Incident data
Status: incident confirmed; final net loss unconfirmed.
Three different times: sources up to 2026-10-31 07:09:10 UTC · last chain check 2026-10-31 02:21 UTC · price sample ends 2026-10-30 02:00 UTC. Each table row has its own time. The prices table is history, not a live feed.
Timeline
Attack times come from security-firm analysis. A row with a Site check was re-read on a public node, and the check says which fields. A row without one was not re-read. A report time is the article publication time, not the time the event happened.
Thu, 29 Oct 2026 (UTC)9
Malicious contract delegation set on Binance 14 hot wallet
Blockaid attributes the mechanism to EIP-7702 abuse: with a valid authorization, the attacker made the hot wallet run sweeper code.
The attack mechanism (EIP-7702 abuse) is Blockaid's analysis. The authorization transaction itself was re-read on the chain.
Site check (same record as the Flow page): Re-read on the chain (2026-10-31 02:21 UTC): block 26300753 at 2026-10-29T20:20:59Z; status success; sender matches; recipient matches; time matches; tx type 0x4; 50 authorizations for nonces 18914775-18914824 all pointing to the stated contract
Sources: Blockaid investigation · as of 2026-10-30 02:40 UTC
First batch of assets moved out
The report describes a first outflow of 167,464 ETH and 1.615 billion USDT.
Amount: Described in token amounts, not converted to USD
The transaction hash first came from a news lead. This site has since re-read the transaction on a public node. The ETH amount is still taken from the reports.
Site check (same record as the Flow page): Re-read on the chain (2026-10-31 02:21 UTC): block 26300770 at 2026-10-29T20:24:23Z; status success; sender matches; recipient matches; time matches; USDT transferred 1,615,409,499 Scope: Transaction identity, sender, recipient, time and the USDT transfer logs. The ETH amount and the other 62 tokens come from reports and were not re-read.
Sources: Blockaid investigation · First sweep transaction (Etherscan) · as of 2026-10-30 02:40 UTC
Stablecoins moved via another smart account called through Binance 14
The report describes ordinary signed transfers and a linked smart account being called. The event cannot be reduced to one contract bug.
A valid signature alone does not show whether a raw private key leaked or a signing process failed.
Site check (same record as the Flow page): Re-read on the chain (2026-10-31 02:21 UTC): block 26300855 at 2026-10-29T20:41:23Z; status success; sender matches; recipient matches; time matches; USDC transferred 780,000,000
Sources: Blockaid investigation · as of 2026-10-30 02:40 UTC
Circle says it froze more than 800 million USDC
Circle's chief executive posted that more than 800 million USDC was frozen.
Amount: More than 800 million USDC
A freeze restricts token transfers. It does not mean funds were returned.
Site check: Not re-read by this site. The figures come from the cited reports.
Sources: Circle executive's original post · as of 2026-10-30 03:01 UTC
Tether says it froze more than 1.567 billion USDT
Tether's chief executive posted that more than 1.567 billion USDT was frozen.
Amount: More than 1.567 billion USDT
A freeze restricts token transfers. It does not mean funds were returned.
Site check: Not re-read by this site. The figures come from the cited reports.
Sources: Tether executive's original post · as of 2026-10-30 03:01 UTC
Later incoming deposits swept again
The research firm reports that the attacker swept follow-on deposits again. Time is precise to the minute only.
Site check (same record as the Flow page): Re-read on the chain (2026-10-31 02:21 UTC): block 26301167 at 2026-10-29T21:44:11Z; status success; sender matches; recipient matches; time matches; USDT transferred 200,397,772
Sources: Blockaid investigation · as of 2026-10-30 02:40 UTC
Aave pauses new deposits and new borrows as a precaution
Scope: all V3 and V4 markets run by community governance. Existing positions can still withdraw and repay. Aave says its contracts are not affected.
This shows the service was affected. It does not show Aave contracts were breached. The time of any later unfreeze is not verified.
Site check: Not re-read by this site. The figures come from the cited reports.
Sources: Aave official post · as of 2026-10-30 03:01 UTC
Binance reports a verified frozen total of $2.54 billion
Amounts from issuers are statements made at different times and cover addresses that are not unified. Do not add them to this total.
Amount: $2.54 billion
Not a final recovery figure and not a net loss.
Site check: Not re-read by this site. The figures come from the cited reports.
Sources: Binance official post · Associated Press · as of 2026-10-30 03:01 UTC
AP reports Binance suspended deposits and withdrawals and discloses frozen amount
This is the article publication time, not the moment the suspension began. No reliable announcement that deposits and withdrawals resumed was found. Resumption is unverified.
Site check: Not re-read by this site. The figures come from the cited reports.
Sources: Associated Press · as of 2026-10-30 02:40 UTC
Fri, 30 Oct 2026 (UTC)2
CoinDesk: about $200 million Ripple and about $27 million USD1 frozen
Relayed by media. CoinDesk also uses start-of-month reserves to estimate ether coverage falling to about 94%. This is not a live post-event balance-sheet audit.
Amount: About $200 million + about $27 million, media relay
Time is the article time. Issuer figures may already be included in Binance's total.
Site check: Not re-read by this site. The figures come from the cited reports.
Sources: CoinDesk · as of 2026-10-30 03:01 UTC
Co-founder He Yi pledges that Binance will bear the attack losses
Media report that Binance pledged to bear the losses, suspended all deposits and withdrawals, and will publish a post-mortem after the investigation.
Amount: No total loss or completed compensation amount published
Time is the article time, not when the pledge was made. A pledge is not a completed payment. The official post URL was found but its text was not retrieved.
Site check: Not re-read by this site. The figures come from the cited reports.
Sources: Axios · Binance official post URL (text not retrieved) · BusinessToday reprint of the statement · as of 2026-10-30 02:40 UTC
Loss figures compared
Do not add these numbers or average them. Chain coverage, pricing time and double-counting of follow-on transfers all change the total. Taken figures run from $5.3 billion to $6.43 billion, and frozen figures from $2.54 billion to about $3 billion. These ranges only summarize the figures listed here. They are not the bounds of all public figures. A frozen figure is not a recovery and not a net loss. Earlier reports also gave subset tallies of about $3.3 billion and $3.55 billion (same The Block report).
Newest as-of time first. A row marked "Earlier estimate" is an older figure that its source later revised. It stays here so you can see how the estimate moved.
Reported as taken
| Figure | What it measures | Source type | Published / as of | Limits | Source |
|---|---|---|---|---|---|
| $6.43 billion (Elliptic) | Elliptic's tally of cryptoassets stolen from Binance on 29 October | Analyst / chain data | 2026-10-30 08:00 UTC as of 2026-10-30 19:30 UTC page revised 2026-10-30 19:53:06 UTC | Elliptic's 'last updated' time. It describes the situation as still developing. Valuation basis not checked by this site. | Elliptic investigation |
| About $6.3 billion (Binance estimate, via Blockaid) | Binance's own total-impact estimate, as quoted on the revised Blockaid page | Analyst / chain data | 2026-10-29 23:00 UTC as of 2026-10-30 18:46:41 UTC | The page's modified stamp, not a stated time for this number. The page does not say when the wording changed from the earlier $5.5 billion. Binance's original statement was not read. Blockaid is a security firm and its page contains product promotion. | Blockaid (revised page) |
| About $6.3 billion (Bitquery) | Bitquery's tally: coins sent from 17 Binance hot wallets across nine chains, at the price when each left | Analyst / chain data | 2026-10-30 06:30 UTC as of 2026-10-30 06:43 UTC page revised 2026-10-30 07:12 UTC | Bitquery states its own chain reads, last at 06:43 UTC. Not confirmed by Binance. Valued at theft-time prices. | Bitquery investigation |
| About $6.36 billion (TRM) | TRM Labs' tally: transfers out of Binance wallets on ten chains, each valued at the price when it was taken | Analyst / chain data | 2026-10-30 02:10 UTC as of 2026-10-30 00:30 UTC page revised 2026-10-30 19:41:23 UTC | TRM says its figures reflect what it saw on chain as of 00:30 UTC on 30 October. Attribution to North Korea is TRM's judgement, not this site's. | TRM Labs analysis |
| About $6.28 billion | A researcher's tally across eight chains | Media report | 2026-10-30 as of 2026-10-30 00:00 UTC | Self-described as of about 08:00 Singapore time. Not confirmed by Binance. Not all chains independently verified. | TechFlow reprint of Dickson's analysis |
| At least $5.5 billion Earlier estimate Kept for history. Replaced by: About $6.3 billion (Binance estimate, via Blockaid), same Blockaid page, revised text. | Blockaid's multi-chain public estimate | Analyst / chain data | 2026-10-29 23:00 UTC as of 2026-10-29 23:00 UTC | Some chains (Bitcoin, Tron) still await confirmation. The original text contains product promotion. Time is the datePublished stamp of the Blockaid page. | Blockaid |
| Up to $5.8 billion | Conor Grogan's total estimate | Media report | 2026-10-29 21:49 UTC as of 2026-10-29 21:49 UTC | Media relay. No transaction-level list obtained. | The Block |
| About $5.3 billion | Estimate of assets reported as abnormal outflows | Media report | 2026-10-30 05:48 (time zone unclear) as of date not stated in source | The English version credits Coinglass. Other reprints credit Glassnode. The underlying table was not obtained. | Investing.com |
Reported as frozen
| Figure | What it measures | Source type | Published / as of | Limits | Source |
|---|---|---|---|---|---|
| $2.84 billion (frozen, Elliptic) | Frozen funds that Elliptic says it verified on chain (44% of its total) | Analyst / chain data | 2026-10-30 08:00 UTC as of 2026-10-30 19:30 UTC page revised 2026-10-30 19:53:06 UTC | Frozen is not recovered and not a net loss. Elliptic's verification, not this site's. | Elliptic investigation |
| About $3 billion (frozen, via Blockaid) | Verified total frozen, as Binance puts it on the revised Blockaid page | Analyst / chain data | 2026-10-29 23:00 UTC as of 2026-10-30 18:46:41 UTC | Relayed by Blockaid. Binance's own post was not read. Not a final recovery figure and not a net loss. Time is the page's modified stamp. | Blockaid (revised page) |
| About $2.7 billion (frozen, Bitquery) | Bitquery's tally of funds locked by Tether, Circle, Arbitrum and four smaller issuers | Analyst / chain data | 2026-10-30 06:30 UTC as of 2026-10-30 06:43 UTC page revised 2026-10-30 07:12 UTC | Frozen is not recovered and not a net loss. | Bitquery investigation |
| About $2.7 billion (frozen, TRM) | TRM Labs' count of funds frozen on chain | Analyst / chain data | 2026-10-30 02:10 UTC as of 2026-10-30 00:30 UTC page revised 2026-10-30 19:41:23 UTC | Frozen is not recovered and not a net loss. Time is TRM's stated cut-off. | TRM Labs analysis |
| $2.54 billion (frozen) | Total frozen amount published by Binance | Official source | 2026-10-29 23:22:09 UTC as of 2026-10-29 23:22:09 UTC | Not a final recovery figure and not a net loss. | Binance official post · Associated Press |
No independent verification exists yet of any executed fund payout, compensation transaction or current balance. CoinDesk describes the SAFU fund (user safety asset fund) as about $1 billion held in bitcoin.
Addresses and transactions
These are third-party public addresses and transactions. They are attributed to research firms or news leads. This site has not completed on-chain replay, cross-chain aggregation or fund de-duplication.
The address-level fund flow, with arrows and the check status of each step, is on the Fund flow page. This table is the plain list of addresses and hashes.
| Item | Address / hash | Source type | Note and site check |
|---|---|---|---|
| Binance 14 | 0x28C6c06298d514Db089934071355E5743bf21d60 | Analyst / chain data | Identified by Blockaid Source: Blockaid investigation · as of 2026-10-30 02:40 UTC Site check: Not re-read by this site. The figures come from the cited reports. |
| Collection address | 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c | Analyst / chain data | Identified by Blockaid Source: Blockaid investigation · as of 2026-10-30 02:40 UTC Site check (same record as the Flow page): Re-read on the chain (2026-10-31 02:21 UTC): holds 4.808 ETH at check time |
| First sweep transaction | 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3 | Our inference | The hash first came from a news lead (a Binance Square account, not an official one). This site has since re-read the transaction on a public node. Source: Binance Square account (news lead) · as of 2026-10-30 02:40 UTC Site check (same record as the Flow page): Re-read on the chain (2026-10-31 02:21 UTC): block 26300770 at 2026-10-29T20:24:23Z; status success; sender matches; recipient matches; time matches; USDT transferred 1,615,409,499 Scope: Transaction identity, sender, recipient, time and the USDT transfer logs. The ETH amount and the other 62 tokens come from reports and were not re-read. |
| Malicious delegate contract | 0x63e842B054Bd624a465454D533C33F573e9c6fAe | Analyst / chain data | Identified by Blockaid Source: Blockaid investigation · as of 2026-10-30 02:40 UTC Site check: Not re-read by this site. The figures come from the cited reports. |
Blockaid left placeholders for Bitcoin and Tron pending intelligence confirmation, so not every cross-chain amount is described as verified transaction by transaction. Networks involved include Ethereum, Arbitrum, Avalanche and Optimism. This is wallet-asset impact, not a breach of those chains' consensus.
Knock-on effects
Not finding an announcement does not mean a party took no action. A statement does not show every protocol is free of risk. Blockaid describes funds passing through Permit2, LI.FI, Uniswap, UniswapX and Aave. This shows the path touched those tools. It does not show any bridge itself was robbed.
| Party | Public statement or action | Source type | Limits | Source |
|---|---|---|---|---|
| Aave | Paused new deposits and new borrows in all V3/V4 markets. Says contracts are unaffected and positions remain overcollateralized. | Official source | Time of any later unfreeze not verified. as of 2026-10-29 22:44:33 UTC | Aave official post |
| Binance.US | Says it is not affected by the event. | Media report | Reuters reprint. Page update time zone unclear. as of 2026-10-29 18:30 UTC | Investing.com reprint of Reuters |
| Bybit, Kraken | No event-specific freeze or outage announcement was found in this round. | Our inference | Only means the search found nothing. It does not mean there was no risk or action. as of 2026-10-30 03:01 UTC | none |
| Coinbase | Says it is monitoring the event and has offered support to Binance. | Media report | Page gives no time zone. Original post not checked. as of 2026-10-29 22:57 UTC | CoinNess |
| Ethena | Collateral is held with off-exchange custodians. Unrealized PnL exposure to Binance is about $8.8 million. | Media report | Amount is a media relay. Unrealized PnL is not a confirmed loss. as of 2026-10-29 22:20 UTC | CoinNess custody statement · The Information |
| Lido / Ether.fi / Maple | Respectively: stETH unaffected, no direct exposure, no Binance-related positions. | Media report | Media relay. Original posts not checked. Does not imply every protocol is free of risk. as of 2026-10-29 22:57 UTC | CoinNess |
| OKX | Founder called for minute-level alerts and freeze coordination across the industry. | Media report | Time zone unclear. Not evidence of any frozen assets. as of 2026-10-29 23:59 UTC | CoinNess |
Prices and volume
Binance spot (single venue), unit USDT. Baseline is the 2026-10-29 20:23 UTC close. This is a history table for the attack window. The price sample ends at 2026-10-30 02:00 UTC. These are not current prices. Baseline is the 20:23 one-minute close. The hour after the event is 20:24-21:24 and the hour before is 19:24-20:24, 60 one-minute candles each. Volume is the sum of quoteAssetVolume.
| Coin | Baseline | Close after 1h | 1h change | Low in next hour | Volume multiple | Last 1-min close in sample |
|---|---|---|---|---|---|---|
| BNB | 740.23 | 711.71 | -3.85% | 680 | 19.17× | 703.56 (-4.95%) |
| BTC | 80364.74 | 79432.94 | -1.16% | 78297.05 | 3.61× | 76837.04 (-4.39%) |
| ETH | 2318.21 | 2286.81 | -1.35% | 2233 | 4.03× | 2195.34 (-5.30%) |
| SOL | 99.35 | 97.58 | -1.78% | 95 | 3.18× | 93.99 (-5.40%) |
| XRP | 1.272 | 1.2608 | -0.88% | 1.2233 | 4.33× | 1.2103 (-4.85%) |
Prices were already moving before the event, so this does not show the whole decline was caused by it. Volume is one exchange only, not the whole market. Source: Binance market data API example (BNBUSDT one-minute candles)
Data principles
- Public sources only. Every item carries a source link and an "as of" time.
- Source type says who published a claim: Official source the party's own post, Media report relayed by media, Analyst / chain data security firm or chain data, Our inference our own reading. It does not say whether this site checked the claim.
- Site check is separate. It shows what this site re-read on a public node, when, and which fields. It is the same record as on the Fund flow page. Items without one say "Not re-read by this site".
- Three times are kept apart. "Sources up to" is the newest as-of time of any source record. "Last chain check" is when this site last re-read something on a public node. "Price sample ends" is the last minute in the price table. One of them does not stand for the others.
- If a time is unknown, the page says "date not stated in source" or "unknown". It does not guess.
- Each page is built from a reviewed library and published as a versioned static site. Reload the page to get the newest version.