Binance's hot wallets sent $6.3B to an attacker in under four hours. $2.8B is frozen. Most of the rest sits untouched in the attacker's wallets

01 · What happenedWhat happened in the Binance hack

On Thursday night, Binance stopped letting its users take money out. The world's biggest crypto exchange said it was looking into a security problem. By then, most of the money was already gone.

Binance is where millions of people buy and sell crypto. Like any exchange, it keeps its customers' coins in wallets it controls, and it pays out withdrawals from a few of those wallets that stay online all the time.

That evening, in under four hours, those wallets sent coins worth about $6.3 billion to new addresses on nine blockchains. Ethereum, Bitcoin and TRON took the biggest hits. Binance says a hacker got in through an engineer's laptop and used Binance's own withdrawal system to send the money out.

Bitquery traced each transfer with its blockchain data. We matched every drain to a Binance wallet and followed the money to where it sits now. Tether, Circle, Arbitrum and other token issuers locked $2.8 billion. Most of the rest sits in wallets that have never sent a transaction. Dollar values are at the prices of the moment the coins left, and holdings are as of 07:37 UTC on 5 November.

02 · The setupWhere an exchange keeps your coins

An exchange does not keep every coin online. Most sit in cold wallets, which are kept offline and are slow to reach on purpose. A smaller amount sits in hot wallets. These stay online, so the exchange's systems can sign a withdrawal from them in seconds, at any hour, without anyone touching a cold wallet.

Binance publishes the addresses of its wallets in a proof-of-reserves list, a public record that lets anyone check the exchange holds what its customers own. Each wallet drained that night carries the Binance proof-of-reserves label in Bitquery's address data.

A hot wallet moves only when the exchange's withdrawal system signs a transfer. That system is what the hacker reached.

03 · The nightNine chains in under four hours

The first coins left on the XRP Ledger. Five Binance accounts there sent 233.5 million XRP to an account that had not existed a minute earlier. Solana followed five minutes later, then Base and Optimism, two networks built on top of Ethereum.

A quarter of an hour later, the three biggest drains began within minutes of each other. Binance's TRON hot wallet sent out 613 million USDT. Its main Bitcoin hot wallet sent 18,270 BTC, all in one block. On Ethereum, the hacker set a trap inside Binance's busiest hot wallet and sprang it four minutes later.

Ethereum lost the most by far, $3.8 billion from three Binance wallets. Nothing else came close. Drains there kept coming for three and a half hours, and the last one landed after Tether's first freeze and after Binance had paused withdrawals.

The XRP Ledger account shares no address with the rest of the attack. But its transfers were built in the same unusual way as the others, with a higher fee than Binance's own payments that day. Binance's own estimate of the damage, around $6.3 billion, only adds up if those coins are counted.

04 · The break-inHow the hacker got in

Early on 30 October, Binance said its first look points to "a compromised DevOps engineer's laptop". That gave the hacker a way into one of Binance's internal services, where the hacker could "submit unauthorized withdrawal transactions". Binance said it found "no evidence of any wallet private key leak".

The chain fits that account. Every drain carries a valid signature from a Binance wallet. On 16 of the 17 wallets, Binance's system simply signed ordinary transfers to the hacker. Those transfers were built differently from Binance's normal ones, though. On Bitcoin they paid about twice the usual fee. On TRON and the XRP Ledger they used settings we did not see on any of Binance's own transfers that night. Binance's system did the signing, but the requests came from the hacker's software.

On Ethereum the hacker went further. Since the Pectra upgrade last year, an Ethereum wallet can sign a note called an EIP-7702 authorization. It lets the wallet borrow a smart contract's code, a program that lives on the chain, and run it as its own. Four minutes before the main drain, the hacker's wallet sent in a batch of these notes for Binance 14, Binance's busiest Ethereum hot wallet. Each note only works when the wallet's transaction count hits one exact value, so the hacker brought 50, one for each count in a row. One of them matched.

From that moment the wallet ran the hacker's code. The hacker called it seven times over the next three and a half hours. The first call alone took about 167,000 ETH, 1.6 billion USDT and 62 other tokens in one transaction. Seconds later, a second Binance hot wallet signed nine transfers of its own.

Binance cancelled the note just after midnight UTC, almost four hours after it was set. More than an hour and a half of that came after withdrawals were paused.

The chain cannot show who asked Binance's system to sign. On 31 October the FBI said North Korea was behind the theft. It named the TraderTraitor group, which it also blamed for the Bybit hack, and listed 628 addresses it ties to the theft. North Korea denied it. ZachXBT and the security firm Blockaid had already pointed to North Korea, CoinDesk reported.

The hacker's Ethereum wallet got its first gas money, the coin that pays network fees, from Tornado Cash, a mixer that breaks the link between where coins come from and where they go. About 1 ETH came out of the mixer five and a half hours before the Ethereum drain, and smaller amounts the day before.

05 · The freezesThe race against the freezes

Stablecoins like USDT and USDC have an off switch. Their issuers, Tether and Circle, can freeze an address so that the tokens sitting in it cannot move until the issuer lifts the freeze. The hacker moved fast to stay ahead of that switch.

Tether's first freeze hit the main Ethereum receiver 37 minutes after the big drain, and by then 700 million USDT had already left it for two new wallets. From there the money ran down a chain of fresh wallets. At each step some of it was swapped, and the rest was passed on before the freeze arrived. Back at the start, later drains still sent another 204 million USDT into the frozen main wallet, where it is stuck too. Of that, 200 million USDT came from Binance itself. At 21:42 UTC, 78 minutes after the main drain, a wallet that Binance lists in its proof of reserves sent that money to Binance 14. Binance 14 still ran the hacker's code, and 72 seconds later the hacker moved the money on to the frozen main wallet.

Tether froze 11 of the hacker's wallets on Ethereum and TRON. Six were already empty when the freeze landed. One wallet passed on 130 million USDT less than a minute before its freeze. On Polygon, a smaller amount of USDT was frozen later that night.

Circle froze the 823 million USDC in the main Ethereum wallet three minutes after Tether's first freeze, before any of it moved. Smaller issuers acted too. World Liberty froze its WLFI token in the main receiver at 20:57, before anyone else, and later its USD1 stablecoin, as Zach Witkoff confirmed on X. Tether's gold token, Paxos, Ripple and First Digital followed. Together these six token freezes locked about $132 million. Binance blacklisted a hacker wallet holding about $75 million of wBETH, its own staked-ETH token, at 22:48 UTC. Our earlier updates missed that freeze. Issuers also froze 11 smaller tokens, and 10 more tokens were burned or moved out of the hacker's reach. Together they add about $18 million. We found them in a read on 6 November.

Just after midnight, Arbitrum's Security Council moved the hacker's ARB and ETH on that network into a locked wallet. The council is a group that can act for the network in an emergency.

In all, 1.76 billion USDT is locked, 71% of what was taken. The other $729 million got out first. On Ethereum it went through UniswapX and 1inch Fusion, swap apps where market makers fill big orders, and through Uniswap's own pools. Some went into Aave, a lending app, as collateral for a loan paid out in ETH. On TRON it was swapped on SunSwap, TRON's main swap app. Our audit of Tether's freezes explains how the blacklist works.

06 · The loan60 million USDT that Tether's freeze does not reach

One of the hacker's wallets put 60 million USDT into Aave a few minutes before Tether froze that wallet. The wallet borrowed about $45 million in ETH against the USDT. Less than a minute before the freeze, the wallet sent the ETH and its other USDT on to the next wallet.

Tether's freeze stops that wallet from sending USDT. It does not reach the USDT in Aave, because Tether blocks wallet by wallet and that USDT was paid into Aave's pool. The pool lends out every lender's USDT, and the hacker holds Aave's receipt for its share. To block the hacker's share, Tether would have to block the whole pool and trap every other lender's money too.

About three quarters of an hour after the last loan, Aave's guardian, a group of signers allowed to act fast in an emergency, froze lending in 32 coins on Aave's main Ethereum market. Nobody could deposit those coins or borrow them there. LlamaRisk, a firm that advises Aave on risk, wrote on Aave's forum that 292 markets were frozen across Aave's networks. The main Ethereum market reopened the next afternoon. USDT there still cannot back a new loan.

Aave lets a loan stay open as long as the deposit covers the debt with room to spare. If ETH rises too far, anyone can repay part of the debt and take USDT from the deposit at a discount. That happened on the afternoon of 4 November, soon after ETH passed about $2,365. A trading bot repaid 9,884 WETH, half of the debt, and took 24.4 million USDT out of Aave's pool. Tether's freeze did not stop it, because the USDT came from the pool and not from the hacker's wallet. In the same transaction, the bot sold the USDT for ETH and paid 236 ETH to the block builder that added the transaction to the chain. Aave kept a small fee. The hacker keeps the ETH it borrowed.

When we read the loan the next morning, the deposit held 35.6 million USDT against a debt of 9,885 WETH. Another liquidation would need ETH to rise about 16% from its price then. The hacker could take about $4.9 million of the USDT out without repaying anything. To take out more, it would first have to repay part of the loan.

We count the borrowed ETH in what the hacker holds, and we leave out the USDT in Aave.

07 · The swapHow stolen dollars became ETH

The hacker took about 200,000 ETH from Binance. Hours later, it held more than twice as much. Most of the extra was bought with stolen stablecoins and the other tokens it took, and later with TRX. Part came from a loan on Aave, taken against stolen USDT. Many of the stolen tokens went to a fresh wallet first and were then sold on Uniswap and other DEXes.

Speed cost money. On the stablecoins it sold through UniswapX and 1inch Fusion, the hacker paid about 16% over the market price for its ETH.

In all, the rushed swaps cost the hacker $119 million against market prices. Traders on the other side of those swaps kept $60 million after their costs. Our follow-up on who profited from the hacker's swaps tracks that money wallet by wallet.

The swaps also explain two figures that went round on X, $875 million in ETH and $234 million in TRX. Both counted coins the hacker had bought with stolen stablecoins, which is why they run well above what Binance lost in those coins.

08 · The moneyWhere the money sits now

When we last read the chains, on the morning of 5 November, the hacker held about $3.2 billion. BTC and ETH make up most of it.

Eight big Ethereum wallets that have never sent a transaction hold almost all the ETH. The Bitcoin taken from Binance sits in 19 addresses, most of them holding 1,000 BTC each, and has not moved.

Early on 2 November, the XRP moved for the first time. The account that took it sent all 233 million XRP to seven new accounts. It sent small test payments first. None of the new accounts sent anything before our 5 November read. That afternoon the hacker began swapping the XRP through THORChain, mostly for Bitcoin. By 10:00 UTC on 6 November, the hacker had swapped 44.2 million XRP.

The Solana coins started to move a day earlier. On the morning of 1 November, the hacker's Solana wallet sent 485,277 SOL to one new wallet. Smaller lots went to more new wallets over the next two days. Four of those wallets swapped about 41,000 SOL for USDC and spread it across hundreds of fresh wallets that also carry money from elsewhere. We did not follow that money further.

Then THORChain reopened. It had paused swaps on most of its networks on 31 October, after a refund bug that had nothing to do with the hack. It restarted Bitcoin swaps late in the afternoon of 3 November, and ETH and TRON swaps about three hours later. By our latest read, only its Solana swaps were still paused. Less than an hour after the Bitcoin restart, the wallet holding the 485,277 SOL began sending it back to the hacker's main Solana wallet. Between our reads on 3 and 4 November, the main wallet sent 779,097 SOL to 91 new wallets. Almost all of them passed it on within hours.

Part of that SOL was turned into Bitcoin. Wallets one step further on swapped SOL for USDC and sent the USDC to Ethereum through CCTP, Circle's own bridge. From the evening of 3 November to the next morning, at least 10.4 million USDC came this way from Solana to new Ethereum wallets. The wallets swapped the USDC for ETH within minutes and sent the ETH to Ethereum addresses that THORChain had paid for the hacker's TRX on 30 and 31 October. Those addresses paid the ETH back into THORChain, with notes asking for Bitcoin. The hacker did the same with AVAX, after sending USDC to Avalanche over the same bridge. By our 4 November read, THORChain had paid at least 497 BTC to nine Bitcoin addresses named in the hacker's swaps. Six of those addresses pass coins to one another in chained transactions, so one group controls them. They passed their Bitcoin on to 62 new addresses, which still held 355 BTC at our latest read. We count that Bitcoin as the hacker's. Early on 5 November, one of those addresses sent 11.9 BTC on to other new addresses, which we do not count.

Later on 4 November, the main Solana wallet paid out the last of its SOL. Most of that SOL went through one more wallet to a new wallet. The new wallet also took SOL from another wallet the main wallet had paid. It swapped all its SOL for USDC and sent 2.24 million USDC over Circle's bridge to a single new Ethereum wallet. The Ethereum wallet also had USDC from a sender we did not trace. It bought ETH and paid 1,132 ETH into THORChain in seven swaps that afternoon. THORChain paid 33.5 BTC for them, each time to a different new address. Five of those addresses still held 24.7 BTC at our latest read, and we count it. Since THORChain reopened, it has paid at least 543 BTC to 16 Bitcoin addresses named in the hacker's swaps. That total includes 12.4 BTC from a swap that landed minutes after our 4 November read. The last swap we found was late that afternoon. Of the SOL taken, less than 0.1% is left in the hacker's Solana wallet and in the wallets it paid directly.

Our 31 October update missed two Ethereum wallets. One has collected ETH from the token-sale wallets since the night of the hack and has never sent a transaction. It now holds 9,788 ETH. The other got its ETH through Relay. Together they held 6,042 ETH at that read, so our ETH count then was about 1% too low.

The hacker spent the early hours of 30 October pulling its ETH together. Soon after five in the morning, UTC, the main receiving wallet sent 17,260 ETH to a new wallet. Minutes later, four wallets the hacker had used to sell stolen tokens such as LINK and USDe sent 14,540 ETH into one of the stash wallets. About an hour after that, the second receiving wallet sent 7,647 ETH into another. All of that ETH stayed in wallets we track.

Later that morning the biggest TRON wallet moved. Within five minutes, it sent out all 638 million TRX it held, in five lots. Three new wallets got 398 million. The other 240 million went through two more new wallets to the wallet that pays out TRX in small lots. On 31 October all three new wallets sent their TRX to the payout wallet too, the last one that evening.

From the early hours of 30 October to 05:33 UTC on 1 November, the payout wallet sent 685 million TRX to 220 addresses and emptied. The parked wallets and the payout wallet now hold almost no TRX. At least six of those addresses sent TRX straight into a swap router. On 30 October we followed that route through SunSwap to two wallets. The swaps ran through a router contract named BWSwapRouterV1. The first wallet passed almost all the USDT to a busy hub wallet that also pays a Bitget deposit address. The same hub took stolen money in the Ledger and CryptoBilis hack. Many other people use it too, so we do not count its payouts as the hacker's.

Another part of the TRX went through THORChain, a service that swaps coins between blockchains. On 30 and 31 October, 98 new TRON wallets funded by the hacker swapped 124 million TRX, about $39 million, through THORChain. Each payment carries a note that tells THORChain what to send back and where. The notes name 102 Ethereum addresses and 13 Bitcoin addresses. THORChain paid the Ethereum addresses 16,553 ETH and the Bitcoin addresses about 49 BTC. The Ethereum addresses also took about 4,000 ETH from other senders that we have not traced. They passed almost all the ETH on to 333 new wallets. None of those wallets has sent a transaction, and together they hold 19,985 ETH. We count that ETH as the hacker's. Most of the Bitcoin has moved on, and 8.2 BTC still sits in one of those addresses.

Before our 4 November update, we had read the notes on only one of those TRON wallets, and we counted 3,600 ETH from THORChain. The other payees and the new wallets they paid hold another 16,410 ETH, which is now in our total.

From midday on 31 October the hacker also used Relay, a bridge that pays out on another blockchain. The hacker's last TRX payment to THORChain that day was at 12:27 UTC. About half an hour later, THORChain stopped reading the TRON chain, and it did not read it again until 3 November. One of the payout addresses put 145 million TRX into a TRON contract that passes coins through, and took it all back out to 18 new wallets. Those wallets swapped most of the TRX for USDT on SunSwap. By 20:34 UTC, twelve of them had sent Relay about $34 million in USDT and TRX. Relay refunded some of those deposits. Relay's own records show its payouts landing on Ethereum, in 13 new wallets. Those wallets swapped their USDT for ETH, mostly on CoW Swap, a trading app, and moved most of the ETH on to 24 more new wallets. When we last read the chains, those 24 wallets held 13,853 ETH and had not sent a transaction. We count all of that ETH as the hacker's.

The payout wallet's other TRX was split into smaller and smaller amounts across hundreds of new addresses. Many of the THORChain senders above sit further down that trail. Some TRX went through swap apps on TRON, and at least 1.9 million USDT went into JustLend, a lending app on TRON. At least 5.3 million TRX went straight into 723 deposit addresses at HitBTC, an exchange. Other TRX and USDT went to services that swap coins between blockchains. We did not follow those amounts further, and they are not in our total.

The main receiving wallet has kept selling the smaller tokens it took. On 30 and 31 October it sold DAR, CTSI and PROM into Uniswap pools that held almost no ETH, and got about $490 for all three. The 908,793 PROM in that sale were worth about $4.6 million at that day's trading price. In the same block as each sale, trading bots bought the tokens out of the pools and sold them on. Larger sales went through new wallets. One sold 1.69 billion SOPH for 932 ETH, and others sold ZAMA, RE, BLUR and ROBO. On the morning of 31 October, those wallets sent 4,003 ETH into one of the stash wallets. That ETH includes 1,187 ETH from the VIRTUAL tokens the hacker took on Base. A new wallet swapped the VIRTUAL for ETH on Base and sent the ETH to Ethereum through Stargate, another bridge.

On 3 and 4 November, wallets fed by the hacker's Solana wallet put about $7.7 million of SOL into Privacy Cash, a mixer on Solana. We missed this in earlier updates. On Ethereum we found no transfer to a mixer. Some TRX reached the hub wallet, HitBTC and other swap services. THORChain, Relay, Stargate and Circle's bridge all move value from one blockchain to another. On each of those routes, the coins we found either sit in new wallets that we count as the hacker's or have moved on through more new wallets. Anyone can watch these wallets with the Bitquery MCP. The addresses are listed at the end. Our report on how fast the hacker laundered the money traces it on all nine chains to the morning of 6 November. By then the hacker had laundered or cashed out $333 million.

09 · The scaleThe biggest crypto hack on record

CoinDesk called it the largest crypto theft on record, and the numbers back that up. The previous record, the Bybit hack of February 2025, took about $1.5 billion. This one took about four times as much. Even now, what the hacker still holds is about twice what Bybit lost.

It is not the only exchange hack this autumn. In September, about $387 million left Bitget on nine blockchains, and our Bitget hack trace followed it out. In October, CoinDCX lost $16 million from wallets it was still using, as our CoinDCX hack report showed. Two smaller drains around the same time, at Polymarket and Predict.fun, also used valid signatures to move the money.

10 · What to doIf you use Binance

Binance says user funds are safe. It says it will cover all losses from its SAFU fund, an emergency pot it keeps for hacks, and from its own money. Two days after the hack, its chief executive said Binance had already replaced 90% of the stolen assets and had shared an updated proof of reserves. Two days later, Binance said it had covered about 95% of the loss. Binance says deposits kept working. Withdrawals reopened in stages three days after the hack.

• Rely only on Binance's official channels for updates. Scams follow big hacks.
• Do not sign anything or send coins to anyone who contacts you about the hack.
• Check the address you withdraw to before you confirm.

11 · The methodHow we traced the Binance hack

We started from every wallet that carries the Binance proof-of-reserves label in our address data. We looked for large transfers to new addresses that night, then followed each one hop by hop. We timed each freeze against the moment the money moved on, and read the final balances straight from each chain at 07:37 UTC on 5 November. Dollar values use the price at the time of each transfer. Holdings, and the dollar values for the THORChain and Relay moves, use prices from that morning.

The full histories are also sold as files on the Bitquery Data Store, as the Ethereum, Bitcoin, TRON, Solana and XRP Ledger datasets.

12 · The recordThe addresses behind the Binance hack

FAQ

How much was stolen in the Binance hack?

About $6.3 billion, at the prices of the moment it left. The coins came from 17 Binance hot wallets on nine blockchains on the evening of 29 October, in under four hours. Binance's own estimate is about the same.

How did the Binance hack happen?

Binance says a hacker got into its systems through a compromised engineer's laptop and used its withdrawal service to send money out. No private key leaked, Binance says. On Ethereum, the hacker also used EIP-7702 authorizations, signed by Binance's system, to make Binance's busiest hot wallet run the hacker's code.

Is Binance safe after the hack?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and its own money. Withdrawals were paused on the night of the hack and reopened in stages three days later. Binance says deposits kept working and that it had covered about 95% of the loss. It has shared an updated proof of reserves and has promised a full report on what went wrong.

How much of the stolen crypto was frozen?

About $2.8 billion. Tether locked 1.76 billion USDT and Circle locked 823 million USDC. Tether's gold token and four smaller issuers froze about $132 million in other tokens. Binance blacklisted the hacker's wBETH, its own staked-ETH token, worth about $75 million, on the night of the hack. Smaller tokens worth about $18 million more were frozen by their issuers or moved out of the hacker's reach. Arbitrum's Security Council moved the hacker's ARB and ETH on its network into a locked wallet. Another 60 million USDT went into Aave, where Tether's freeze does not reach it. A liquidation later took 24.4 million USDT of it out of Aave to repay half the hacker's ETH loan.

Where is the stolen money now?

At 07:37 UTC on 5 November, the hacker held about $3.2 billion, mostly BTC and ETH. The biggest wallets have never sent a transaction. The XRP moved to seven new accounts on 2 November. On the afternoon of 5 November, after our read, the hacker began swapping the XRP through THORChain, mostly for Bitcoin. Since THORChain reopened on 3 November, the hacker has moved all but about 440 SOL and turned part of it into Bitcoin, through Circle's bridge and THORChain. On 3 and 4 November, before our read, wallets funded from the hacker's Solana wallet put about $7.7 million of SOL into Privacy Cash, a mixer on Solana. The TRX went through THORChain, the Relay bridge and swap apps, and most of what we followed came out as ETH in new wallets. Some reached a busy hub wallet, the HitBTC exchange and other swap services.

Is the Binance hack the biggest crypto hack ever?

By the figures reported so far, yes. At about $6.3 billion, it is about four times the size of the Bybit hack, the previous record at about $1.5 billion.