Tracing the Binance Hack, From a 20-Minute Drain to a Four-Day Money Trail

On Oct. 29, about $6.4 billion in cryptocurrency drained out of Binance, the world's largest cryptocurrency exchange. Signs of preparation had appeared a day and a half earlier. Most of the theft was over in 20 minutes. About $3 billion of the stolen funds was frozen within 70 minutes. The rest has been laundered through about 12,000 wallets in under four days. The Federal Bureau of Investigation has attributed the theft to a North Korean hacking organization. Binance has said the company will absorb its customers' losses. What follows traces the confirmed record in chronological order.

Estimates of the total differ by source, from $6.3 billion to $6.43 billion. The figures below are attributed to the source that reported them.

The Preparation on Oct. 28 and 20 Minutes of Theft

The first sign of the attack appeared on the morning of Oct. 28. According to TRM Labs, the attacker's operating wallet received three small payments from Tornado Cash, a service that obscures the origin of funds. The money was used for fees, known as gas. TRM Labs said the preparation matched patterns seen in earlier North Korea-linked attacks.

Hours before the theft on Oct. 29, the attacker deployed a malicious sweeper contract and tested it on three smaller wallets. A sweeper is a program that empties a wallet on command. In one test, funds were taken out and immediately returned. It was a final dress rehearsal.

The theft began at 8:05 p.m. UTC on Oct. 29. TRM Labs and Elliptic found that most of the money was gone within 20 minutes and that the theft continued until 11:56 p.m. At 8:20 p.m., a single transaction carrying 50 EIP-7702 delegation signatures installed the attacker's sweeper contract as the executor of a Binance Ethereum hot wallet. The signatures were all made by the Binance hot wallet.

EIP-7702 is a feature introduced in Ethereum's Pectra upgrade in May 2025. It lets an ordinary wallet temporarily borrow the functions of a smart contract, for convenience such as bundling several transactions or having fees paid on the user's behalf. The attacker used the feature in reverse, taking control of the wallet's execution authority for its own program.

Three minutes and 24 seconds after installation, the sweeper drained about 167,464 ether, 63 tokens and about $823 million in USDC. Because a delegation remains in effect until it is revoked, the sweeper kept draining newly arriving deposits in six further rounds between 8:41 p.m. and 11:56 p.m.

On blockchains other than Ethereum, the attacker moved funds through ordinary signed transfers. TRM Labs concluded that the hot wallet signing infrastructure itself had been compromised, not individual wallet keys. Signing infrastructure is the internal system that approves withdrawals. Elliptic reached the same conclusion. The cryptography itself was not broken, the firm said; the systems and people around the wallets were breached.

Binance first said a DevOps engineer's laptop had been compromised and unauthorized withdrawals approved, with access gained through the laptop to a service container. On Oct. 30, the company said there was more than one point of compromise. Binance said there was no evidence that hot wallet private keys themselves had been taken. The root cause has not been made public. Binance has not named an attacker.

Assessments of EIP-7702 differ. The security firm Blockaid concluded the theft would have been possible without the feature. What the feature provided was speed and compression: emptying a wallet in a single transaction and continuing to drain new deposits. Taylor Monahan, MetaMask's security lead, said, "It's not actually a 7702 issue, it's the same issue crypto has had since day one." For an attacker that already held signing authority, the feature only made the crime cheaper and less tedious.

The total differs by source. Elliptic put it at $6.43 billion, TRM Labs at $6.36 billion, and Binance and most outlets at about $6.3 billion. Any of those figures makes it the largest cryptocurrency theft on record, more than four times the $1.5 billion Bybit theft of February 2025.

A 70-Minute Freeze, but Half Was Already Gone

Stablecoins such as USDT and USDC made up 54 percent of the stolen funds, $3.46 billion. A stablecoin is a coin pegged to the value of the dollar, and its issuer can block movement from a specific address. The attacker's first task was to convert them into assets that cannot be frozen.

The freeze was fast. At about 9:18 p.m., Circle said it had frozen more than $800 million in USDC. Minutes later, Tether said it had frozen more than $1.567 billion in USDT, Ripple about $200 million in RLUSD and World Liberty Financial about $27 million in USD1. Combined, the issuers' announcements came to about $3 billion frozen within 70 minutes of detection, 44 to 48 percent of the stolen total.

But some money moved before the freezes. On Ethereum, 37 minutes before Tether's freeze, the attacker swapped 434 million USDT for ether on decentralized exchanges, venues where programs exchange coins without an intermediary. It also borrowed 19,762 ether on the lending service Aave against 59.9 million USDT in collateral. On Tron, it swapped 234 million USDT for TRX on SunSwap. Circle froze all $823 million in stolen USDC before any of it had been swapped. Elliptic concluded that about $786 million in stablecoins had been converted before the freezes landed.

The final frozen or seized total is $2.85 billion, 44 percent of the whole. Frozen coins have not disappeared. They are immobilized, and returning them to Binance will require separate legal proceedings, including court orders in multiple jurisdictions.

The speed of the freeze has drawn criticism. Smaller victims struggle to obtain court orders, critics noted, while the Binance case moved the whole industry within an hour. Others argued that clearer legal standards for good-faith freezes could make such a response routine for every victim. What is clear is that a freeze does not itself determine who owns the assets.

One structural fact remains. Bitcoin and ether have no issuers and cannot be frozen at the protocol level. The roughly $2.4 billion in bitcoin and ether that was stolen can be tracked by the FBI but locked by no one. Exchanges can block deposits on their own platforms, but the coins themselves can keep trading on decentralized exchanges or over the counter.

The Grounds for Attribution

TRM Labs attributed the theft to TraderTraitor with high confidence before midnight UTC on Oct. 30, citing on-chain and off-chain intelligence. The core evidence was preparation matching the Bybit attack: small Tornado Cash payments funding an operating wallet, delegation signatures collected in advance and executed in one burst, and a peel-chain laundering method splitting stolen bitcoin into 1,000 and 100 bitcoin increments.

Chainalysis cited the money trail. It said stolen funds had mixed on-chain with funds from the September Bitget theft, which had already been attributed to North Korea. Chainalysis announced its attribution at 12:30 a.m. Eastern time on Oct. 30. Jonathan Levin, its co-founder, stated the same conclusion. Elliptic found that about $16 million of the stolen funds was sent to addresses that also held proceeds of the September Bitget exploit.

The FBI named TraderTraitor in a formal alert on Oct. 31. The Secret Service and IRS Criminal Investigation joined the investigation. The FBI said the hackers were converting the stolen assets mainly into ether, published hundreds of attacker wallet addresses and asked THORChain node operators, decentralized finance services and analytics firms to block related transactions.

TraderTraitor is described as an organization under North Korea's Lazarus Group that targets only cryptocurrency, operating under the Reconnaissance General Bureau. Earlier attributed cases include the Bybit theft of $1.5 billion, the DMM Bitcoin theft of $308 million and the Ronin Network theft of $620 million.

President Donald Trump said on Oct. 31 that the United States was looking into the hack. Days later, the chair of the Commodity Futures Trading Commission cited the case in arguing that offshore exchanges should be required to register with U.S. authorities.

Tracing Four Days of Money Laundering

The scale of the laundering was itself unusual. In under four days, it used about 12,000 wallets across 11 blockchains and more than 40,000 transactions. A new wallet appeared about every 25 seconds. Elliptic said the laundering was "clearly automated, but nothing we have seen shows an AI agent making decisions." It cited fixed timing and amounts, blind retries, new tactics introduced hours apart and pauses that looked like human working patterns. On Tron alone, about 32,000 transactions peaked at roughly 1,300 in an hour, one every three seconds. Each dollar laundered on Tron moved about nine times.

On Oct. 29, immediately after the theft, the attacker focused on converting funds into assets that cannot be frozen. Within the same half hour, the 18,270 stolen bitcoin was split into 19 addresses. It has not moved since.

At 2:19 a.m. UTC on Oct. 30, a single distribution wallet on Tron began sending the attacker's 684.6 million TRX in small amounts to hundreds of new addresses. The funds spread to about 7,700 addresses. Within two and a half hours, the attacker first used six different bridges, tools that move assets from one blockchain to another. Almost all of the TRX came out as ether on Ethereum. At least $147 million has been bridged out of Tron so far.

The ether that arrived on Ethereum was forwarded to newly created addresses and then stopped moving. About 68,700 ETH is now spread across about 850 smaller addresses holding 10 to 100 ETH each. The nine largest addresses, holding 89 percent of the attacker's ether, have not moved since Oct. 30.

New routes were added on Oct. 31. From 3:36 a.m., some TRX was swapped into USDD, a stablecoin promoted as freeze-free, meaning no central party can freeze it. From 5:18 a.m., one address put 128 million TRX through a JustLend lending vault, depositing from one address and withdrawing to 16 new ones, leaving no direct transfer record. The distribution wallet also sped up, from under 12 million TRX an hour for most of Oct. 30 to as much as 37 million an hour on Oct. 31. At 8 a.m. on Oct. 31, the attacker's Tron wallets made about 1,300 transactions in an hour. Elliptic wrote that the distribution wallet kept running through both nights in Pyongyang.

The FBI published its attribution late on Oct. 31. By about 5 a.m. on Nov. 1, activity on Tron had largely stopped. The distribution wallet made its last transfer at 5:33 a.m., after 1,113 transfers in 51 hours.

Other chains then started to move. From 7 a.m., NEAR was moved to new accounts. From 8:19 a.m., some of the parked ether began moving again in lots of about 10 ETH. From 9:38 a.m., about half of the SOL was moved to a new address, with small amounts peeled off since. NEAR has not moved since.

That day also saw the first mixing of the stolen funds. From 5:55 a.m., bitcoin from the Tron funds began entering coinjoins using WabiSabi, the protocol used by Wasabi Wallet and similar wallets. A coinjoin combines many users' bitcoin in a single transaction, breaking the visible link between the coins going in and those coming out. Later in the day, some of the parked ether was swapped for bitcoin, most of which went the same way. By 6:02 a.m. on Nov. 2, about 28 bitcoin, worth $2.2 million, had passed through 18 coinjoins.

Between 2:12 a.m. and 4 a.m. on Nov. 2, XRP moved for the first time since the theft. All 233 million XRP was sent to six new addresses. On Solana, the attacker swapped some SOL for USDC and back again and passed SOL through a lending vault the same way as on Tron.

Elliptic summarized the techniques as five: splitting across thousands of addresses, moving between blockchains through at least seven bridges, swapping assets on decentralized exchanges, hopping through a lending vault, and mixing through coinjoins. Splitting does more than complicate tracking. Smaller amounts can be swapped or bridged without moving prices, stand out less to exchanges screening incoming funds and can be laundered in small batches at the attacker's chosen pace.

The current state is as follows. Apart from the $2.85 billion that is frozen, about $3.24 billion remains in addresses linked to the theft. Most of it is bitcoin and the ether in the nine largest addresses that has not yet been laundered. Funds that have not moved are very likely still held by North Korea. Funds already being laundered may have passed to Chinese money laundering networks North Korea has used before. The amount actually cashed out so far is negligible. Most of what has happened is conversion, not cashing out. Turning the funds into spendable money requires a counterparty such as an exchange or an over-the-counter broker, and that is where the funds can be identified and stopped.

Elliptic expects the attacker to swap the ether for bitcoin in many small transactions and then cash out through over-the-counter brokers over a period of months. An over-the-counter broker is an intermediary that arranges large trades directly between parties rather than on an exchange screen. In the Bybit case, all 499,000 stolen ether was laundered within ten days, and cashing out took months. This time the pace is slower. Ether and bitcoin cannot be frozen, so there is no rush, the sums are more than twice those stolen from Bybit, moving quickly would mean large losses on swaps, and the industry is watching the addresses the FBI published. Further freezes will be harder. Freezing 44 percent is already unusual; after the Bybit hack, about 3 percent was frozen. The best remaining chances are stablecoins caught briefly in transit and centralized services at the point of cash-out.

Binance's Response and Its Customers' Money

Binance suspended deposits and withdrawals within hours of detecting the breach, paused its Binance Alpha trading platform and revoked the attacker's EIP-7702 delegation from the affected hot wallets. "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe," the company said.

The company said it had reserved more than $6.34 billion of its own funds. About $5 billion was already held in the same types of tokens that were stolen, and the remaining $1.34 billion was being acquired through market and over-the-counter channels. The roughly $3 billion frozen on-chain by stablecoin issuers was not counted in that figure; it would be additional recovery if legally reclaimed.

The money came from the SAFU fund, a portion of the futures insurance fund and corporate funds. SAFU, the Secure Asset Fund for Users, was established in July 2018 from a share of trading fees and holds about $1 billion in bitcoin. It is an emergency fund set aside for crises. In the 2019 theft of 7,000 bitcoin, SAFU alone covered the full amount. The current incident is roughly six times what SAFU alone can absorb, and most of the commitment comes from corporate funds. Yi He, a co-chief executive, said operating earnings held in cryptocurrency were sufficient to absorb the loss without liquidating the exchange's SpaceX equity stake.

In this incident, $581 million, or 7,499 bitcoin, was spent from SAFU, and the fund is to be refilled to $1 billion.

On Oct. 31, Binance said it had replaced about 90 percent of the stolen amount. By Nov. 1, the figure had risen to 95 percent. The remaining 5 percent consists of less liquid tokens that take longer to source at the required scale, the company said.

Withdrawals reopened in phases from 6 a.m. UTC on Nov. 1, starting with ether, USDT and USDC. By 12:36 p.m. UTC, all 15 networks and assets in the first phase were open, and on Monday, withdrawals on Zcash, TON and Sui and in fiat currencies including the dollar were also restored. In the first nine and a half hours, withdrawals totaled $4.649 billion and deposits $1.01 billion, a net outflow of about $3.64 billion. Net outflow means more money left than came in. Binance put that at 2.1 percent of its $171 billion in assets under management, the total value of customer assets held. DefiLlama, which tallies balances in publicly visible wallets, put the comparable figure at about $127.6 billion on Monday, measured on a different basis.

A proof of reserves was also published. A snapshot taken at midnight UTC on Oct. 31 showed the ten major assets backed at more than 100 percent of customer balances. Bitcoin stood at 100.04 percent and BNB at 101.30 percent. A proof of reserves is a public disclosure showing that an exchange actually holds the assets it owes customers, with wallet addresses anyone can check on the blockchain. But the figures are Binance's own claims, no outside auditor was named, and a snapshot shows only a single moment, not later movements, unlisted assets or other obligations. All withdrawals now leave from newly published wallet addresses.

The full zero-knowledge proof, known as a zk-SNARK, has not yet appeared. The technology lets each customer verify that their own balance is included in the reserves without seeing anyone else's. Binance said in a Sunday post that the updated report would appear on its reserves page on Monday, Nov. 2, while an earlier post gave a date of Nov. 3, citing 40 to 50 hours of computing time. CertiK, a blockchain security firm, said as of Oct. 31 that it could not yet verify about $5 billion in substitute-asset coverage.

The market shock was also large. BNB fell 8.6 percent to about $694 within hours of the disclosure, bitcoin fell 4.76 percent and ether 4.71 percent. Liquidations across digital asset markets exceeded $1.5 billion in 24 hours. Circle's shares fell about 12 percent over the week and Coinbase's about 10 percent.

What Remains Unconfirmed

The root cause has not been made public. How the signing infrastructure was compromised, how many points of compromise there were and whether the same path remains open after the EIP-7702 delegation was revoked will only be known when Binance publishes its incident report. The company has said it will publish a technical report once the investigation is complete.

Whether the zk-SNARK proof actually appears, whether withdrawals continue to be processed without interruption and whether the frozen share grows further are all still unconfirmed. The moment the stolen funds are cashed out in earnest, through exchanges and over-the-counter brokers, appears to be the next chokepoint.

Editor's note: This article is based on material published through the morning of Nov. 2 (Eastern time). Figures differ by source and the situation continues to change, so accuracy cannot be guaranteed. The root cause of the intrusion has not been confirmed, and the cited figures rest on partial announcements and analyses by the agencies involved and include points that are difficult to verify.