Binance's hot wallets sent $6.3B to an attacker in under four hours. $2.7B is frozen. Most of the rest sits untouched in the attacker's wallets

01 · What happenedWhat happened in the Binance hack

On Thursday night, Binance stopped letting its users take money out. The world's biggest crypto exchange said it was looking into a security problem. By then, most of the money was already gone.

Binance is where millions of people buy and sell crypto. Like any exchange, it keeps its customers' coins in wallets it controls, and it pays out withdrawals from a few of those wallets that stay online all the time.

That evening, in under four hours, those wallets sent coins worth about $6.3 billion to new addresses on nine blockchains. Ethereum, Bitcoin and TRON took the biggest hits. Binance says a hacker got in through an engineer's laptop and used Binance's own withdrawal system to send the money out.

Bitquery traced each transfer with its blockchain data. We matched every drain to a Binance wallet and followed the money to where it sits now. Tether, Circle, Arbitrum and four smaller token issuers locked $2.7 billion. Most of the rest sits in wallets that have never sent a transaction. Dollar values are at the prices of the moment the coins left, and holdings are as of early on 30 October.

02 · The setupWhere an exchange keeps your coins

An exchange does not keep every coin online. Most sit in cold wallets, which are kept offline and are slow to reach on purpose. A smaller amount sits in hot wallets. These stay online, so the exchange's systems can sign a withdrawal from them in seconds, at any hour, without anyone touching a cold wallet.

Binance publishes the addresses of its wallets in a proof-of-reserves list, a public record that lets anyone check the exchange holds what its customers own. Each wallet drained that night carries the Binance proof-of-reserves label in Bitquery's address data.

A hot wallet moves only when the exchange's withdrawal system signs a transfer. That system is what the hacker reached.

03 · The nightNine chains in under four hours

The first coins left on the XRP Ledger. Five Binance accounts there sent 233.5 million XRP to an account that had not existed a minute earlier. Solana followed five minutes later, then Base and Optimism, two networks built on top of Ethereum.

A quarter of an hour later, the three biggest drains began within minutes of each other. Binance's TRON hot wallet sent out 613 million USDT. Its main Bitcoin hot wallet sent 18,270 BTC, all in one block. On Ethereum, the hacker set a trap inside Binance's busiest hot wallet and sprang it four minutes later.

Ethereum lost the most by far, $3.8 billion from three Binance wallets. Nothing else came close. Drains there kept coming for three and a half hours, and the last one landed after Tether's first freeze and after Binance had paused withdrawals.

The XRP Ledger account shares no address with the rest of the attack. But its transfers were built in the same unusual way as the others, with a higher fee than Binance's own payments that day. Binance's own estimate of the damage, around $6.3 billion, only adds up if those coins are counted.

04 · The break-inHow the hacker got in

Early on 30 October, Binance said its first look points to "a compromised DevOps engineer's laptop". That gave the hacker a way into one of Binance's internal services, where the hacker could "submit unauthorized withdrawal transactions". Binance said it found "no evidence of any wallet private key leak".

The chain fits that account. Every drain carries a valid signature from a Binance wallet. On 16 of the 17 wallets, Binance's system simply signed ordinary transfers to the hacker. Those transfers were built differently from Binance's normal ones, though. On Bitcoin they paid about twice the usual fee. On TRON and the XRP Ledger they used settings we did not see on any of Binance's own transfers that night. The signing was Binance's. The software asking for it was not.

On Ethereum the hacker went further. Since the Pectra upgrade last year, an Ethereum wallet can sign a note called an EIP-7702 authorization. It lets the wallet borrow a smart contract's code, a program that lives on the chain, and run it as its own. Four minutes before the main drain, the hacker's wallet sent in a batch of these notes for Binance 14, Binance's busiest Ethereum hot wallet. Each note only works when the wallet's transaction count hits one exact value, so the hacker brought 50, one for each count in a row. One of them matched.

From that moment the wallet ran the hacker's code. The hacker called it seven times over the next three and a half hours. The first call alone took about 167,000 ETH, 1.6 billion USDT and 62 other tokens in one transaction. Seconds later, a second Binance hot wallet signed nine transfers of its own.

Binance cancelled the note just after midnight UTC, almost four hours after it was set. More than an hour and a half of that came after withdrawals were paused.

The chain cannot show who asked Binance's system to sign. ZachXBT and the security firm Blockaid said North Korea was likely behind it, CoinDesk reported. Binance has named nobody and says it is working with law enforcement.

The hacker's Ethereum wallet got its first gas money, the coin that pays network fees, from Tornado Cash, a mixer that breaks the link between where coins come from and where they go. About 1 ETH came out of the mixer five and a half hours before the Ethereum drain, and smaller amounts the day before.

05 · The freezesThe race against the freezes

Stablecoins like USDT and USDC have an off switch. Their issuers, Tether and Circle, can freeze an address so that the tokens sitting in it cannot move until the issuer lifts the freeze. The hacker moved fast to stay ahead of that switch.

Tether's first freeze hit the main Ethereum receiver 37 minutes after the big drain, and by then 700 million USDT had already left it for two new wallets. From there the money ran down a chain of fresh wallets. At each step some of it was swapped, and the rest was passed on before the freeze arrived. Back at the start, later drains still sent another 204 million USDT into the frozen main wallet, where it is stuck too.

Tether froze 11 of the hacker's wallets on Ethereum and TRON. Six were already empty when the freeze landed. One wallet passed on 130 million USDT less than a minute before its freeze. On Polygon, a smaller amount of USDT was frozen later that night.

Circle froze the 823 million USDC in the main Ethereum wallet three minutes after Tether's first freeze, before any of it moved. Smaller issuers acted too. World Liberty froze its WLFI token in the main receiver at 20:57, before anyone else, and later its USD1 stablecoin, as Zach Witkoff confirmed on X. Tether's gold token, Paxos, Ripple and First Digital followed. Together these six token freezes locked about $132 million.

Just after midnight, Arbitrum's Security Council moved the hacker's ARB and ETH on that network into a locked wallet. The council is a group that can act for the network in an emergency.

In all, 1.76 billion USDT is locked, 71% of what was taken. The other $729 million got out first. On Ethereum it went through UniswapX and 1inch Fusion, swap apps where market makers fill big orders, and through Uniswap's own pools. Some went into Aave, a lending app, as collateral for a loan paid out in ETH. On TRON it was swapped on SunSwap, TRON's main swap app. Our audit of Tether's freezes explains how the blacklist works.

06 · The swapHow stolen dollars became ETH

The hacker took about 200,000 ETH from Binance. Hours later, it held more than twice as much. The extra was bought with stolen stablecoins and the other tokens it took. Many of those tokens went to a fresh wallet first and were then sold on Uniswap and other DEXes.

Speed cost money. On the stablecoins it sold through UniswapX and 1inch Fusion, the hacker paid about 15% over the market price for its ETH.

The swaps also explain two figures that went round on X, $875 million in ETH and $234 million in TRX. Both counted coins the hacker had bought with stolen stablecoins, which is why they run well above what Binance lost in those coins.

07 · The moneyWhere the money sits now

When we last read the chains, at 06:43 UTC on 30 October, the hacker held about $3.2 billion. ETH and BTC make up most of it.

Seven of the Ethereum wallets have never sent a transaction, and they hold almost all the ETH. The Bitcoin sits in 19 addresses, most of them holding exactly 1,000 BTC each. The XRP and the Solana coins have not moved. On TRON, one wallet holds most of the TRX.

The hacker spent the early hours of 30 October pulling its ETH together. At 05:15 UTC the main receiving wallet sent 17,260 ETH to a new wallet. Between 05:27 and 05:36, four wallets the hacker had used to sell stolen tokens such as LINK and USDe sent 14,540 ETH into one of the stash wallets. At 06:36 the second receiving wallet sent 7,647 ETH into another. All of that ETH stayed in wallets we track.

The TRX is moving too. Since 02:45 UTC the second TRON wallet has sent out 11.4 million TRX, in more than 30 lots, to new addresses. We followed two of them. Each passes the TRX to one more new address, which swaps it back into USDT on SunSwap. The USDT then goes to two older wallets we could not identify. Unlike TRX, that USDT can still be frozen by Tether.

We still found no transfer to a known exchange, a mixer or a bridge. Anyone can watch these wallets with the Bitquery MCP. The addresses are listed at the end.

08 · The scaleThe biggest crypto hack on record

CoinDesk called it the largest crypto theft on record, and the numbers back that up. The previous record, the Bybit hack of February 2025, took about $1.5 billion. This one took about four times as much. Even now, what the hacker still holds is more than twice what Bybit lost.

It is not the only exchange hack this autumn. Last month, about $387 million left Bitget on nine blockchains, and our Bitget hack trace followed it out. Last week, CoinDCX lost $16 million from wallets it was still using, as our CoinDCX hack report showed. Two smaller drains this week, at Polymarket and Predict.fun, also ran on valid signatures instead of broken code.

09 · What to doIf you use Binance

Binance says user funds are safe. It says it will cover all losses from its SAFU fund, an emergency pot it keeps for hacks, and from its own money. Deposits and withdrawals stay paused until its security checks are done, and it says it will publish an updated proof of reserves.

• Rely only on Binance's official channels for updates. Scams follow big hacks.
• Do not sign anything or send coins to anyone who contacts you about the hack.
• When withdrawals reopen, check the address you withdraw to before you confirm.

10 · The methodHow we traced the Binance hack

We started from every wallet that carries the Binance proof-of-reserves label in our address data. We looked for large transfers to new addresses that night, then followed each one hop by hop. We timed each freeze against the moment the money moved on, and read the final balances straight from each chain at 06:43 UTC. Dollar values use the price at the time of each transfer.

The full histories are also sold as files on the Bitquery Data Store, as the Ethereum, Bitcoin, TRON, Solana and XRP Ledger datasets.

11 · The recordThe addresses behind the Binance hack

FAQ

How much was stolen in the Binance hack?

About $6.3 billion, at the prices of the moment it left. The coins came from 17 Binance hot wallets on nine blockchains on the evening of 29 October, in under four hours. Binance's own estimate is about the same.

How did the Binance hack happen?

Binance says a hacker got into its systems through a compromised engineer's laptop and used its withdrawal service to send money out. No private key leaked, Binance says. On Ethereum, the hacker also used EIP-7702 authorizations, signed by Binance's system, to make Binance's busiest hot wallet run the hacker's code.

Is Binance safe after the hack?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and its own money. Deposits and withdrawals were paused while it checks its systems. It has promised an updated proof of reserves and a full report on what went wrong.

How much of the stolen crypto was frozen?

About $2.7 billion. Tether locked 1.76 billion USDT and Circle locked 823 million USDC. Tether's gold token and four smaller issuers froze about $132 million in other tokens, and Arbitrum's Security Council moved the hacker's ARB and ETH on its network into a locked wallet.

Where is the stolen money now?

Early on 30 October, the hacker held about $3.2 billion, mostly ETH and BTC. The biggest wallets have never sent a transaction, and we found none of the money sent to a known exchange, a mixer or a bridge.

Is the Binance hack the biggest crypto hack ever?

By the figures reported so far, yes. At about $6.3 billion, it is about four times the size of the Bybit hack, the previous record at about $1.5 billion.