Cory Rove
Deep PromptMedia & PoliticsNeural ScoopScience · Tech · HealthWeights & MeasuresAI · Claims vs. EvidenceAlgorithmic AssistSports · Scores · ResultsGround TruthFrom the Ground Up

Evidence Wiki · Timeline

Binance hackers stole $6.3 billion in record-breaking crypto heist

Primary documents, neutrally analyzed, plus the facts and quotes compiled from the coverage — one searchable base, organized by topic and anchored to when things happened.

exported Nov 6 08:06 UTClast dossier Aug 3, 2026711 documents11,419 topics

80 facts and 23 quotes compiled from the coverage on this topic.

Facts & quotes from the coverage

Compiled from every article the pipeline has read on this topic — deduplicated across sources, tagged with how many independent outlets assert each fact and each source's credibility. Background for the reporting, not a substitute for the primary documents above.

  • Hackers stole an estimated $6.3 billion from Binance.

    cred 7.8[1]2026-10-30

  • The attack was linked to North Korea’s TraderTraitor hacking group.

    cred 7.8[1]2026-10-30

  • An Ethereum upgrade (EIP-7702) enabled the attacker to drain a hot wallet in a single transaction.

    cred 7.8[1]2026-10-30

  • The theft occurred across 10 blockchains, with most funds leaving Binance-controlled wallets in about 20 minutes.

    cred 7.8[1]2026-10-30

  • Binance estimates $3 billion of the stolen funds has been frozen by third parties.

    cred 7.8[1]2026-10-30

  • Binance will cover all losses using its Secure Asset Fund for Users (SAFU) and other company funds.

    cred 7.8[1]2026-10-30

  • Funds from the Binance and Bitget hacks were commingled at the same address via THORChain.

    cred 7.8[1]2026-10-30

  • North Korea has been accused of using crypto hacks to fund its weapons programs.

    cred 7.8[1]2026-10-30

  • North Korean hackers stole $6.36 billion in cryptocurrency from Binance

    cred 7.8[1]2026-10-30

  • The attack occurred on October 29 and drained funds across 10 blockchains in 20 minutes

    cred 7.8[1]2026-10-30

  • TRM Labs attributes the operation to TraderTraitor, a North Korean state-sponsored hacking group

    cred 7.8[1]2026-10-30

  • Hackers exploited Ethereum’s EIP-7702 standard to hijack a Binance hot wallet

    cred 7.8[1]2026-10-30

  • Binance confirmed the security incident and temporarily suspended withdrawals

    cred 7.8[1]2026-10-30

  • Companies like Tether, Circle, Ripple, and World Liberty Financial froze about $2.7 billion of the stolen funds

    cred 7.8[1]2026-10-30

  • Hackers still hold around $2.4 billion worth of assets, including over 420,000 ETH and more than 18,000 bitcoin

    cred 7.8[1]2026-10-30

  • Around $3 billion of affected assets, mainly stablecoins, had been frozen.

    cred 7.5[1]2026-10-30

  • Binance disclosed $6.3 billion worth of crypto funds were stolen.

    cred 7.5[1]2026-10-30

  • User funds are safe, and $3 billion of impacted assets have been frozen.

    cred 7.5[1]2026-10-30

  • Binance has reserved $6.34 billion in company funds to cover the incident.

    cred 7.5[1]2026-10-30

  • The attack involved a compromised laptop belonging to a DevOps engineer.

    cred 7.5[1]2026-10-30

  • Blockchain analysis firms TRM and Chainalysis attribute the hack to TraderTraitor, a North Korean group.

    cred 7.5[1]2026-10-30

  • The theft occurred over 20 minutes and is four times larger than the previous record.

    cred 7.5[1]2026-10-30

  • Binance has a $1.3 billion emergency reserve fund for such incidents.

    cred 7.5[1]2026-10-30

  • Binance has not attributed responsibility to any individual yet.

    cred 7.5[1]2026-10-30

  • Binance suffered a previous $40 million hack in 2019.

    cred 7.5[1]2026-10-30

  • TRM called the hack an 'extraordinary' event due to its scale and speed.

    cred 7.5[1]2026-10-30

  • Hackers siphoned around $6.3 billion in cryptocurrencies from Binance wallets.

    cred 7.5[1]2026-10-30

  • The attack occurred on October 29, with most of the stolen crypto taken in around 20 minutes.

    cred 7.5[1]2026-10-30

  • Crypto tracing firms TRM Labs and Chainalysis link the attack to North Korean hackers known as TraderTraitor.

    cred 7.5[1]2026-10-30

  • Binance suspended deposits and withdrawals following the hack and says it is working with law enforcement.

    cred 7.5[1]2026-10-30

  • Around $2.8 billion, or 44% of the stolen amount, has been frozen, mostly in stablecoins.

    cred 7.5[1]2026-10-30

  • TraderTraitor is known for targeting crypto and decentralized finance companies, including a $1.5 billion hack against Bybit.

    cred 7.5[1]2026-10-30

  • The attack involved a compromised laptop and the use of Tornado Cash for laundering.

    cred 7.5[1]2026-10-30

  • Binance suspended all withdrawals after a hack estimated to impact $6.3 billion.

    cred 7.5[1]2026-10-30

  • Analysts at Elliptic estimated $3.3 billion was converted into unfreezeable digital assets.

    cred 7.5[1]2026-10-30

  • Blockchain intelligence firm TRM Labs linked the hack to a North Korean unit called TraderTraitor.

    cred 7.5[1]2026-10-30

  • North Korean hackers stole $1.5 billion from Bybit last year.

    cred 7.5[1]2026-10-30

  • Binance reserved over $6.34 billion in company funds to cover the incident.

    cred 7.5[1]2026-10-30

  • Binance is actively buying more tokens to cover the remaining amount.

    cred 7.5[1]2026-10-30

  • Binance was co-founded in 2017 by Changpeng Zhao and holds about $140 billion in digital assets.

    cred 7.5[1]2026-10-30

  • Binance pleaded guilty to US criminal charges in 2023 and paid a $4.3 billion fine.

    cred 7.5[1]2026-10-30

  • Binance was hit by the biggest cryptocurrency heist, with $6.36 billion stolen in 20 minutes.

    cred 7.5[1]2026-10-30

  • The attack is believed to have originated from a North Korean-linked hacking unit called TraderTraitor.

    cred 7.5[1]2026-10-30

  • The US Treasury has previously linked stolen funds to North Korea’s nuclear missile programme.

    cred 7.5[1]2026-10-30

  • The attack may have originated from a compromised laptop belonging to an engineer.

    cred 7.5[1]2026-10-30

  • TRM Labs suggests preparations for the attack may have begun several days ago.

    cred 7.5[1]2026-10-30

  • Binance claims no evidence of stolen cryptographic keys, but attackers may have accessed withdrawal software.

    cred 7.5[1]2026-10-30

  • Alan Woodward at the University of Surrey questions how a single PC could compromise the entire exchange.

    cred 7.5[1]2026-10-30

  • Clive Summerfield at FARx notes that crypto platforms are as centralised as banks, with privileged individuals controlling billions.

    cred 7.5[1]2026-10-30

  • Tether and Circle froze stolen funds, stymying hackers.

    cred 7.5[1]2026-10-30

  • Woodward highlights the lack of two-man rules or similar safeguards in crypto platforms.

    cred 7.5[1]2026-10-30

  • Binance suffered a crypto hack affecting $6.3 billion in funds

    cred 7.0[1]2026-10-30

  • Polymarket reported a security incident wiping out around $2.7 million in user funds

    cred 7.0[1]2026-10-30

  • Binance found no evidence that wallet passwords were leaked

    cred 7.0[1]2026-10-30

  • Hackers compromised Binance's wallet-signing infrastructure

    cred 7.0[1]2026-10-30

  • Elliptic estimated 44% of stolen assets have been frozen, with stablecoins accounting for nearly all of those funds

    cred 7.0[1]2026-10-30

  • TRM Labs and Elliptic linked the theft to North Korean hackers and the group TraderTraitor

    cred 7.0[1]2026-10-30

  • Binance claims user funds are safe but has not provided proof.

    cred 6.8[1]2026-10-30

  • Binance suspended all deposits and withdrawals during the investigation.

    cred 6.8[1]2026-10-30

  • About half of the stolen amount was frozen as the crypto moved across blockchains.

    cred 6.8[1]2026-10-30

  • Hackers working for the North Korean regime are blamed for a $6.3B crypto heist at Binance.

    cred 6.8[1]2026-10-30

  • Binance has not responded to questions about the breach or prior security audits.

    cred 6.8[1]2026-10-30

  • The breach took about 20 minutes according to TRM Labs.

    cred 6.8[1]2026-10-30

  • The stolen funds were traced to a wallet used in a previous $351M theft from Bitget.

    cred 6.8[1]2026-10-30

  • The breach is described as the 'largest hack in history' by TRM Labs.

    cred 6.8[1]2026-10-30

  • TRM Labs and Elliptic both attributed the breach to North Korean hackers.

    cred 6.8[1]2026-10-30

  • Binance has temporarily paused all withdrawals.

    cred 6.5[1]2026-10-30

  • Binance was hit by hackers this week.

    cred 6.5[1]2026-10-30

  • The company confirmed on Thursday that attackers gained access to its servers and stole $6.3 billion.

    cred 6.5[1]2026-10-30

  • Binance is working with the FBI and US Secret Service on the investigation.

    cred 6.5[1]2026-10-30

  • Binance told CNET that $5 billion is being held in exact token assets, with plans to purchase the rest through other market channels.

    cred 6.5[1]2026-10-30

  • The FBI is aware of the incident and is engaged with relevant public and private partners.

    cred 6.5[1]2026-10-30

  • Binance has a business relationship with the Trump family's World Liberty Financial.

    cred 5.8[1]2026-10-30

  • Tether and Circle froze $1.5 billion and $800 million, respectively, associated with the attack.

    cred 5.8[1]2026-10-30

  • TRM Labs attributed the attack to North Korea's TraderTraitor unit with 'high confidence'.

    cred 5.8[1]2026-10-30

  • Binance froze approximately $3 billion in assets and promised to cover all losses.

    cred 5.8[1]2026-10-30

  • Binance reported a $6.3 billion loss from a cyber attack.

    cred 5.8[1]2026-10-30

  • Binance attributed the hack to a compromised DevOps laptop.

    cred 5.8[1]2026-10-30

  • Binance founder Changpeng Zhao pleaded guilty in 2023 to a felony related to money laundering.

    cred 5.8[1]2026-10-30

  • Binance, the world’s largest crypto exchange, suspended withdrawals after a security breach.

    cred 4.8[1]2026-10-30

Quotes

  • “Binance confirmed the security incident and temporarily suspended withdrawals across several networks.”— Binance [1]
  • “The attacker did not simply use one engineer’s permissions, and this was not a single âone-clickâ action. It involved a more complex attack process.”— Richard Teng [1]
  • “This is state-sponsored theft at a scale that no criminal group comes close to, with the proceeds funding North Koreaâs weapons programmes.”— Tom Robinson [1]
  • “7702 itself isn't broken. Don't panic if you are using a wallet that supports 7702 (MetaMask, Uniswap, Ambire, etc.)”— Derek Chiang [1]
  • “North Korean hackers have stolen a staggering $6.36 billion in cryptocurrency from Binance, according to blockchain intelligence firm TRM Labs.”— TRM Labs [1]
  • “TRM Labs says the North Korean hacking group TraderTraitor is also tied to last year’s $1.5 billion Bybit hack”— TRM Labs [1]
  • “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.”— Binance [1]
  • “This step can take longer because some tokens may have low liquidity, and settlement also takes time.”— Binance [1]
  • “We have already reserved over $6.34 billion of company funds to cover this incident.”— Binance [1]
  • “It shouldn’t be possible for a single [developer] PC to be compromised and somehow for that to allow the entire exchange to be compromised,”— unattributed [1]
  • “We think North Korea is likely responsible”— Tom Robinson, chief scientist and cofounder of Elliptic [1]
  • “This is an extraordinary hack, for its size and for the response... Few financial systems have ever shown a theft of this scale.”— TRM chief policy officer Ari Redbord [1]
  • “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process.”— Binance co-CEO Richard Teng [1]
  • “These folks in particular are somewhat artists in terms of getting into these distributed finance organizations”— Rafe Pilling, senior director of threat intelligence at Sophos [1]
  • “You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened.”— unattributed [1]
  • “The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit”— research blog from Chainalysis [1]
  • “Things may get a lot worse going forward.”— Peter Ward, of the Sejong Institute in Seoul [1]
  • “This was a complex attack.”— Richard Teng [1]
  • “User funds are safe.”— CZ [1]
  • “Our teams are aware of reports of a potential security issue and are actively investigating.”— Binance on X [1]
  • “Binance said it has seen no evidence of a leak of its private keys, which would grant the hacker near-unfettered control over the company’s stores of crypto.”— Binance [1]
  • “Binance... will cover all losses using funds from its SAFU [Secure Asset Fund for Users] fund and the company, and user funds are safe.”— unattributed [1]
  • “The estimated total impact is around $6.3 billion, and [Binance] has worked with blockchain partners to freeze affected assets, with approximately $3 billion frozen on-chain so far,”— unattributed [1]