2 NOV 2026 — Attackers took what TRM Labs values at US$6.36bn from Binance on 29 October, most of it within about 20 minutes. The first freeze came 56 minutes after the first theft. Withdrawals began reopening on 1 November, and Binance now says it has covered about 95% of the loss.
Different parties put the theft at three different totals. Binance's second update says "approximately $6.3B USD". TRM's tracing reaches US$6.36bn by pricing each transfer at the moment it was taken, and about US$6.23bn at later prices. Chainalysis says approximately US$6.4bn. Both analytics firms call it the largest crypto theft on record.
TRM and Chainalysis attribute the attack to TraderTraitor, which they describe as a North Korean group. Chainalysis rests that on stolen funds mixing on-chain with money from last month's Bitget theft. BleepingComputer quotes an FBI alert as saying North Korea "was responsible for the theft of more than $6 billion USD in virtual assets". We could not open the alert itself.
The clock in UTC and Singapore time
The entries below use TRM's on-chain timestamps and the publication times of Binance's notices. Singapore is UTC+8, so the theft began before dawn on 30 October here. The conversions are ours.
| UTC | SGT | Event |
|---|---|---|
| 28 Oct, morning | Hour not given | Operator wallet starts receiving small Tornado Cash withdrawals, TRM says |
| 29 Oct 20:05 | 30 Oct 04:05 | First theft: five wallets send 233.46m XRP by 20:09. Binance also dates the compromise to around 20:05 |
| 29 Oct 20:20 | 30 Oct 04:20 | 18,270 BTC leaves. In the same minute, a transaction carrying 50 pre-signed authorisations hands an Ethereum hot wallet to a sweeper contract |
| 29 Oct, about 20:24 | 30 Oct, about 04:24 | Main sweep: 167,464 ETH and 63 tokens, including 1.615bn USDT. The time is our reading of TRM's gaps |
| 29 Oct 21:01 | 30 Oct 05:01 | First freeze: Tether locks 971.1m USDT in the main receiving wallet |
| 29 Oct 21:04 | 30 Oct 05:04 | Circle freezes 823m USDC |
| 29 Oct 22:01 | 30 Oct 06:01 | Ripple freezes 40.5m RLUSD, after 48m had been sold |
| 29 Oct 22:10 | 30 Oct 06:10 | World Liberty Financial freezes 27.8m USD1 |
| 29 Oct 23:05 | 30 Oct 07:05 | Second wave reaches wallets on Avalanche and Polygon |
| 30 Oct 00:08 | 30 Oct 08:08 | Arbitrum's Security Council forces 8,426 ETH and 74.6m ARB out of the attacker's wallet |
| 30 Oct 02:23 | 30 Oct 10:23 | First notice: a compromised DevOps laptop may be involved, about US$3bn frozen |
| 30 Oct 19:33 | 31 Oct 03:33 | Update #2: more than US$6.34bn set aside, about 80% covered, "additional points of breach" found |
| 31 Oct 14:24 | 31 Oct 22:24 | Update #3: 90% covered |
| 31 Oct, hour not given | Hour not given | FBI alert published, per BleepingComputer |
| 1 Nov 04:08 | 1 Nov 12:08 | Update #4: 95% covered, phase one of withdrawals set for 06:00 to 09:00 UTC |
| 1 Nov 06:00 to 15:30 | 1 Nov 14:00 to 23:30 | US$4.6bn withdrawn and US$1.0bn deposited, figures TechCrunch attributes to Binance |
Our arithmetic on the freeze race
56 minutes (our sum). From 20:05 to 21:01 UTC. Chainalysis uses different marks. It has funds leaving around 4:20pm Eastern and freezes starting by 5:14pm, which we convert to 20:20 and 21:14 UTC. That leaves 54 minutes on its clock, and it places the first freeze 13 minutes after TRM does.
About 42% frozen (our sum). TRM counted about US$2.7bn frozen as of 00:30 UTC on 30 October: 2.7 ÷ 6.36 = 42.5%. Chainalysis and Binance report larger shares. Chainalysis's about US$2.8bn of US$6.4bn gives 43.8%, though its page still shows an unfilled "[time]" beside the figure. Binance's approximately US$3bn of US$6.3bn gives 47.6%. Frozen money is not recovered money, and Binance lists recovering it as separate work.
US$38m to US$44m given up (our sum). TRM says about 325m USDT was sold for about 122,300 ETH while ETH traded around US$2,300 to US$2,350. At those prices the ETH was worth US$281.3m to US$287.4m, and 325 minus those figures leaves US$37.6m to US$43.7m. Chainalysis reports the same swap as US$325m into US$285m, a US$40m gap that sits inside our range. The attacker paid that to hold an asset no issuer can freeze. TRM says the remaining 175m USDT from the batch was frozen.
Binance's open promises
Binance's notices still do not name a root cause. The company first pointed to the laptop, then said it had found more points of breach. It says it has seen no evidence that private keys leaked, while TRM's assessment is that the attacker could make Binance's signing system sign transactions across chains. Update #2 expected further technical findings "within about 48 hours", which by our count ran out around 19:33 UTC on 1 November. Its announcements feed showed no new incident notice when we checked at 03:20 UTC on 2 November. We did not review its X posts.
Binance itself claims that "user funds remain safe" and that ten major tokens are fully backed. Users can test them with the zero-knowledge proof, which Update #3 estimated would be ready by 3 November. It was not in that feed either. The uncovered 5% is about US$315m by our sum (5% of US$6.3bn), and Binance says those tokens are less liquid and slower to buy.
View author profile → · Editorial policy
