Reported Nov 4, 20264h ago
Emergency THORChain pause temporarily slows Binance theft laundering
Chainalysis reported that an emergency THORChain pause triggered by an unrelated technical issue temporarily slowed laundering of funds stolen from Binance.
Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist - SecurityWeekNov 4, 202614h ago
North Korea launches missiles hours after rejecting Binance hacking allegations
South Korea's Joint Chiefs of Staff reported that North Korea launched several missiles toward its eastern waters on November 4, hours after Pyongyang rejected the Binance hacking allegations. South Korean and U.S. authorities were analyzing the launches; the report did not establish that the allegations caused them.
North Korea Launches Missiles Toward the Sea as Pyongyang Protests Against US Claims on Binance Hack - SecurityWeekReported Nov 3, 202618h ago
Binance reveals pyenv backdoor used in recruitment compromise
Binance disclosed that a malicious recruitment coding assignment installed previously unseen malware that replaced the legitimate pyenv executable in the macOS Homebrew directory and enabled commands from an attacker-controlled server. The malware evaded antivirus and endpoint protection tools at the time of installation.
Binance says fake job interview led to $6.3 billion crypto heistReported Nov 3, 202622h ago
Binance post-mortem details months-long intrusion and security overhaul
Binance said the campaign began with malicious developer software in June 2026, followed by a recruitment-related compromise in September and lateral movement to two additional devices by October 20. It reported replacing compromised devices and wallets, decommissioning exposed credentials, strengthening security controls and hiring an external firm to review the incident.
Binance CEO says ‘months-long campaign’ led to $6.3 billion theft as N. Korea denies responsibility | The Record from Recorded Future NewsReported Nov 3, 202622h ago
Binance reports replacing 98% of impacted tokens
Binance said it had replaced 98% of impacted tokens by October 31 and would absorb the loss. This represents replacement of customer assets, not recovery of funds controlled by the attackers.
North Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance HeistReported Nov 3, 202623h ago
Binance identifies fake job interview as entry point to $6.34 billion hack
Binance said a fake job interview opened the path to the $6.34 billion hack. The report also states that attackers used an internal AI tool to reach wallet engineers, but the supplied excerpt does not name the tool or explain the technical exploitation sequence.
Fake Job Interview Opened Path to $6.34 Billion Hack, Binance Says | The DefiantReported Nov 3, 20261d ago
Report reveals Binance lacks cyber insurance for $6.3 billion theft
Bloomberg Law reportedly disclosed that Binance lacks cyber insurance for the approximately $6.3 billion theft. Binance says it is using company funds, including emergency and futures reserves, to replace stolen assets.
Binance Lacks Cyber Insurance for $6.3 Billion Hack, Bloomberg Law Reports | The DefiantNov 3, 20262d ago
THORChain resumes most swaps after outage that slowed Binance theft laundering
THORChain node data showed swaps resumed on Bitcoin Cash, Dogecoin, Litecoin, Zcash, Bitcoin, Ethereum and Tron on November 3 following the reorg-triggered halt that had impeded laundering of stolen Binance funds. BNB Smart Chain remained halted at 3:50 p.m. ET, alongside Cosmos Hub and Solana, which had been halted before the reorg.
THORChain Restarts Most Swaps After Analyst Said Operators Would Expect North Korea to Launder - UnchainedNov 3, 20262d ago
Binance reopens withdrawals for additional assets
Binance reopened withdrawals for additional assets on Tuesday, expanding its post-theft restoration of services. In a Tuesday statement, the exchange also reported that hourly deposits were exceeding withdrawals.
teiss - News - Binance says outflows normalised as North Korea rejects US allegation over heistReported Nov 2, 20262d ago
North Korea rejects FBI attribution of Binance theft
North Korea rejected the FBI's attribution of the reported $6.3 billion Binance theft to North Korea. Kim Yo Jong called the US accusation “absurd rhetoric.”
North Korea Rejects FBI Blame for $6.3 Billion Binance Hack | The DefiantReported Nov 2, 20262d ago
Relay reports bridge-route disruptions while blocking Binance theft funds
Relay reported disruptions to its bridge routes during efforts to block funds linked to the Binance theft. It said it was working with Binance and law enforcement to screen hacker-linked addresses and that users did not need to take any action.
Relay Reports Route Disruptions in Bid to Block Binance-Hack Funds | The DefiantReported Nov 2, 20262d ago
Binance reports net customer outflows rising to $4.72 billion
Binance said customers had withdrawn a net $4.72 billion since withdrawals reopened, equivalent to approximately 2.8% of platform assets. A spokesperson separately reported $2.7 billion in inflows and said withdrawal volumes were declining and stabilizing after an initial spike.
Binance says customers pulled net $4.7 billion after hack - Business InsuranceReported Nov 2, 20262d ago
Binance co-founder rejects employee-related North Korean spy rumor
Binance co-founder Yi He denied a circulating claim that a compromised DevOps engineer had a romantic relationship with a North Korean spy and left a laptop unattended. The report said the rumor was falsely attributed to blockchain analyst ZachXBT.
ФБР: Binance взломали северокорейские хакеры - ХакерReported Nov 2, 20262d ago
Bitget cites North Korean indicators in separate $387.5 million theft
Bitget said the separate attack that drained $387.5 million from its wallets exhibited characteristics of a North Korean operation. Its CEO cited IP behavioral patterns and on-chain signatures as supporting indicators, without establishing a definitive attribution.
FBI pins $6.3B Binance crypto heist on North Korean hackersReported Nov 2, 20262d ago
Elliptic flags first Bitcoin mixing of Binance theft proceeds
Elliptic reported the first Bitcoin mixing of proceeds linked to the Binance theft. Its analysis traced approximately 12,000 wallets across 11 blockchains and estimated remaining hack-linked balances at $3.24 billion.
Elliptic Flags First Bitcoin Mixing of Binance Hack Proceeds | The DefiantReported Nov 2, 20262d ago
Elliptic reveals bridge-rejection evasion in Binance laundering
Elliptic reported that when a cross-chain bridge refused deposits, the Binance theft laundering operation rerouted funds to the same destination through newly created wallets. Its analysis also found that a principal TRON distribution wallet made hourly payouts around the clock for more than a day.
FBI Flags Over 600 Addresses Tied to North Korea's Binance Heist - SecurityWeekReported Nov 2, 20262d ago
Binance-linked attacker splits $292 million in XRP across six wallets
An attacker linked to the Binance theft split $292 million in XRP across six recipient wallets. None of the six wallets showed outgoing payments at the time described.
Binance Attacker Splits $292 Million in XRP Across Six Wallets | The DefiantNov 2, 20263d ago
Binance completes proof-of-reserves check for its ten largest assets
Binance reportedly completed a proof-of-reserves check on November 2 covering BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The check was intended to allow customers to verify the backing of their funds following the theft.
Binance возобновила вывод еще 51 токена в сетях Ethereum и Solana после взлома на $6,3 млрд - ХакерNov 2, 20263d ago
Binance expands fiat withdrawals to 28 currencies
Binance added withdrawal support for the US dollar, UAE dirham, Vietnamese dong, Philippine peso and Indonesian rupiah, bringing the number of withdrawable fiat currencies to 28.
FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users - Help Net SecurityNov 2, 20263d ago
Circle reports more than $1.1 billion in USDC frozen after Binance theft
Circle said on Monday that it had frozen more than $1.1 billion in USDC linked to the Binance theft. The statement increased the reported total of immobilized USDC; it did not establish that those funds had been recovered.
teiss - News - Binance says exit rush slowing down as users weigh security riskReported Nov 1, 20263d ago
THORChain co-founder responds to FBI appeal over Binance theft
A THORChain co-founder cited public data in response to the FBI's Binance-related blocking appeal, which explicitly named THORNode operators. THORChain's controls permit broad trading halts, but those would also interrupt other users.
THORChain Co-Founder Cites Public Data After FBI Binance Blocking Appeal | The DefiantReported Nov 1, 20263d ago
FBI publishes 628 cryptocurrency addresses associated with the Binance theft
The FBI published 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address associated with the Binance theft. The FBI, Secret Service and IRS Criminal Investigation asked cryptocurrency service providers to block transactions linked to the attackers' laundering addresses.
FBI links $6.3 billion Binance crypto heist to North Korean hackersReported Nov 1, 20263d ago
SomaXBT traces $140 million in Binance loot through four TRON exit routes
Analyst SomaXBT traced $140 million in stolen Binance assets through four exit routes on TRON, focusing on assets that remained unfrozen. The supplied excerpt does not identify the four routes.
Analyst Traces $140 Million in Binance Loot Through Four Tron Exit Routes | The DefiantReported Nov 1, 20263d ago
Binance attacker-linked Solana wallet reportedly begins moving funds to a new wallet
A social-media report stated that a Solana wallet linked to the Binance attacker had begun moving funds to a new Solana wallet. The post linked to Solscan account 7SDuVQ2SkaHBURbxzyXAr8coNcLV2ZuSLkteoRYfQ2fK but did not specify the amount transferred.
AndreGironda: RT @banthisguy9349: The sol wallet from the Binance hacker has begun moving funds towards a new sol wallet.
https://t.c...Reported Nov 1, 20263d ago
Chainalysis traces $500 million TRON laundering operation reaching Solana
Chainalysis reported that Binance hack-linked launderers moved $500 million through a TRON operation involving more than 1,000 addresses and over 3,000 deposits. The funds subsequently dispersed across blockchains, with the report identifying Solana as a destination.
Binance-Hack Launderers Reach Solana After Draining $500 Million on Tron, Chainalysis Says | The DefiantReported Nov 1, 20263d ago
Blog alleges recruitment lure and Kubernetes access enabled Binance intrusion
A blog account alleged that a fraudulent recruitment assessment compromised a Binance DevOps engineer’s workstation, enabling session-token theft, access to production Kubernetes and injection of unauthorized transactions into signing queues. The supplied material does not independently substantiate this intrusion chain, and Binance’s previously reported findings left the complete entry mechanism unresolved.
The $6.36 Billion Binance Cyber Heist: Inside th | ShellcodeReported Nov 1, 20263d ago
Binance begins reopening withdrawals, starting with Bitcoin
Binance began reopening withdrawals with Bitcoin following the reported $6.3 billion theft. This marked an actual resumption of withdrawals after the incident-related suspension.
Binance Begins Reopening Withdrawals With Bitcoin After $6.3 Billion Hack | The DefiantReported Nov 1, 20263d ago
Binance reports replacing 95% of stolen tokens
Binance reportedly said it had covered 95% of the stolen tokens, with the remaining assets less liquid and harder to source. Replacing customer assets does not establish recovery of funds controlled by the attackers.
FBI Confirms North Korean Hackers Responsible for $6 Billion+ Binance Attack | Cryptika CybersecurityNov 1, 20264d ago
Binance reports $3.64 billion in net outflows after withdrawals reopen
Binance reported $4.65 billion in withdrawals and $1.01 billion in deposits between 1 a.m. and 10:30 a.m. ET on November 1, producing $3.64 billion in net outflows, or 2.1% of its reported assets. The exchange said withdrawal volumes were stabilizing after an initial spike and cautioned that some transfers were internal wallet movements.
Binance Sees $3.64 Billion in Net Outflows After Reopening WReported Oct 31, 20264d ago
FBI attributes Binance theft to North Korea’s TraderTraitor
The FBI attributed the theft of more than $6 billion from Binance to North Korea’s TraderTraitor. The bureau also sought blocks along the laundering trail associated with the stolen funds.
FBI Attributes $6 Billion-Plus Binance Hack to North Korea | The DefiantReported Oct 31, 20264d ago
Binance confirms 7,499 BTC SAFU transfer and reports 90% replenishment
Binance confirmed a 7,499 BTC transfer involving its SAFU fund and reported that it had replenished 90% of the amount lost in the hack. The exchange also pledged to rebuild its emergency fund to approximately $1 billion.
Binance Confirms 7,499 BTC SAFU Transfer After Hack | The DefiantReported Oct 31, 20264d ago
Origin restores OGN liquidity after withdrawing funds during Binance incident
Origin withdrew 46.74 million OGN from the token’s Curve pool during the Binance incident, with Ethereum records subsequently showing liquidity returning. Origin also reported that the attacker sold OGN at an average discount of 79%.
Origin Restores OGN Liquidity After Pulling Funds During Binance Incident | The DefiantReported Oct 31, 20264d ago
Chainalysis flags a DeFi receipt-token route linked to the Binance hack
The report’s headline states that Chainalysis flagged a DeFi receipt-token route connected to the Binance hack. Its excerpt describes a separate JustLend deposit, jUSDT transfer and redemption, but does not establish that this example involved stolen Binance funds.
Chainalysis Flags DeFi Receipt-Token Route in Binance Hack | The DefiantOct 31, 20265d ago
Trump questions certainty of North Korean involvement in Binance theft
President Donald Trump said North Korea's involvement in the Binance theft was not yet certain. His remarks contrasted with the FBI's reported attribution of the attack to the North Korean group TraderTraitor.
Binance Resumes Transactions Following Crypto Heist That Stole $6B From the Platform Last WeekOct 31, 20265d ago
Binance attacker creates TRON token to launder proceeds through a liquidity pool
On October 31, a Binance theft-linked address created a mint-controlled TRON token paired with a lending receipt token in a liquidity pool. Theft-funded buyer wallets supplied value through purchases, while separate seller wallets received freely minted tokens, sold them into the pool and redeemed the proceeds for USDT, avoiding direct transfers between buyers and sellers.
Binance Hack Update: North Korea Launders Proceeds Through Self-Minted Tokens and Chained Bridges | TRM LabsOct 31, 20265d ago
Attacker routes 128 million TRX through JustLend to 16 new addresses
Beginning at 05:18 UTC on October 31, an attacker-linked address deposited 128 million TRX into a JustLend vault and withdrew funds to 16 new addresses. The vault transfers avoided direct address-to-address transfers linking the depositing and receiving wallets.
How North Korea is laundering the $6.4 billion stolen from Binance | EllipticReported Oct 30, 20265d ago
Flare reveals historical stealer logs containing Binance-domain usernames
Flare analyzed 219 historical infostealer logs containing 74 distinct @binance.com username strings, including records associated with authentication, development and monitoring services. Credential validity, employee ownership and successful access remained unverified, and researchers found no evidence connecting the records to the newly disclosed Binance theft.
Beyond the Binance Attack: Stealer Log Analysis - FlareReported Oct 30, 20265d ago
TRM attributes the theft to TraderTraitor and identifies likely signing-system abuse
TRM attributed the Binance attack with high confidence to North Korea’s TraderTraitor using on-chain and off-chain intelligence. It assessed that valid signatures across different blockchains pointed to compromised hot-wallet signing capabilities, while Binance had not published a definitive root cause or named an attacker.
North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026 | TRM LabsReported Oct 30, 20265d ago
FBI confirms coordination on the Binance incident
The FBI confirmed it was working with public- and private-sector partners to understand the incident’s scope, evaluate impacts and determine investigative steps. It did not attribute the Binance intrusion to North Korea in its statement.
FBI is involved in response to $6.3 billion Binance hack linked to North Korea - Nextgov/FCWReported Oct 30, 20265d ago
1inch confirms its token was among the stolen assets
1inch said 1INCH tokens were among the assets stolen from Binance and clarified that blocking the attacker’s access to its applications could not freeze the tokens themselves. The accompanying report recorded a 13% decline in 1INCH.
1INCH Slides 13%, Extending Losses Beyond Bitcoin and Ether | The DefiantReported Oct 30, 20265d ago
Teng says EIP-7702 bypassed controls and attackers destroyed traces
Teng said the attacker used EIP-7702 to bypass Binance wallet controls and destroyed tools and traces during the intrusion. Binance was rebuilding its withdrawal service following the breach.
Binance Attacker Used EIP-7702 to Bypass Wallet Controls, Teng Says | The DefiantReported Oct 30, 20265d ago
Teng sets withdrawal-restart and reserve-report targets
Richard Teng targeted Sunday for restarting withdrawals and Monday for publishing a full proof-of-reserves report. Reopening remained conditional on the rebuilt withdrawal service passing testing; neither milestone was reported as completed.
Binance’s Teng Targets Sunday Withdrawal Restart After Hack | The DefiantReported Oct 30, 20265d ago
Abu Dhabi regulator engages with Binance over the breach
Abu Dhabi’s Financial Services Regulatory Authority said it was engaging with Binance and monitoring the incident. The authority had issued Binance’s main operating license.
Hackers steal $6.3 billion from Binance - Business InsuranceReported Oct 30, 20265d ago
Binance says it has reserved more than $6.34 billion for reimbursement
Binance said it had set aside more than $6.34 billion in company funds to cover the incident, excluding frozen or protected assets still undergoing recovery and verification. It said approximately $5 billion was already held in the affected token denominations.
Binance Says It Has Reserved Over $6.34 Billion to Cover Hack Losses | The DefiantReported Oct 30, 20265d ago
Synthetix recovers 8.4 million stolen SNX
Synthetix reportedly recovered 8.4 million SNX stolen in the Binance hack. Its protocolDAO said the tokens were secured in its Safe and would be returned when Binance requested them.
Synthetix Recovers 8.4 Million SNX Stolen in Binance Hack | The DefiantReported Oct 30, 20265d ago
Attacker deposits 300 million USDT into JustLend and swaps 234 million USDT for TRX
ThreatMon reported that the Binance attacker deposited 300 million USDT into JustLend and swapped 234 million USDT for TRX through SunSwap. The TRX was subsequently split across five addresses.
Binance Lost $6.3 Billion Without Losing a Key - ThreatMonReported Oct 30, 20265d ago
USDT0 freezes 6.19 million tokens and restores cross-chain transfers
USDT0 froze 6.19 million tokens linked to the Binance exploit. It also restored USDT transfers between Tron and Ethereum following a precautionary pause.
USDT0 Freezes 6.19 Million Tokens Linked to Binance Exploit | The DefiantReported Oct 30, 20265d ago
Chainalysis reveals signs of automated laundering
Chainalysis reported thousands of laundering transactions, repeated address reuse and consistent sequences in which addresses received exactly 1 TRX before forwarding additional funds. It assessed that the pattern suggested programmatic redistribution of the stolen assets.
Binance Exploit: Latest Findings and Response - ChainalysisReported Oct 30, 20265d ago
Unit delays deposits and withdrawals after the Binance breach
Unit protocol delayed all deposits and withdrawals following the Binance incident. The supplied report said guardian screening could prevent transfers from completing.
Unit Delays All Deposits and Withdrawals After Binance Breach | The DefiantReported Oct 30, 20265d ago
Aave restricts lending markets following the attacker’s borrowing
Aave imposed precautionary restrictions on new deposits and borrowing across affected lending markets. LlamaRisk said the attacker had used normal protocol functionality rather than an Aave vulnerability and that the position remained overcollateralized.
У криптобиржи Binance похитили рекордные 6,3 млрд долларов США - ХакерReported Oct 30, 20265d ago
Binance exploit-linked wallet transfers 14,040 ETH to another holding address
A wallet linked to the Binance exploit transferred 14,040 ETH to another holding address. The recipient held approximately 19,740 ETH after the transfer.
Binance Exploit-Linked Wallet Moves 14,040 ETH to Another Holding Address | The DefiantReported Oct 30, 20265d ago
MistTrack identifies a laundering route to a Phemex-connected address
MistTrack linked a Binance theft-related transaction route to an address connected to Phemex. The reported wallet overlap did not establish the perpetrators’ identities or prove that the same actor carried out both thefts.
MistTrack Links Binance Theft Route to Phemex-Connected Address | The DefiantReported Oct 30, 20265d ago
A researcher releases a reconstruction of the Binance 14 sweeper
Researcher banteg reported decompiling the contract that drained Binance 14 and shared a Solidity reconstruction. The supplied material described it as reconstructed source matching the observed executable runtime, not recovered original source.
AndreGironda: RT @banteg: i decompiled the contract that drained binance wallet 14
https://t.co/Zg3fYHcJOYReported Oct 30, 20266d ago
Attacker transfers 195,460 stolen ETH to a second address
After receiving ETH drained from Binance 14 and Binance 16, the attacker transferred 195,460 ETH, valued at approximately $442 million, to a second address. The report places this onward transfer nearly 15 minutes after the preceding wallet transfers.
Binance says customer money is safe after huge hack drains key reserve walletsReported Oct 30, 20266d ago
Binance pledges to cover customer losses
Binance committed to covering all incident-related losses using its Secure Asset Fund for Users and company resources. It also promised an updated proof of reserves and a verified technical post-mortem after remediation and investigation.
Binance Links $6.3B Hack to Engineer’s Compromised LaptopReported Oct 30, 20266d ago
Blockaid publishes evidence of signing misuse rather than key extraction
Blockaid’s preliminary analysis described valid EIP-7702 authorizations delegating Binance 14 to a malicious sweeper. Its CEO said the evidence suggested misuse of signing infrastructure rather than extraction of the underlying private key, without establishing the initial compromise mechanism.
Binance Links $6.3B Hack to Engineer’s Compromised LaptopReported Oct 30, 20266d ago
Binance revokes the affected wallet authorization
Binance said it revoked the affected address authorization as part of its response. Investigators reported that the malicious Ethereum delegation could otherwise continue sweeping incoming funds independently of the exchange’s withdrawal service.
Binance Links $6.3B Hack to Engineer’s Compromised LaptopReported Oct 30, 20266d ago
Additional token issuers freeze incident-linked assets
World Liberty Financial, First Digital and other token issuers froze assets associated with the theft, supplementing the Tether, Circle and Ripple interventions. Binance reported approximately $3 billion frozen overall, while investigators published differing totals reflecting different scopes and reporting stages.
The largest theft in history: North Korea likely behind the $6.4 billion Binance hack | EllipticReported Oct 30, 20266d ago
Attacker borrows ETH against stolen USDT through Aave
An attacker-controlled wallet deposited approximately 60 million USDT into Aave and borrowed approximately 19,760 ETH. This converted access to issuer-freezable collateral into holdings that could not be frozen by a token issuer.
The largest theft in history: North Korea likely behind the $6.4 billion Binance hack | EllipticOct 30, 20266d ago
Trump confirms North Korea probe as Secret Service details Binance recovery efforts
On October 30, President Donald Trump said his administration was investigating whether North Korean hackers were responsible for the Binance theft. The Secret Service separately confirmed it was working with Circle and other private-sector partners to trace, freeze and recover funds, while coordinating with the U.S. Attorney’s Office for the District of Columbia and other law enforcement partners.
North Korean hackers suspected in $6.3B Binance cryptocurrency theft | Fox BusinessOct 30, 20266d ago
Binance says it has begun recovering affected assets
In an October 30 statement, Binance said it had begun recovering affected assets for users. The exchange said it was cooperating with law enforcement, token issuers, blockchain analytics firms and industry partners to trace, freeze and recover additional funds.
Cyberattaque contre Binance: comment des pirates ont dérobé pour 6,3 milliards de dollars d'actifs numériques à la première plateforme mondiale de cryptomonnaiesOct 30, 20266d ago
Attacker converts stolen AVAX and bridges the proceeds to Ethereum
Between 11:38 and 12:29 UTC, the attacker converted the stolen AVAX into USDC and bridged it to Ethereum using Circle’s Cross-Chain Transfer Protocol. The proceeds were then exchanged for approximately 7,242.8 ETH.
The largest theft in history: North Korea likely behind the $6.4 billion Binance hack | EllipticOct 30, 20266d ago
Binance discloses additional breach points
Binance’s subsequent October 30 updates reported additional, undisclosed breach points beyond the initially suspected laptop. Richard Teng said the attack involved more than one engineer’s permissions and was not a single-click operation, leaving the complete intrusion chain unresolved.
Binance Probes DevOps Engineer’s Hacked Laptop After $6.3B TheftOct 30, 20266d ago
Bitcoin, ether and BNB decline following the incident announcement
Early Friday Asian trading saw bitcoin fall to approximately $77,646 and ether to approximately $2,239 following the incident announcement. BNB was reported down more than 8% over 24 hours.
Binance freezes $3B after security incident, suspends withdrawals | Fox BusinessOct 30, 20266d ago
Chainalysis announces its TraderTraitor attribution
Chainalysis announced at 12:30 a.m. Eastern Time that it assessed North Korea’s TraderTraitor as responsible for the Binance theft. Its assessment drew on laundering behavior and the commingling of Binance proceeds with funds from the earlier Bitget exploit.
Binance Exploit: Latest Findings and Response - ChainalysisOct 30, 20266d ago
Binance restores deposits while rebuilding withdrawal security
Binance restored deposits but kept withdrawals suspended during a security overhaul of its withdrawal service and related addresses. Yi He said at approximately 04:17 UTC that withdrawals were expected to begin resuming within 48 hours, rather than confirming that they had reopened.
North Korea Suspected in $6.3B Binance Hack - BankInfoSecurityOct 30, 20266d ago
Attacker redistributes 11.4 million TRX through a secondary TRON wallet
Beginning at 02:45 UTC on October 30, a secondary attacker-controlled TRON wallet distributed approximately 11.4 million TRX in more than 30 transfers. Bitquery traced two paths that converted TRX into USDT through SunSwap and forwarded the proceeds to unidentified older wallets.
Binance Hack: $6.3B Drained on 9 Chains, $2.7B Frozen - BitqueryOct 30, 20266d ago
Binance and Bitget theft proceeds converge at a shared address
ZachXBT reported that proceeds from the Binance theft and the approximately $388 million Bitget exploit were commingled after arriving through THORChain. He said the overlap suggested a likely shared attacker, although a common destination alone did not conclusively establish responsibility.
zachxbt: @SpecterAnalyst Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same...Oct 30, 20266d ago
Binance releases preliminary findings pointing to a DevOps laptop
Binance’s preliminary update identified a compromised DevOps engineer’s laptop as a possible entry point that enabled access to a service container and unauthorized withdrawal submissions. Binance said it had found no evidence that wallet private keys had leaked.
Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record - Help Net SecurityOct 30, 20266d ago
Arbitrum Security Council removes approximately $30 million from attacker control
At approximately 00:08 UTC, Arbitrum’s Security Council intervened to secure 8,426 ETH and 74.6 million ARB associated with the theft. The action placed approximately $30 million beyond the attacker’s control.
Binance Hack: Inside the $6.3B Hot Wallet TheftOct 29, 20267d ago
A second theft wave reaches Avalanche and Polygon
Investigators reported another wave of unauthorized transfers affecting Binance wallets on Avalanche and Polygon shortly after 23:00 UTC. Persistent Ethereum delegation also enabled repeated sweeps of newly arriving deposits, with the latest reported at 23:56 UTC.
The largest theft in history: North Korea likely behind the $6.4 billion Binance hack | EllipticOct 29, 20267d ago
Tether blacklists Binance’s compromised Binance 14 wallet
Tether blacklisted Binance 14, the compromised Ethereum hot wallet, at 22:06 UTC on October 29. This followed its earlier freeze of USDT held at the attacker’s receiving hub.
Inside the Largest Crypto Theft on Record: What the $6.3 Billion Binance Hack Means for Bank CustodyOct 29, 20267d ago
Attacker sells RLUSD before Ripple freezes the remaining balance
The attacker reportedly sold approximately 48 million RLUSD between 21:42 and 22:01 UTC. Ripple subsequently froze the remaining approximately 40.5 million RLUSD identified in that flow.
Binance Hack: Inside the $6.3B Hot Wallet TheftOct 29, 20267d ago
Binance pauses withdrawals during its incident response
Binance temporarily suspended withdrawals on multiple networks as a precaution while investigating the incident. Reporting subsequently described a broader suspension of deposits and withdrawals while security checks were performed.
Binance Hack: Inside the $6.3B Hot Wallet TheftOct 29, 20267d ago
Binance acknowledges an investigation into a potential security issue
Binance publicly acknowledged its investigation at approximately 21:16 UTC and said at 21:29 UTC that user funds were completely safe. The exchange said its security teams were urgently reviewing the activity and warned users against unofficial messages and links.
Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion FrozenOct 29, 20267d ago
Changpeng Zhao publicly says Binance appears to have been hacked
At approximately 21:15 UTC, Binance founder Changpeng Zhao said the activity appeared to be a hack and expressed his expectation that customer funds would be covered. He noted that he no longer managed the exchange.
Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion FrozenOct 29, 20267d ago
Tether and Circle begin freezing stolen stablecoins
Tether began freezing incident-linked assets at approximately 21:01 UTC, and Circle froze approximately 823 million USDC at 21:04 UTC. Subsequent reporting put Tether’s freezes above 1.567 billion USDT; the figures represented immobilized assets, not completed recovery.
Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion FrozenOct 29, 20267d ago
Blockaid distributes malicious-address alerts across its network
Within an hour of detecting the sweep, Blockaid said it flagged attacker addresses as malicious and notified customers through its Ecosystem Incidents Feed. It also traced the stolen assets as they were split, swapped and used as borrowing collateral.
Binance $6.3B Hack: Using Advanced AI Models, Blockaid Detects the Biggest Theft in Crypto History | Blockaid BlogOct 29, 20267d ago
Attacker converts stolen stablecoins into ETH before freezes
Chainalysis reported that the attacker moved $500 million in stablecoins into a conversion wallet and exchanged $325 million for approximately $285 million in ETH over nearly 20 minutes. Ten minutes later, the remaining $175 million was forwarded to intermediate wallets.
Binance Exploit: Latest Findings and Response - ChainalysisOct 29, 20267d ago
Additional Binance wallets are drained into the same collection address
Blockaid reported that ten more Binance hot wallets on four chains sent funds to the same address within 12 minutes of the initial Ethereum sweep. The attacker also used the delegated wallet’s authority over another Binance smart account to steal approximately 823 million USDC.
Binance $6.3B Hack: Using Advanced AI Models, Blockaid Detects the Biggest Theft in Crypto History | Blockaid BlogOct 29, 20267d ago
Blockaid detects the Ethereum drain and identifies the delegation mechanism
Blockaid said its detection system flagged the drain less than two minutes after the sweep and before public reporting. Its automated analysis identified unauthorized signing and the EIP-7702 delegation mechanism within 11 minutes.
Binance $6.3B Hack: Using Advanced AI Models, Blockaid Detects the Biggest Theft in Crypto History | Blockaid BlogOct 29, 20267d ago
Signed EIP-7702 authorizations delegate Binance 14 to the attacker’s code
At approximately 20:20 UTC, the attacker submitted 50 pre-signed EIP-7702 authorizations covering consecutive nonce values. One matched Binance 14’s transaction counter, delegating the hot wallet to an attacker-controlled sweeper contract.
The largest theft in history: North Korea likely behind the $6.4 billion Binance hack | EllipticOct 29, 20267d ago
Attacker steals 18,270 BTC and splits it through a peel chain
At approximately 20:20 UTC, a Binance Bitcoin hot wallet transferred 18,270 BTC to the attacker. The funds were immediately divided through a peel chain, including outputs of 1,000 BTC and 100 BTC.
Binance Faces Largest Crypto Heist - $6.36 Billion Reportedly Stolen by North Korean GroupOct 29, 20267d ago
Binance theft begins with transfers from five XRP Ledger wallets
Between approximately 20:05 and 20:09 UTC, five Binance wallets transferred 233.46 million XRP to an attacker-controlled address. Transfers on other networks followed in a coordinated theft that TRM estimated removed approximately $6.36 billion across ten blockchains.
Binance Faces Largest Crypto Heist - $6.36 Billion Reportedly Stolen by North Korean GroupOct 29, 20267d ago
Attacker uses stolen deployment token to run a malicious container
Between 17:15 and 19:56 UTC, the attacker accessed a compromised Binance engineer’s computer and used a stolen container deployment token to deploy a container and execute a malicious script. Binance said the attacker used its wallet signing service to move assets outside the normal withdrawal process.
North Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance Heist | Cryptika CybersecurityOct 29, 20267d ago
Attacker deploys and rehearses a malicious sweeper contract
Elliptic reported that the attacker deployed a sweeper contract at 15:59 UTC on October 29 and tested it against another wallet before targeting Binance.
The largest theft in history: North Korea likely behind the $6.4 billion Binance hack | EllipticOct 28, 20268d ago
Attacker funds an operational wallet through Tornado Cash
TRM reported small Tornado Cash withdrawals beginning October 28 that funded a wallet used in the Binance attack. Investigators assessed that preparations began at least 36 hours before the theft.
North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026 | TRM LabsJun 2026
Binance contains June compromise after attackers identify wallet personnel
Binance detected an intrusion involving a tampered installer for an AI coding tool, replaced the affected employee’s computer and changed their credentials. Before containment, the attackers had identified employees working on Binance’s wallet-management systems.
Binance says fake job interview helped North Korean hackers steal $6.3 billion in crypto - Nextgov/FCWReported Jan 1, 202610mo ago
A single transaction sweeps approximately $2.5 billion from Binance 14
At 20:24:23 UTC, a transaction swept 167,464 ETH and 63 ERC-20 token holdings from Binance 14 to an address labeled Binance Hot Wallet Exploiter 2. The transfers included approximately 1.615 billion USDT.
Ethereum Transaction Hash: 0x53bd38b816... | Etherscan
