On 29 October 2026, between 20:04 and 23:56 UTC, an attacker drained about $6.3 billion from 17 Binance hot wallets on nine chains (Bitquery; Chainalysis puts it at about $6.4 billion). On Ethereum, signed EIP-7702 authorizations let the attacker's code run Binance's biggest hot wallet for almost four hours. Stablecoin issuers froze about $2.7 billion (Bitquery; about $2.8 billion per Chainalysis), but most of the ETH and all of the BTC can't be frozen and still sits in the attacker's wallets.

Figures

• Stolen: about $6.3B (Bitquery).
• Frozen: about $2.7B (Bitquery).
• Stolen: about $6.3 billion from 17 hot wallets on nine chains (Bitquery).
• Stolen: about $6.4 billion (Chainalysis).
• Frozen: about $2.7 billion frozen or rescued (Bitquery).
• Frozen: about $2.8 billion frozen so far (no time stated) (Chainalysis).
• Swapped before freezes: $729 million of USDT turned into ETH and TRX before the freezes landed (Bitquery).
• Swapped before freezes: $325 million of stablecoins swapped for $285 million of ETH; $175 million more sent to stopover wallets (Chainalysis).
• Still held at 06:43 UTC, 30 Oct: about $3.2 billion, mostly ETH and BTC in wallets that have never sent a transaction (Bitquery).
• Still held by the attacker: ~$3.23B, partly verified (only part of the balance could be checked against a second source).

By chain

• ethereum: about $3.77B stolen (Bitquery).
• bitcoin: about $1.48B stolen (Bitquery).
• tron: about $628M stolen (Bitquery).
• xrp: about $300M stolen (Bitquery).
• solana: about $96M stolen (Bitquery).
• arbitrum: about $32M stolen (Bitquery).
• polygon: about $10M stolen (Bitquery).
• optimism: about $4.8M stolen (Bitquery).
• base: about $2.7M stolen (Bitquery).

How it happened

Binance's early findings point to a compromised DevOps engineer's laptop, which gave the attacker access to an internal service. Binance said it found no evidence that any wallet private key leaked. (Bitquery)

On Ethereum, Binance's system signed 50 EIP-7702 authorizations, one for each upcoming transaction count so that one would match. Once one landed, Binance 14 (0x28C6c06298d514Db089934071355E5743bf21d60) ran the attacker's code for 3 hours 50 minutes. The attacker called it seven times; the main drain at 20:24:23 UTC took 167,464 ETH, 1.6 billion USDT and 62 other tokens. (Bitquery)

Other hot wallets, on Bitcoin, TRON, XRP Ledger, Solana and the rest, appear to have been emptied by ordinary signed transfers. (Chainalysis)

Binance cancelled the delegation at 00:10:35 UTC on 30 October. (Bitquery)

Who did it

Chainalysis attributes the hack to TraderTraitor, a North Korean group, because funds from it mixed on-chain with funds from last month's Bitget theft. Binance has not named anyone. Pursuit doesn't attribute: on-chain data shows which wallets, not who. (Chainalysis)

Frozen, by issuer

• Tether: 1,760,000,000 USDT. 11 freezes on Ethereum and TRON; six hit wallets that were already empty. (Bitquery)
• Circle: 823,000,000 USDC. Frozen at 21:04 UTC. (Bitquery)
• Paxos, Ripple, First Digital, Tether Gold and World Liberty: various. Six token freezes, about $132 million together. World Liberty froze WLFI, then USD1. (Bitquery)
• Arbitrum Security Council: ARB, ETH. Locked the attacker's ARB and ETH on Arbitrum. No amount stated. (Bitquery)

Timeline (UTC)

1. 2026-10-29 14:54: The attacker's gas wallet receives about 1 ETH from Tornado Cash. (Bitquery)
2. 2026-10-29 20:04: First drain, on the XRP Ledger. (Bitquery)
3. 2026-10-29 20:10: Solana drain begins. (Bitquery)
4. 2026-10-29 20:20: TRON and Bitcoin drains. EIP-7702 authorizations land on Binance 14. (Bitquery)
5. 2026-10-29 20:24: Main Ethereum drain: 167,464 ETH, 1.6 billion USDT and 62 other tokens. (Bitquery)
6. 2026-10-29 20:30: Arbitrum drain begins. (Bitquery)
7. 2026-10-29 20:57: World Liberty freezes WLFI in the main receiver. (Bitquery)
8. 2026-10-29 21:01: Tether's first freeze, on the main Ethereum receiver. (Bitquery)
9. 2026-10-29 21:04: Circle freezes 823 million USDC. (Bitquery)
10. 2026-10-29 22:33: Binance pauses withdrawals, per press reports. (Bitquery)
11. 2026-10-29 23:05: Polygon drain. (Bitquery)
12. 2026-10-29 23:56: Last Ethereum drain. (Bitquery)
13. 2026-10-30 00:10: Binance cancels the EIP-7702 authorization. (Bitquery)
14. 2026-10-30 00:18: Arbitrum Security Council locks the attacker's ARB and ETH. (Bitquery)
15. 2026-10-30 04:30: Chainalysis attributes the hack to TraderTraitor (12:30 a.m. ET). (Chainalysis)
16. 2026-10-30 06:43: Bitquery reads the attacker's wallets: about $3.2 billion still held. (Bitquery)

Attacker wallets

38 wallets on 6 chains are under live watch. The list, live balances and movement alerts load with JavaScript.

Sources

• Bitquery: Binance hack investigation (2026-10-30)
• Chainalysis: Binance exploit, latest findings and response (2026-10-30)

Pursuit doesn't attribute: on-chain data shows which wallets, not who.