advertisement
Twenty Minutes, Ten Blockchains: The Binance Heist In Numbers
Binance lost an estimated $6.3 billion in about 20 minutes on 29 October, making it the largest crypto theft on record. Here is what happened, what was recovered or frozen, and what the available evidence still does not establish.
The first sign of trouble was small. On the morning of 28 October, a wallet that TRM Labs identifies as belonging to the attacker received three small withdrawals from Tornado Cash, a mixing service. That was at least 36 hours before the theft.
The following day, the attackers rehearsed. According to TRM’s reconstruction, they deployed attack code on two wallets, tested a final version on a third, and routed the test funds back to themselves. About four hours later, the same code was deployed against a Binance hot wallet.
advertisement
Twenty minutes
At 20:05 UTC on 29 October, five Binance XRP wallets sent 233.46 million XRP to a single address. Within minutes, wallets on Solana and Optimism were drained.
At 20:20, Binance’s Bitcoin hot wallet sent out 18,270 BTC, worth about $1.47 billion. The attacker began splitting the funds through a series of small transfers. Within two minutes, a Tron wallet had sent 612.7 million USDT and 46.4 million TRX.
advertisement
The largest transfer came from Ethereum. At 20:20, the hot wallet authorised a sweeper contract using one of 50 authorisations signed in advance. About three minutes and 24 seconds later, the contract emptied the wallet, transferring 167,464 ETH and 1.615 billion USDT, among 63 tokens, according to TRM.
Further sweeps followed at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56. A second wave hit Binance wallets on Avalanche and Polygon at 23:05.
By the end, funds had left Binance across ten blockchains. TRM estimates the haul at about $6.36 billion, based on prices at the time of each transfer. This included roughly $3.79 billion on Ethereum, $1.47 billion in Bitcoin, $628 million on Tron, $296 million in XRP and $96 million on Solana. The remaining chains each accounted for less than $40 million.
advertisement
For scale, that is about 4.2 times the $1.5 billion Bybit hack in February 2025, previously the largest crypto theft on record.
How the money got out
Binance has not disclosed how the attackers gained access. Its initial statement pointed to a compromised DevOps engineer’s laptop, which provided access to a service container used to submit unauthorised withdrawals. The company later said its investigation had identified “additional points of breach.”
Binance says no wallet private key was leaked. Co-CEO Richard Teng also said the attack was not a single-permission, one-click operation, as reported by The Hacker News. No root cause has been published.
Outside analysts have offered their own assessments. TRM believes Binance’s signing infrastructure was compromised, given that funds were taken across ten chains using different key and signing schemes. Elliptic says the attacker did not steal keys but instead manipulated Binance’s own systems into signing transactions.
Both are external assessments, not findings confirmed by Binance.
On attribution, TRM Labs and Chainalysis assess with high confidence that the attack was carried out by North Korea’s TraderTraitor group, the unit the FBI linked to the Bybit hack.
Chainalysis points to funds from the recent Bitget exploit that mingled with the Binance proceeds at the same Ethereum address. Elliptic urges caution, citing differences in laundering speed and methods compared with previous North Korean operations, as well as the absence of a confirmed root cause.
Binance has not attributed the attack to any group.
The race to freeze
While the sweeps were still underway, stablecoin issuers began freezing assets.
At 21:01 UTC, about 40 minutes after the main transfer, Tether froze $971.1 million in USDT in the attacker’s main receiving wallet. Circle froze $823 million in USDC there at 21:04.
Ripple froze 40.5 million RLUSD at 22:01, while World Liberty Financial froze 27.8 million USD1 at 22:10. At 00:08 on 30 October, the Arbitrum Security Council forced about $30 million in ETH and ARB out of the attacker’s control.
The totals vary depending on when each source counted. The Hacker News puts Tether’s final freeze at 1.57 billion USDT, while TRM estimates about 1.77 billion. Circle’s freeze is reported at between $800 million and $825 million in USDC.
Overall, TRM counted about $2.7 billion frozen by 00:30 UTC on 30 October. Elliptic put the figure at $2.84 billion, while Binance said about $3 billion had been frozen the following day.
One claim did not survive scrutiny. Binance’s co-CEO said about $200 million had been stopped at Ripple, but TRM confirmed only the 40.5 million RLUSD frozen on-chain.
The attacker was also moving funds. TRM traced about 325 million USDT sold through UniswapX and similar contracts for roughly 122,300 ETH, at a discount of more than 10 per cent to market prices. Another 175 million USDT was frozen.
About 60 million USDT was deposited into the Aave lending market, against which the attacker borrowed approximately 19,760 ETH, until Aave froze the affected markets. Another 300 million USDT went into JustLend on Tron.
Of the 88.5 million RLUSD stolen, 48 million was sold on decentralised exchanges in about 20 minutes.
The amount that remained unfrozen was substantial. Elliptic estimates the attacker’s remaining holdings at about $3.33 billion across 43 wallets. These included 511,861 ETH, worth approximately $1.15 billion; 18,270 BTC, worth about $1.43 billion; 233 million XRP; and 670 million TRX.
TRM’s estimate is lower, at about $2.4 billion. Neither source explains the discrepancy.
Making customers whole
Binance’s response to customers rests on a promise and a ledger. The company says it has set aside more than $6.34 billion of its own resources to restore every balance on a one-for-one basis.
About $5 billion is already held in the same assets that were stolen. The remainder is being acquired through public markets and over-the-counter transactions, according to CoinDesk.
Binance says the money does not come from customer funds and that frozen assets are separate from its reserves. It is also drawing on its Secure Asset Fund for Users (SAFU), its emergency fund, which has typically held about $1 billion in Bitcoin.
Deposits remained open. Withdrawals were suspended, with Binance saying it expected to resume them within 45 to 48 hours. The reports reviewed do not confirm whether withdrawals have resumed.
No source gives the number of affected users or a date for completing reimbursement.
For context, DefiLlama put Binance’s assets at about $144 billion before the theft, making the loss roughly 4 per cent of its assets.
DefiLlama also recorded 322 confirmed crypto incidents in 2026, with more than $8.7 billion in losses. The report does not say whether that total includes Binance.
What the market did
Prices fell as the news spread. By the evening of 29 October, Bitcoin was down 4.8 per cent to below $77,000, Ether had fallen 5.7 per cent and BNB was down 8 per cent. The Aave lending token dropped 11 per cent, according to CoinDesk.
A day later, the thinly traded FUN token had fallen 90 per cent.
The reports reviewed provide no figures for liquidations, exchange outflows or price movements beyond those initial days. This article therefore does not estimate them.
What the record shows, and what it does not
Three facts stand out.
First, the theft spanned ten blockchains within a window of about 20 minutes. It was not confined to the design or vulnerabilities of a single chain.
Second, companies able to freeze assets stopped at least $2.3 billion in USDT and USDC within hours. Yet Elliptic reports that 18,270 BTC and 511,861 ETH, worth about $2.58 billion combined, remained unfrozen in attacker-controlled wallets.
Third, the two largest crypto thefts on record, Bybit in 2025 and Binance in 2026, have both been attributed by on-chain analysts to the same North Korean unit. TRM also cites similarities with the April 2026 KelpDAO hack.
Several questions remain unanswered as of 1 November 2026.
Binance has not published a root cause. Loss estimates range from $5.9 billion to $6.43 billion. Attribution has not been confirmed by Binance or law enforcement. Estimates of the attacker’s remaining balance differ significantly.
No source has disclosed how many customers were affected, when reimbursement will be completed, or whether withdrawals have resumed.
The numbers establish the scale of the theft. They do not yet establish how Binance’s systems were breached, who was responsible, or how much of the stolen value will ultimately be recovered.