Inside the $6.4 Billion Binance Breach: A Forensic Reconstruction, and a Tool to Check Your Deposits

On the evening of 29 October 2026, Binance lost roughly $6.4 billion in about twenty minutes. It is the largest theft of digital assets on record, more than four times the $1.5 billion taken from Bybit in February 2025.² Binance’s core keys and cold storage were never touched. The attackers got in through a single engineer’s laptop and then asked Binance’s own systems to pay them.

This piece reconstructs the incident from Binance’s public updates and Elliptic’s on-chain tracing, sets out what the numbers show and what they do not, and ends with a deposit checker: paste the address that sent you funds and it is compared against Elliptic’s list of 9,948 wallets linked to the theft, without the address ever leaving your browser. You can check up to 1,000 addresses at once.

taken from hot wallets

$6.43B

Elliptic estimate ²

blockchains drained at once

11

Binance, Elliptic ¹²

from first to last withdrawal

~20 min

20:05 to 20:25 UTC

of stablecoins frozen

$2.85B

Tether and Circle ²

wallets used to launder

~12,000

first four days ²

laundering transactions

40,000+

first four days ²

addresses on the blocklist

9,948

Elliptic, 3 Nov ³

of losses replenished by Binance

95%

update #4, 1 Nov ¹

The first 72 hours

Times are UTC and come from Binance’s announcements unless marked otherwise. The withdrawals were automated and ran in parallel, which is why eleven chains emptied inside a single twenty-minute window.

1. 29 Oct, 20:05

   Withdrawals begin

   Scripts start draining hot wallets on more than ten chains at once, including Bitcoin, Ethereum, Solana, Optimism and the XRP Ledger.

2. 29 Oct, 20:25

   The drain is complete

   About $6.4 billion has left Binance. On Ethereum, compromised wallets have been turned into contracts that sweep any new balance out within seconds.

3. 29 Oct, 20:58

   Converting what can be frozen

   Attackers deposit 60 million USDT on Aave and borrow 19,762 WETH against it, and swap stablecoins for ETH and TRX before the issuers can act.²

4. 29 Oct, 21:15

   Binance flags the activity

   Executives acknowledge abnormal outflows. Tether and Circle begin freezing the receiving addresses within minutes.

5. 29 Oct, 22:30

   Withdrawals suspended

   Binance confirms a security incident and halts all withdrawals. Deposits are paused, then safely reopened.

6. 30 Oct

   Entry point identified

   Updates #1 and #2 trace the breach to an infected DevOps engineer’s laptop and put the impact at about $6.3 billion. On the same day, 684.6 million TRX is fanned out across about 7,700 Tron addresses.

7. 31 Oct

   90% replenished

   Update #3: Binance has refilled 90% of the missing assets from company capital, with BTC, ETH, USDT, BNB and SOL fully backed.

8. 1 Nov

   95% replenished, withdrawals return

   Update #4: coverage reaches 95% and phased withdrawals resume from 06:00 to 09:00 UTC. The FBI attributes the attack to TraderTraitor, a North Korean state-sponsored group.

How the breach worked

Most large thefts of the past few years exploited a smart contract or tricked people into signing a malicious transaction. This one did neither. According to Binance’s technical updates and post-mortems by Chainalysis and TRM Labs, the attackers never broke Binance’s encryption, never obtained a master private key and never reached cold storage.¹ They went around all of it.

1. A laptop is compromised

   Malware lands on the workstation of an engineer who works on Binance’s internal deployment and DevOps systems. How it got there has not been disclosed.

2. The attackers move inside

   From that machine they reach the internal network that runs Binance’s automated wallet operations.

3. They impersonate a trusted service

   The attackers pose as a legitimate internal service that is allowed to request withdrawals. Because the requests look like routine, authorised administrative traffic, they pass the threshold and approval rules meant to catch large or unusual withdrawals.

4. Wallets become sweepers

   On Ethereum the attackers use EIP-7702, the account-delegation feature introduced in the 2025 Pectra upgrade, to turn compromised hot wallets into contracts that drain any existing or incoming balance within seconds.⁹

5. Billions leave in twenty minutes

   Withdrawals run in parallel across eleven chains until the outflow alarms trip and Binance freezes the platform.

The lesson is uncomfortable for every exchange. Key management, multi-signature schemes and cold storage all held, and it did not matter, because the weakest point was an ordinary laptop with access to an automated process that could move money. When the machine that requests withdrawals can be impersonated, the controls that check withdrawals are only as strong as the identity of whoever is asking.

Following the money

Elliptic’s tracing gives the clearest picture of where the $6.43 billion went.² Just over half was stablecoins, which their issuers can freeze; the rest was native tokens such as ETH, BTC, TRX and XRP, which nobody can freeze. That split decided almost everything that happened next.

Swipe sideways to see the whole figure.

Status of the stolen funds, 2 November

$6.43B total

• $2.85BFrozen by Tether and CircleStablecoins blacklisted on-chain
• $3.24BParked in attacker-linked walletsMostly ETH clusters and untouched BTC
• ~$0.34BIn motionSwapped, bridged or mixed; derived

The race against the freeze

The attackers knew that every stablecoin they held was a liability for as long as it stayed a stablecoin. In the minutes before the freezes landed they converted as much as they could into assets that cannot be frozen:

Stablecoins converted before the freeze

• Uniswap: USDT to ETH$434M
• SunSwap: USDT to TRX$234M
• Aave: USDT posted as collateral$60M

Of $3.46 billion in stolen stablecoins, $2.85 billion, about 82%, was frozen. That is the single most effective intervention in the whole incident, and it happened because two private companies could blacklist addresses on their own token contracts within minutes. Native assets had no such brake.

The laundering playbook

In its first four days the laundering operation spanned about 12,000 wallets on 11 blockchains and more than 40,000 transactions.² It ran at two very different speeds.

Tron: the fast lane

On 30 October a single distribution wallet sent 684.6 million TRX to about 7,700 addresses. From there the value was bridged to Ethereum as ETH through at least six cross-chain bridges, with JustLend lending vaults used along the way to break the direct link between deposit and withdrawal.² Intermediate wallets were first topped up with exactly 1 TRX to pay their fees, an automated pattern that analysts associate with North Korean operations.

Swipe sideways to see the whole figure.

Ethereum and Bitcoin: the holding layer

Ethereum carried the largest share, about $3.8 billion, and is where most of the converted value now sits in large, still clusters. More than 18,000 BTC, worth over $1 billion, was split into 19 holding addresses and has barely moved. By 2 November only about 28 BTC had entered WabiSabi coinjoins, the mixing protocol used by Wasabi-style wallets, which looks like a test batch rather than the start of a full cash-out.²¹²

The overall pattern is simple: convert anything that can be frozen immediately, then wait. Speed mattered only for the stablecoins. Native assets cannot be blacklisted, so time costs the attackers little and lets the attention of investigators and exchanges fade.

Who did it

On 1 November the FBI attributed the attack to TraderTraitor, a North Korean state-sponsored group also tracked under the wider Lazarus umbrella.⁴ Chainalysis, TRM Labs and Elliptic reached the same conclusion from the on-chain evidence: the 1 TRX funding pattern, the automated splitting, and stolen funds mixing with proceeds of the previous month’s Bitget breach.² It is the same group the FBI named for the Bybit theft in 2025.⁵

That matters beyond attribution. These thefts fund a sanctioned state, the people behind them are not deterred by arrest, and they are patient. They will hold billions for months or years if that is what it takes to cash out safely.

Binance’s response, and why SAFU mattered

Binance’s handling of the incident was fast and, by the standards of past exchange failures, unusually transparent. It froze the platform, isolated the compromised containers, revoked the affected API and deployment keys, published four numbered updates in three days, and committed to covering 100% of user losses from company capital and its Secure Asset Fund for Users (SAFU).¹

Lost assets replenished by Binance

• 31 Oct, update #390%
• 1 Nov, update #495%

Customers were protected because the money to protect them existed before the theft. SAFU was created in 2018 and is funded from a share of trading fees; it is the reason a loss of this size became a balance-sheet event for Binance rather than a catastrophe for its users. Most people who hold crypto, including most Ethiopian users, have no such guarantee when the platform they use fails.

What happens to the remaining $3.24 billion

This is analysis, not a forecast from live data. It is based on how TraderTraitor has behaved after earlier thefts. After Bybit, most of the stolen ETH was converted to Bitcoin within weeks, largely through cross-chain swap services.⁵ A parked balance more than twice that size will strain the over-the-counter brokers that turn crypto into cash, so a slower cash-out is likely.

The points where this can still be stopped are well known: cross-chain swap services, OTC desks onboarding large Bitcoin sellers, and the USDT-on-Tron off-ramp, where Tether can freeze again. Every exchange that screens incoming deposits against the published list closes one more exit.

Lessons for exchanges, regulators and Ethiopia

• Treat engineer endpoints as part of custody. A laptop that can reach a withdrawal service deserves the same protection as a signing key: hardware-backed identity, strict device posture checks and no standing access.
• Authenticate machines, not just messages. Internal services that can move funds should prove who they are cryptographically on every request, so that traffic which merely looks authorised is not treated as authorised.
• Rate-limit hot wallets by design. Twenty minutes was enough to empty eleven chains. Hard per-minute and per-hour caps, enforced outside the systems they protect, turn a catastrophe into a contained loss.
• Fund user protection in advance. SAFU worked because it already existed. Regulators should require licensed platforms to hold reserves against hot-wallet losses, much as Japan requires exchanges to back the small share of assets they keep online.

For Ethiopia, the incident is a sharper version of the warning in my piece on the Bybit hack. Ethiopians are among the most active crypto users in Africa, yet they have little legal recourse when a platform fails. Binance users were made whole this time because of a choice Binance made in 2018. Ethiopia should not leave its citizens’ protection to the policies of foreign companies: a licensing regime with cybersecurity standards, proof-of-reserves requirements and a protection fund financed by licensed platforms would give Ethiopian users the same safety net by right rather than by luck.

Check your deposits

If you received crypto since 29 October, especially through P2P trades or from wallets you do not know, check the sending address. Investigators and compliance teams can paste up to 1,000 addresses at once and export the results as a dated record. Exchanges that screen deposits will freeze funds that touch the list, and receiving them, even unknowingly, can get an account locked.

Deposit checker

Check the addresses that sent you funds since 29 October against Elliptic’s list of wallets linked to the Binance theft. Every chain in the list is covered, including Ethereum and other EVM chains, Bitcoin, Tron, Solana and the XRP Ledger.

Loading the reference list…

Addresses to check

0 of 1,000 addresses Check the sending address of each deposit, not your own.

Check addresses Clear

Checked in your browser against the saved Elliptic list. The addresses you paste never leave your device.

The list comes from Elliptic, which publishes it free of charge and updates it as tracing continues.³ Compliance teams can pull the same data as a CSV or through Elliptic’s public MCP server for AI assistants. Addresses on EVM chains are compared without regard to letter case, as Ethereum’s checksum casing is cosmetic;¹⁰ Bitcoin, Tron, Solana and XRP Ledger addresses are compared exactly, except all-caps bc1 addresses, which the Bech32 standard treats as case-insensitive.¹¹

Method and limits

This reconstruction relies on public sources: Binance’s official updates, Elliptic’s published tracing, and press coverage citing Chainalysis, TRM Labs and the FBI. I have not independently re-traced the transactions, and the figures are as reported in the first four days. Totals differ slightly between sources, $6.3 billion from Binance and $6.43 billion from Elliptic, mainly because of asset prices at the time of measurement. Values marked “~” are derived arithmetically from reported figures. The incident is still developing, and this page will be updated as official findings are published.

References

1. Binance. Security incident announcements and recovery updates #1 to #4, 29 October to 1 November 2026. binance.com/en/support/announcement
2. Elliptic. “How North Korea is laundering the $6.4 billion stolen from Binance.” November 2026. elliptic.co
3. Elliptic. Binance hack 2026 blocklist, continuously updated. Overview and CSV download. Public MCP server: public.mcp.elliptic.co/mcp
4. Federal Bureau of Investigation. Public attribution of the Binance theft to TraderTraitor, 1 November 2026. Reported by Reuters and Al Jazeera.
5. Federal Bureau of Investigation. “North Korea Responsible for $1.5 Billion Bybit Hack.” Public Service Announcement, 26 February 2025. ic3.gov
6. Chainalysis. Security briefings on the Binance incident, October to November 2026, as cited in Binance’s technical updates.
7. TRM Labs. Intelligence on the Binance incident and TraderTraitor laundering patterns, October to November 2026.
8. Daily Maverick, Reuters and Al Jazeera. Coverage of the Binance breach, 29 October to 2 November 2026.
9. Ethereum Improvement Proposals. “EIP-7702: Set Code for EOAs.” eips.ethereum.org
10. Ethereum Improvement Proposals. “EIP-55: Mixed-case checksum address encoding.” eips.ethereum.org
11. Bitcoin Improvement Proposals. “BIP-173: Base32 address format for native v0-16 witness outputs.” github.com/bitcoin/bips
12. zkSNACKs. “WabiSabi: Centrally Coordinated CoinJoins with Variable Amounts.” github.com/zkSNACKs/WabiSabi