Illustration: ten streams of glowing coins pour out of a vault, past a single laptop on the floor.

Illustration drawn by Antigravity · prompts at the end

Explainer · as of Friday 30 Oct 2026, evening (US Pacific)

How $6.3 billion walked out of Binance

On Thursday 29 October an attacker got Binance’s own systems to sign away crypto on ten blockchains at once: the largest theft on record. Here is what happened, minute by minute, and why the keys never left the vault.

$6.3B
taken, by Binance’s estimate
TRM Labs: $6.36B; Chainalysis: $6.4B
10
blockchains hit at once
Ethereum and Bitcoin gave up 83%
~20 min
for most of it to leave
from 20:05 UTC; last sweep 23:56
~$3B
frozen by stablecoin issuers
almost all of it USDT and USDC
4.4×
the previous record
Bybit, February 2025: $1.46B

The short version

  1. One laptop, then the signing machine. Binance traced the entry to a DevOps engineer’s compromised laptop. From there the attacker got Binance’s hot-wallet signing system to approve its transactions.
  2. No key leaked, and the money left anyway. Wallets on ten chains, with different key types, all signed for the attacker within about half an hour.
  3. Issuers froze about $3B before Binance hit pause. Tether and Circle locked stablecoins within the first hour. Bitcoin and ether can’t be frozen.
  4. North Korea’s TraderTraitor is the prime suspect. TRM Labs and Chainalysis say so. No government has yet.
  5. Binance says customers won’t pay. It will cover every loss. Withdrawals stay paused until about Sunday 1 November.

1 · The way in

It began on one engineer’s laptop

Binance’s first account, on Friday: the incident “may involve a compromised DevOps engineer’s laptop”, which let the attacker into a service container (one boxed-up piece of Binance’s internal software) and from there “submit unauthorized withdrawal transactions”.

Hours later co-CEO Richard Teng widened it. The attacker “did not simply use one engineer’s permissions”: there were more breach points, and tooling built to destroy itself. How the laptop was compromised, Binance hasn’t said.

Illustration: a laptop glowing on a desk at night, with thin threads of light leading away to distant server racks.
The entry point Binance named first: one engineer’s machine.
Image prompt

An engineer’s desk at night, seen from behind an empty chair: a laptop screen glows in an otherwise dark room. Thin, almost invisible threads of light leave the screen and run across the floor, under a door, toward rows of server racks in the far distance. Quiet, uneasy mood.

“Blaming a single laptop risks confusing the entry point with the full cause.”

Pieter Arntz, researcher at Malwarebytes, to Hackread
How North Korea’s hackers usually get onto a laptop Background
  • Fake recruiters. In 2024 a LinkedIn “recruiter” sent an employee of the Japanese wallet firm Ginco a “pre-employment test” that was malware. Weeks later the attackers used that foothold to alter a DMM Bitcoin transaction and took 4,502.9 BTC, about $308M (FBI and Japan’s National Police Agency, December 2024).
  • Poisoned developer tools. Bybit’s $1.46B loss in February 2025 began on a Safe{Wallet} developer’s computer. The attackers slipped JavaScript into Safe’s web app that changed what Bybit’s signers approved.
  • Trojanized apps. The group’s name comes from fake crypto-trading apps it sent to employees of blockchain firms (US CISA advisory AA22-108A, April 2022).
  • Malicious packages. In August 2026 North Korean actors hid malware in npm packages that fetched their instructions from the Ethereum blockchain (Hackread).
  • Two days earlier. On 27 October Binance said it had blocked several North Korea-linked intrusion attempts the week before. Nothing public ties them to this breach (Cointegrity).

2 · The mechanism

The keys stayed put. The signing machine was hijacked.

Exchanges keep most coins offline, plus a working float in hot wallets whose keys live inside an automated signer: an internal service asks, the signer checks the request and signs. Binance says it found “no evidence of any wallet private key leak”. That is what makes this hack unusual.

Wallets on ten chains, with different key types and signing schemes, all produced valid signatures for the attacker within about half an hour. TRM Labs’ reading: the attacker could make Binance’s signing system sign “transactions of its choosing across chains”.

Follow the attack, step by step

  1. A DevOps engineer’s laptop. DevOps engineers build and run the internal systems that move money. Binance says this laptop was compromised. How, it hasn’t said.

    Binance says

  2. A service container. From the laptop the attacker reached an internal app running in its own sandbox, and submitted withdrawal requests as if it were a legitimate Binance service.

    Binance says

  3. The signer said yes. No key was copied; the attacker controlled what got signed. How its requests got past the signer’s checks is the open question Binance’s post-mortem has to answer.

    Analysts’ inference: TRM Labs, Blockaid

  4. Hot wallets on ten chains. The XRP Ledger went first at 20:05 UTC, then Solana, Optimism, Bitcoin, Ethereum, Tron, Arbitrum, Avalanche, Polygon and Base. On Ethereum, one big wallet was turned into attacker-controlled code (EIP-7702, in the deep dive below).

    On-chain record

  5. Attacker wallets. About $6.36B arrives, most of it within 20 minutes. Stablecoins are dumped or borrowed against at once; the bitcoin is split into 19 wallets and left alone.

    On-chain record

  6. The freeze. Tether, Circle, Ripple, World Liberty Financial and Arbitrum’s Security Council lock about $2.7B by 00:30 UTC Friday, about $3B by Friday evening. Bitcoin and ether can’t be frozen.

    On-chain record
Illustration: a sealing machine stamps envelopes on a conveyor while a shadowy hand slips extra envelopes onto the belt; the key safe behind it stays locked.
The keys never left the safe. The machine that uses them signed whatever it was fed.
Image prompt

Inside a vast server hall, a giant brass machine presses glowing wax seals onto an endless conveyor belt of envelopes. Behind it, a heavy safe holding keys stays shut and untouched. The shadow of a hand slides extra envelopes onto the belt, and the machine seals those too.

Ethereum and Bitcoin wallets gave up 83% of it

Ethereum$3.79B
Bitcoin$1.47B
Tron$628M
XRP Ledger$296M
Solana$96M
Arbitrum, Optimism, Base$39M
Avalanche$28M
Polygon$10M

Value when taken, by chain. TRM Labs, as of 00:30 UTC Friday; it reports Arbitrum, Optimism and Base together.

Hot wallets, cold wallets and the signer Background
  • Cold wallets keep their keys offline. Moving money out of them takes people and a ceremony, so most of an exchange’s coins sit there.
  • Hot wallets hold the float that pays customer withdrawals around the clock. Their keys have to sign without a human, inside a signing service (often hardware security modules or multi-party computation).
  • The signer is a machine built to say yes. It signs whatever arrives through the approved request path, after automated checks: limits, allow-lists, policy rules. Capture that path, and the keys work for you without ever being copied.
  • Binance holds roughly $150B for customers (estimates run from $144B to $155B), so the stolen $6.3B is about 4% of it.
Why “no key leak” isn’t reassuring Technical
  • A stolen key opens one wallet. Here wallets using two signature algorithms (secp256k1 ECDSA and Ed25519) and separate key stores all signed for the attacker within about 30 minutes: 17 hot wallets in all, by Bitquery’s count. One captured request path explains that; seventeen stolen keys would not.
  • The 50 pre-signed Ethereum authorizations point the same way. Someone holding the key would sign once, at the right moment. TRM reads the batch as a sign that the access was time-limited, or that signatures had to be requested through a system.
  • Not everyone agrees. Mark Karpelès, the former Mt. Gox chief, thinks the attackers probably reached the keys of at least two wallets, and SlowMist’s security chief keeps key theft open. The chain records what was signed, never who asked.
EIP-7702: one transaction, $2.5 billion Technical · try it
  • What it is. Since Ethereum’s Pectra upgrade (May 2025), an ordinary wallet can sign an authorization that makes it run a smart contract’s code. It stays that way until the wallet signs another one.
  • The move. At 20:20:59 UTC the attacker sent one transaction carrying 50 authorizations, all signed with the key of “Binance 14”, a large Binance hot wallet. Each pointed the wallet at the attacker’s sweeper contract, which only the attacker could call.
  • Why 50. Every authorization names the wallet’s nonce, its running transaction count. Binance 14 was still paying customers, so the count kept moving and the attacker couldn’t know its value when the transaction landed. It signed a window of 50 guesses, nonces 18,914,775 to 18,914,824. “One matched, which was all the attacker needed” (TRM).

Try it: drag to set where Binance 14’s nonce stood when the transaction arrived.

Live nonce 18,914,798: guess 24 of 50 matches.

Illustrative: which of the 50 guesses matched hasn’t been published.

  • The sweep. At 20:24:23, 3 min 24 s later, one call to the sweeper moved 167,464 ETH, 1.615B USDT and about 60 other tokens, roughly $2.5B. Binance 14 was left with 1 ETH (Blockaid).
  • “Nothing in Ethereum failed” (Cointegrity). The protocol executed valid signatures exactly as specified. Blockaid says its detector flagged the delegation as malicious on sight; it sat on-chain for 3 min 24 s before the sweep.
The wallet that kept refilling itself Technical
  • The delegation belonged to the address, not the key. Binance’s deposit system kept consolidating customer deposits into Binance 14, and the attacker swept it again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC. At 21:44 alone it took 200M USDT and 13 other tokens.
  • Inherited rights. Binance 14 owned a Circle smart account, “Binance Hot Wallet 34”. Code running at Binance 14 could use that right too: at 20:41 it pulled out 823M USDC. Circle froze it at 21:04.
  • Rotating keys doesn’t clear it. Only a new authorization from the same wallet, pointing at the zero address, does. Binance sent one at about 00:10 UTC, four hours after the first outflow.

3 · Timeline

Four hours, minute by minute

Times are UTC, with your own clock beside them. Gold is the attacker, blue is whoever froze funds, black is Binance. ★ marks the key moments.

  1. Staging · Wed 28 – Thu 29 Oct
  2. Wed morning
    Three small Tornado Cash withdrawals fund the attacker’s operator wallet. TRM
  3. Thu, early
    Rehearsals. The attack code is tested on the attacker’s own wallets, moving $2–6 at a time. TRM, Blockaid
  4. The final “sweeper” contract is deployed. Only the attacker can call it. Blockaid
  5. The burst · Thu 29 Oct
  6. First outflow: the XRP Ledger. Five Binance wallets send 233.46M XRP (about $296M) to one address. It hasn’t moved since. TRM
  7. Solana and Optimism wallets follow. TRM
  8. The Bitcoin hot wallet sends 18,270 BTC (about $1.47B), split into round pieces in the same block. TRM
  9. 50 pre-signed authorizations hit “Binance 14”. One matches, and the wallet now runs the attacker’s code. Blockaid
  10. Tron hot wallet sends 612.7M USDT and 46.4M TRX. TRM
  11. The sweep: about $2.5B in one call. 167,464 ETH, 1.615B USDT and some 60 tokens. Binance 14 is left with 1 ETH. Blockaid
  12. Eleven hot-wallet keys in 12 minutes. Binance wallets on Ethereum, Optimism, Arbitrum and Avalanche sign ordinary transfers to the attacker. Blockaid
  13. 823M USDC pulled from a second account that Binance 14 controlled. Blockaid
  14. The freeze race · Thu 29 Oct
  15. Borrowing on Aave. 60M USDT goes in as collateral, about 19,760 ETH comes out. TRM, Cointegrity
  16. Tether freezes 971.1M USDT in the main receiving wallet, 37 minutes after the sweep. TRM
  17. Circle freezes 823M USDC, “in coordination with law enforcement”. TRM
  18. 48M RLUSD sold on decentralized exchanges over 19 minutes. TRM
  19. Binance 14 is swept again: 200M USDT and 13 tokens that customers deposited since. Blockaid
  20. Ripple freezes the RLUSD wallet, with 40.5M still inside. TRM
  21. World Liberty Financial freezes 27.8M USD1, and at 22:26 the USD1 inside Binance 14. TRM
  22. Binance suspends withdrawals, about 86 minutes after Tether’s first freeze. Founder Changpeng Zhao says the exchange appears to have been hacked. Cointegrity, Al Jazeera
  23. Second wave: Binance wallets on Avalanche and Polygon. TRM
  24. Binance: verified frozen total reaches $2.54B. TRM
  25. Last sweep of the refilled Binance 14, 3 h 51 min after the first outflow. TRM
  26. Aftermath · Fri 30 Oct
  27. Arbitrum’s Security Council uses emergency powers to move about $30M (8,426 ETH and 74.6M ARB) out of an attacker wallet. TRM
  28. Binance revokes the Ethereum delegation, after every outside responder with a published time had already acted. Cointegrity
  29. TRM tallies about $2.7B frozen. TRM
  30. After hops through THORChain, Binance proceeds land in the same wallet as funds from September’s Bitget theft. Cointegrity, ZachXBT
  31. Elliptic verifies $2.84B frozen, 94% of it USDT and USDC. Cointegrity
  32. Friday
    Binance: about $6.3B affected, about $3B frozen. It names a DevOps engineer’s laptop, finds no key leak, and will cover all losses. Co-CEO Richard Teng adds “a more complex attack process”. CNBC, Gizmodo
  33. Friday
    Co-CEO Yi He: withdrawals should resume within 48 hours. Deposits are working again. CNBC, Yahoo Finance
  34. Next
  35. Sun 1 Nov
    Target for withdrawals to restart. An updated proof of reserves is reported for Monday. Yahoo Finance, Cointegrity
Who moved first

Tether froze the main receiving wallet at 21:01 UTC, about 86 minutes before Binance suspended withdrawals. Containment came from the stablecoin issuers, ahead of the victim.

4 · The freeze race

Issuers froze about $3 billion. Bitcoin and ether got away.

Almost half of the $6.3B is frozen

Binance’s figures, Friday. Elliptic puts the frozen share at about 44%, nearly all of it stablecoins.

A stablecoin is a token with a company behind it, and the company can freeze it. Tether and Circle locked the bulk within the first hour; Ripple, World Liberty Financial and Arbitrum’s Security Council followed. Nothing on Bitcoin, the XRP Ledger or Solana could be frozen, because nobody can freeze them.

Tether and Circle did almost all of the freezing

Tether USDT$1.77B
Circle USDC$825M
Ripple RLUSD$40.5M
Arbitrum Security Council ETH, ARB~$30M
World Liberty Financial USD1$27.8M

Frozen by 00:30 UTC Friday, about $2.7B in all. TRM Labs.

18,270 bitcoin sit in 19 wallets, untouched

Each square is one wallet; a full square holds 1,000 BTC. About $1.4B at Friday’s prices, unspent since 20:48 UTC Thursday. Elliptic, Cointegrity.

Illustration: a river of coins splits; one branch freezes into blue ice, the other keeps flowing away.
Coins with an issuer froze. Coins without one kept moving.
Image prompt

A wide river of glowing coins splits around a dark rock. On the left branch the coins freeze mid-flow into pale blue ice crystals and stop. On the right branch gold and orange coins keep rushing away into the darkness, out of reach.

“The attackers knew that route would be closed to them.”

Joe Hancock, head of cyber risk at Mishcon de Reya, to CNBC
Why a stablecoin can be frozen and bitcoin can’t Background
  • A stablecoin is a contract its issuer controls. Tether’s USDT contract has a blacklist and a function that destroys a blacklisted address’s tokens; Circle’s USDC has a blacklist too.
  • Frozen is not returned. Law enforcement gets a court order or seizure warrant, then the issuer burns the frozen tokens and reissues them to the rightful owner. “Tether and Circle can freeze, burn and reissue” (Ari Redbord, TRM Labs).
  • Bitcoin, ether, XRP and SOL have no issuer. They can be traced on the public ledger, and stopped only when they reach an exchange or service that cooperates.
  • Speed. A freeze takes minutes; getting money back “can take months or years” (Eric Jardine, Chainalysis).
How the attacker outran the freeze Technical
  • Dump stablecoins at a loss. About 325M USDT went to market makers through UniswapX and other intent-based contracts, for about 122,300 ETH: more than 10% below market (TRM). Elliptic counts $786M of stablecoins converted in all, at 12–26% below market.
  • Borrow instead of sell. One wallet deposited 60M USDT on Aave and borrowed about 19,760 ETH against it. The freezable coins stayed behind as collateral; the unfreezable ether left. Aave then froze the affected markets.
  • Tron. 300M USDT went into the JustLend lending protocol (TRM), and 234M USDT became 638M TRX on SunSwap (Elliptic).
  • The result. The attacker now holds more than 420,000 ETH, twice the 200,630 ETH it took, plus 18,270 BTC: about $2.4B beyond any issuer’s reach (TRM).

5 · Laundering

Laundering, run by script

Within hours Chainalysis saw “laundering patterns we have not seen before”: thousands of transactions in short bursts, funds circling among linked addresses and returning to wallets used earlier. On Tron, thousands of fresh addresses each received exactly 1 TRX before joining the flow, the fingerprint of automation.

As of Friday nobody had confirmed a cash-out at an exchange, a mixer deposit or an over-the-counter hand-off. Investigators expect bridges, swap services and OTC brokers next, increasingly Chinese money-laundering networks that buy stolen crypto for a fee.

Illustration: a vast glowing maze of nodes with light looping through it, swept by two flashlight beams.
Funds looping back on themselves, by the thousand, to bury the trail.
Image prompt

An enormous maze seen from directly above, built from thousands of tiny glowing nodes joined by thin lines. Streams of light race through it and loop back on themselves again and again. Two narrow flashlight beams from the edge of the frame sweep across the pattern.

“As you get further and further away, the amount of seizure opportunities go down.”

Jonathan Levin, co-founder and CEO of Chainalysis, to CNBC
The Bitget link, and why it’s weaker than it looks Analysis
  • The overlap. At 04:02 UTC Friday, after hops through THORChain, Binance proceeds landed in the same wallet as funds from Bitget’s September theft ($351M–388M). ZachXBT: “the same actor is likely behind both incidents”.
  • The caution. The shared amounts are tiny: about $39,000 of Binance-linked funds next to about $510,000 of Bitget-linked funds (Cointegrity). A shared address proves a shared laundering service, and professional launderers sell to many clients.

6 · Who

Prime suspect: North Korea’s TraderTraitor

WhoNamesHow sure
TRM LabsTraderTraitor (North Korea) “High confidence”
ChainalysisTraderTraitor “Likely”
EllipticNorth Korea Likely, not yet certain
ZachXBTLazarus Group, same actor as Bitget Likely
Any governmentNo one yet FBI is “aware”, working with partners
BinanceNo one yet Working with law enforcement

TRM points to tradecraft from the Bybit and KelpDAO heists: an operator wallet funded through Tornado Cash, a day and a half of staging, and signatures collected in advance and fired in one burst.

“When North Korea steals at this scale, the money funds weapons proliferation.”

Ari Redbord, global head of policy at TRM Labs, to Al Jazeera
Who is TraderTraitor? Background
  • A North Korean state unit under the Lazarus Group umbrella, also tracked as Jade Sleet, Slow Pisces and UNC4899. It goes after exchanges and crypto firms through their people: recruiters, coding tests, poisoned tools.
  • Its record. Bybit, February 2025, $1.46B (the FBI named the group within five days). DMM Bitcoin, May 2024, $308M.
  • The scale. North Korea took about $2B in crypto in 2025 and $6.75B from 2016 through 2025, by Chainalysis’ count. If this attribution holds, one evening nearly matched a decade.
  • North Korea denies the accusations and calls them US propaganda.
Reasons for caution about the attribution Analysis
  • No government has spoken. There is no FBI notice, OFAC designation or South Korean statement yet.
  • The laundering looks different. Market makers and lending protocols instead of Bybit’s bridges (TRM’s own observation), and slower: more than $2.6B of stablecoins was still in attacker wallets when the issuers froze it.
  • Some links are thin. The Bybit match is asserted rather than shown in public, and the Bitget overlap is small (section 5).
  • What would settle it: an FBI public notice, an OFAC designation of the attacker’s addresses, or address-level overlap published by a forensic firm. Until then, touching these funds is a stolen-property risk; after that, a sanctions risk (Cointegrity).

7 · The record

Four times the old record, and more than all of 2025

Binance Oct 2026$6.36B
Every crypto hack of 2025 about 150 of them, combined$2.87B
Bybit Feb 2025$1.46B
Ronin bridge Mar 2022$625M
Poly Network Aug 2021, mostly returned$611M
BNB Chain bridge Oct 2022, also Binance~$570M
Coincheck Jan 2018$534M

Value at the time of each theft. TRM Labs for Binance and the 2025 total; earlier thefts as widely reported.

It also lands a month after Bitget lost $351M and six months after KelpDAO lost $290M, both blamed on North Korea.

8 · Who pays

Binance says customers won’t pay

Binance pledged to “cover all losses”, first from SAFU, the Secure Asset Fund for Users it set up in 2018, then from its own balance sheet. It has set aside $6.34B of company funds while the freezes are worked out.

How the $6.3B gets covered

  • ≈$3.0B frozen, if the issuers burn and reissue it to Binance
  • ≈$1.2B from SAFU (Fundstrat’s estimate of the fund’s size)
  • ≈$2.1B from Binance’s own funds, against roughly $150B it holds for customers

“Bottom line – your money is safe, and we’re covering every loss.”

Richard Teng, co-CEO of Binance

Analysts don’t see a solvency problem. Fundstrat’s Sean Farrell: “it does not currently appear to be a solvency event for Binance.” The net hit is likely smaller than the $4.3B Binance paid US authorities in its 2023 settlement (Gizmodo).

Bitcoin
−4–5%
to below $78K Friday
Ether
−4%
to about $2,200
BNB
−6%
Binance’s own coin
Crypto stocks
down
Circle, Coinbase, Robinhood, Strategy

Market moves on Friday from CNBC, Yahoo Finance and Al Jazeera; Bitcoin’s fall reversed a 9% rally earlier in the week.

What is SAFU, and has it paid out before? Background
  • Since July 2018 Binance has kept an emergency fund for hacks, first fed with a share of trading fees.
  • Its first use: in May 2019 hackers took 7,000 BTC (about $41M) from a Binance hot wallet. Binance covered it in full and reopened withdrawals about a week later.
  • Its size now is about $1.2B by Fundstrat’s estimate, enough for roughly a third of what isn’t frozen.

9 · What’s next

What to watch next

  • Sun 1 NovWithdrawals. Yi He says within 48 hours; Teng says the rebuilt service stays off until it “passes rigorous testing”.
  • Mon 2 NovProof of reserves. Binance promised an update after remediation; it is reported due Monday.
  • SoonThe post-mortem: how a laptop reached the signer, the other breach points, and which controls failed.
  • Any dayA government attribution. An FBI notice or OFAC designation would turn these funds into a sanctions problem for anyone who touches them.
  • Any dayThe 18,270 BTC. Parked since Thursday 20:48 UTC. When it moves, expect bridges, swap services and OTC desks.
  • Weeks–monthsBurn and reissue. Tether, Circle and others returning frozen value to Binance, after court orders.
  • PolicyRegulation. CFTC chairman Michael Selig called it proof for his agency’s 5 October plan to bring exchanges under federal oversight: “these are unregulated offshore exchanges”.

“Any assets held at a centralised exchange are only as safe as the exchange itself.”

Sean Foley, crypto markets researcher at Macquarie University, to Al Jazeera
What would have stopped it Lessons
  • Give the signer judgment. Refuse message types a hot wallet has no business signing: an EIP-7702 authorization, a token approval, a contract upgrade.
  • Split the authority. A separate policy engine per chain and wallet tier, so one captured service can’t speak for wallets on ten chains.
  • Watch the whole pattern. Velocity limits measured across chains; no single-wallet limit sees a theft like this.
  • Pre-sign the undo. A tested revocation for every hot address, so the fix takes one block instead of four hours.
  • Know what each address can touch. Alert when code appears where none should be, and map what each hot address is trusted with elsewhere: Binance 14 owned a USDC account.

Drawn from Cointegrity’s preliminary analysis and Blockaid’s write-up.

About the illustrations

The five pictures were drawn by Google’s Antigravity (its agy command-line agent and Gemini image model) from the prompts printed under each one, on Friday 30 October. They are illustrations, not photographs of anything real. Every prompt ends with the same style line:

Editorial illustration for a news explainer. Deep navy and warm gold palette with small touches of ice blue, soft grain, clean shapes, cinematic lighting. Wide 16:9 landscape composition. No text, no letters, no numbers, no logos, no brand marks, no recognizable people, no flags.

Image prompt for the top picture

A colossal vault door stands ajar in the dark. From a small hatch at its base, ten luminous rivers of coins pour out, each bending away toward a different horizon like light trails on a night highway. A single small laptop glows on the floor beside the hatch, its light reaching up the door.

Sources 17
  1. TRM Labs: North Korea steals USD 6.36 billion from Binance in the largest hack in history (29–30 Oct)
  2. Blockaid: Binance $6.3B hack, reconstruction of the Ethereum leg (29 Oct)
  3. Cointegrity: The Binance hack of 29 October 2026, preliminary analysis (30 Oct)
  4. CNBC: Binance’s $6.3 billion hack, what we know and what comes next (Jenny Lee)
  5. CNBC: Investigators in a “cat and mouse game” to recover $6.3 billion (Arjun Kharpal)
  6. CNBC: $6.3 billion Binance hack is largest crypto theft on record
  7. Gizmodo: How hackers stole $6.3 billion from Binance in minutes (Kyle Torpey)
  8. SecurityWeek: $6 billion Binance hack bears hallmarks of North Korea’s TraderTraitor (Eduard Kovacs)
  9. TechCrunch: North Korean hackers blamed for stealing record $6.3B (Zack Whittaker)
  10. CryptoSlate: never-seen-before laundering tactics (Oluwapelumi Adejumo)
  11. Hackread: Binance probes DevOps engineer’s hacked laptop
  12. Yahoo Finance: withdrawals suspended after “complex attack” (Ines Ferré, David Hollerith)
  13. Al Jazeera: Binance says $6.3bn stolen in biggest crypto heist in history (John Power)
  14. Latin Times: what TraderTraitor stole, what was frozen (Mateo Moreno)
  15. CISA advisory AA22-108A: TraderTraitor targets blockchain companies (April 2022)
  16. FBI: North Korea responsible for the $1.5 billion Bybit hack (26 Feb 2025)
  17. EIP-7702: set code for EOAs (Ethereum)

Bloomberg, The Washington Post and Axios also covered the story; their pages were paywalled and not read. Figures differ between firms (Binance $6.3B, TRM $6.36B, Chainalysis $6.4B); this page names the source wherever they disagree. Times marked “~” are reconstructed by the analysts cited.