wide defensive freezes (Aave on Avalanche, $30.5M locked on Arbitrum), so treat that figure cautiously. The amount actually recovered is unknown.
| Address | Chain | Role | Source |
|---|---|---|---|
0x7C8601d4645b93cea45F71e118A729332e6B5CA0 | Ethereum (presumed from the EIP-7702 context; chain not explicit in the source) | attacker (operator wallet, per Odaily) | source |
0x63e842B054Bd624a465454D533C33F573e9c6fAe | Ethereum (presumed from the EIP-7702 context; chain not explicit in the source) | attacker (sweeper contract, per Odaily) | source |
Every address is from a public source. Check any wallet in the dirty wallet checker.
Binance reportedly said user funds are safe, suspended withdrawals and deposits, and worked with partners to freeze affected assets. It pledged to cover all losses from its SAFU/emergency fund and company funds, and said it engaged law enforcement and blockchain intelligence partners. It also reportedly plans a security revamp and technical post-mortem, with withdrawals possibly resuming within about 48 hours. No regulator order or police action was identified in the available coverage.
The hack was described as a major shock to crypto markets and, in one outlet's phrasing, the 'largest bank heist in human history'. Bitcoin reportedly slid below $77,000 per The National, though no verified price move is available. Binance users face suspended withdrawals and deposits, though the exchange says funds are safe and losses will be covered. Contagion reportedly reached beyond Binance: the headline coverage says India's largest crypto exchange curbed futures trading, Aave froze Avalanche markets and Arbitrum locked $30.5M.
75% negative · 5% positive · the rest neutral · themes: scale of the theft, North Korea attribution, reassurance that user funds are safe, frozen funds and recovery hopes, insider/endpoint security risk
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice.
VaultX