Current outcome
The Binance ~$6.4B hack remains under investigation; the FBI and Secret Service are involved, and TRM Labs and Chainalysis attributed it to North Korea-linked TraderTraitor; Circle and Tether froze about $823M in USDC and $975.1M in USDT respectively; Binance says about $3B is frozen, it is buying missing tokens, and it has reserved over $6.34B to cover losses; the latest investigation indicates “additional points of breach” beyond the compromised DevOps engineer's laptop, and the CFTC chair is citing the hack to push for U.S. oversight of offshore exchanges.
Progress timeline
37 material updates- #01
Binance-hacker-1029 – $5.6B stolen from Binance
Binance suffered a $5.6B hack — the largest exchange theft ever — that reportedly wiped out its ~$1B SAFU insurance fund, with about $2.4B of the stolen USDT/USDC already frozen by Tether and Circle.
Source evidence: Tiberium · Cointelegraph · Decrypt · wublockchainenglish · Protos · Decrypt
- #02
Binance黑客集群持仓监控：涉案65个币种总计58.75亿美元，其中25.4亿美元已被冻结
Arkham data shows the Binance hacker cluster now holds about $5.875 billion across 65 tokens, and Binance says it has coordinated the freezing of about $2.54 billion in stolen funds.
State after update: Binance is still investigating the hack; the hacker cluster holds about $5.875 billion across 65 tokens, and Binance says about $2.54 billion of the stolen funds has been frozen through coordination.
Source evidence: theblockbeats
- #03
Arkham: Binance Hacker-Linked Addresses Hold $5.88B in Assets; Binance Confirms
Arkham identified 66 addresses tied to the 'binance-hacker-1029' entity holding roughly $5.88B in crypto, including 1.768B USDT, 18,270 BTC, 466,622 ETH and 824.56M USDC, while Binance confirmed $2.54B of hack-linked assets have been frozen with recovery ongoing.
Source evidence: wublockchainenglish · foresightnews
- #04
【CZ：Binance 疑遭黑客攻击，用户资金安全】
Binance founder CZ stated that Binance was suspected of being hacked while user funds remain safe, thanking Tether (~$971M) and Circle (~$823M) for rapidly freezing the related funds.
Source evidence: foresightnews
- #05
【何一：Binance 暂停提币，直至确认环境安全，用户资金安全】
Binance co-founder Yi He said the exchange has paused withdrawals until it confirms the environment is secure, asserted user funds remain safe under SAFU, and thanked World Liberty Financial for helping freeze $27 million in USD1 plus 48 million WLFI tokens (worth about $2 million).
State after update: Binance has paused withdrawals until it confirms the environment is secure; the hack remains under investigation, with Binance previously saying about $2.54 billion in stolen funds had been frozen through coordination, and World Liberty Financial helped freeze $27 million in USD1 plus 48 million WLFI tokens (about $2 million).
Source evidence: foresightnews · foresightnews
- #06
【神鱼：Binance 14 热钱包仍未撤销 7702 委托，一笔 2961 ETH 的交易正转向该钱包】
神鱼警告 Binance 14 热钱包的 EIP-7702 委托两小时后仍未撤销，一笔约 2,961 ETH 的待处理转账一旦上链可能被攻击者扫走。
Source evidence: foresightnews
- #07
Binance points to engineer’s hacked laptop in $6.3B breach
Binance's preliminary investigation says attackers may have used a compromised DevOps engineer laptop to access a service container and submit unauthorized withdrawal transactions, with no evidence of private-key leakage; Binance raised the estimated impact to about $6.3 billion, said about $3 billion was frozen, and plans to cover losses via SAFU and company funds, revoke the affected address authorization, and publish updated Proof of Reserves.
State after update: The Binance incident remains under investigation; preliminary findings point to a compromised DevOps device and signing-infrastructure misuse rather than private-key leakage. Estimated impact is about $6.3 billion, about $3 billion has been frozen, deposits/withdrawals were temporarily suspended, the affected address authorization was revoked, losses will be covered by SAFU and company funds, and a detailed technical post-mortem is pending.
Source evidence: Cointelegraph · foresightnews · foresightnews
- #08
He Yi: Binance will cover all hacking losses, deposits and withdrawals are tempo
Binance co-founder Yi He confirmed the exchange suffered a hack, said user funds are safe and Binance will cover all losses, and that deposits and withdrawals are temporarily suspended while security checks, fund freezing and law-enforcement coordination proceed.
Source evidence: wublockchainenglish · wublockchainenglish
- #09
【Binance 热钱包疑遭异常转出，新地址已持超 20 亿美元资产】
Binance's hot wallet reportedly began large anomalous outflows around 04:24 Beijing time, with a new address holding more than $2 billion in assets and BNB dropping about 6% in an hour, while Binance has not confirmed an attack.
Source evidence: foresightnews
- #10
【Circle：已冻结与币安潜在安全事件相关的超 8 亿美元 USDC】
Circle froze more than $800 million in USDC at law enforcement's request in connection with a potential security incident involving Binance.
Source evidence: foresightnews
- #11
🔍 链上侦探 | Binance被盗资金更新：累计冻结约28.29亿美元，Arbitrum、Paxos再冻结相关资产
Arbitrum froze about $30.5 million in ARB and Paxos about $215,700 in USDP linked to Binance stolen funds, bringing an on-chain analyst's estimated cumulative freeze to about $2.829 billion, a figure not yet officially confirmed.
Source evidence: theblockbeats
- #12
【慢雾余弦：币安黑客在以太坊使用 EIP-7702 仅为方便批量清扫相关热钱包代币】
SlowMist founder Cos said the Binance hacker used Ethereum's EIP-7702 only to batch drain tokens from related hot wallets after hours of rehearsal, and that the protocol mechanism itself is not at fault.
Source evidence: foresightnews
- #13
Security Incident Update
Binance reported that an attacker apparently compromised a DevOps engineer's laptop to access a service container and submit unauthorized withdrawal transactions, with no evidence of private key leakage and a full technical post-mortem forthcoming.
Source evidence: binance_announcements
- #14
Blockaid Reveals How Hacker Took Control of Binance Wallet: One of 50 EIP-7702 A
Blockaid analysis disclosed that the attacker submitted 50 EIP-7702 authorizations with different nonces in a single Type-4 transaction; only one matched, delegating the Binance 14 hot wallet to an unverified malicious transfer contract. The contract only lets the attacker-designated address call sweep(), allowing ETH and ERC-20 tokens to be transferred while retaining 1 ETH for gas.
State after update: The Binance incident remains under investigation; preliminary findings pointed to a compromised DevOps device and signing-infrastructure misuse, with estimated impact about $6.3B, about $3B frozen, deposits/withdrawals temporarily suspended, the affected address authorization revoked, and losses to be covered by SAFU and company funds. Blockaid further analyzed that the attacker exploited EIP-7702 authorization by submitting 50 different-nonce authorizations in one transaction; only one succeeded, delegating the Binance 14 hot wallet to a malicious sweep contract.
Source evidence: wublockchainenglish
- #15
【TRM Labs：币安攻击事件或为朝鲜精英黑客组织 TraderTraitor 执行】
TRM Labs attributes a Binance attack to North Korea's elite hacking group TraderTraitor, part of Lazarus Group, with high confidence based on on-chain and off-chain intelligence.
Source evidence: foresightnews
- #16
【1inch 封锁币安攻击者相关地址，但 1INCH 代币无法冻结】
Within one hour of the Binance hack, 1inch blocked attacker-associated addresses from its DApp, Wallet, and API and is sharing newly identified addresses with resolvers and integrators; however, because 1INCH is a standard ERC-20 token without freeze or blacklist functionality, stolen 1INCH tokens cannot be frozen.
State after update: The Binance ~$6.3B hack remains under investigation; 1inch has blocked attacker-associated addresses but cannot freeze stolen 1INCH tokens; about $3B in assets has been frozen, deposits are operating normally, and withdrawals are paused with resumption expected within about 48 hours; analysts attribute the attack to North Korea's TraderTraitor, some stolen funds were commingled with Bitget exploit funds, and losses will be covered by SAFU and company funds.
Source evidence: foresightnews
- #17
ZachXBT: Stolen Funds from the $6.3B Binance Exploit and $388M Bitget Exploit Co
ZachXBT reported that stolen funds from the $6.3B Binance exploit and the $388M Bitget exploit were bridged through THORChain and commingled at the same address, indicating a single North Korea-linked actor also tied to the Phemex hack.
Source evidence: wublockchainenglish · foresightnews
- #18
North Korea’s TraderTraitor linked to $6.3B Binance hack
TRM Labs, Chainalysis, and onchain investigator ZachXBT linked the $6.3B Binance hack to North Korea’s TraderTraitor group, citing commingled Binance and Bitget funds moved through THORChain.
Source evidence: Cointelegraph
- #19
Aave Freezes V3 and V4 Markets After Binance Exploiter Deposits $60M USDT and Bo
Aave froze every DAO-operated V3 and V4 market after a wallet linked to the Binance exploiter deposited about 60 million USDT and borrowed 19,762 WETH (roughly $44.6M) minutes earlier, with the position still open but over-collateralized and Aave's contracts reportedly unaffected.
Source evidence: wublockchainenglish
- #20
Live updates: Binance uncovers more breach points in $6.3B hack
Binance's investigation uncovered additional breach points beyond the initially cited engineer laptop; co-CEO Richard Teng said the incident was not a single 'one-click' action and did not attribute responsibility to any individual; deposits remain normal while withdrawals are paused and expected to resume within about 48 hours; analysts attributed the attack to North Korea's TraderTraitor and said stolen funds were commingled with Bitget exploit funds in the same address.
State after update: The Binance ~$6.3B hack remains under investigation; preliminary findings pointed to a compromised DevOps engineer laptop, but additional breach points have been found and the incident was not a single 'one-click' action. About $3B in assets has been frozen, deposits are operating normally, and withdrawals are paused with resumption expected within about 48 hours. Analysts attribute the attack to North Korea's TraderTraitor, some stolen funds were commingled with Bitget exploit funds, and losses will be covered by SAFU and company funds.
Source evidence: Cointelegraph
- #21
Binance Finds 'Additional Points of Breach' in $6.3B Hack
Binance uncovered additional breach points in a security incident estimated at $6.3 billion, with about $3 billion frozen onchain, deposits reopened, withdrawals still suspended, and losses covered by SAFU and company funds.
Source evidence: Decrypt
- #22
【Aave 分阶段解冻前将下调借款上限，防止币安被盗事件攻击者建立大额仓位】
LlamaRisk announced it will use the Risk Steward to cut roughly $3.8B of idle borrow caps across Aave V3 and V4 before phased unfreezing, aiming to prevent the Binance-hack attacker from opening large positions in the first blocks after unfreezing; Aave V3 Core's WETH borrow cap is set to drop from 2.4M to 1.79M and USDT from 3.09B to 2.56B.
State after update: Aave V3 and V4 reserves remain frozen due to the Binance exploit; LlamaRisk has announced a planned ~$3.8B borrow-cap reduction before phased unfreezing, while the attacker has already borrowed 19,762 WETH on Aave V3 Core. The Binance ~$6.3B hack remains under investigation, about $3B in assets has been frozen, and withdrawals are paused with resumption expected within about 48 hours.
Source evidence: foresightnews
- #23
何一：AAVE抵押的6000万USDT不在完全冻结范围内，黑客实际仅取走4600万美元ETH
He Yi clarified that the $60 million USDT collateral in Aave is not fully frozen; the hacker actually withdrew about $46 million in ETH, with roughly $14 million more potentially recoverable after law enforcement unfreezes assets.
State after update: Aave's DAO-operated V3 and V4 markets remain frozen; the $60 million USDT collateral is not fully frozen, the exploiter actually withdrew about $46 million in ETH, and roughly $14 million more may be recoverable through law enforcement unfreezing.
Source evidence: theblockbeats · foresightnews
- #24
Binance hacker’s Bitcoin haul tops Coinbase’s corporate treasury
Blockchain analytics traced 18,270 BTC (about $1.4B) across 19 attacker-linked addresses, exceeding Coinbase's combined 18,071 BTC investment and operational holdings as of Sept. 30; the same attacker cluster held 508,621 ETH, including 200,630 ETH initially stolen and the rest accumulated by swapping stolen stablecoins and other tokens.
State after update: The Binance ~$6.3B hack remains under investigation; multiple breach points have been confirmed, about $3B in assets has been frozen, losses will be covered by the company, and analysts attribute the attack to North Korea's TraderTraitor. New onchain analysis shows attacker-linked addresses holding 18,270 BTC and 508,621 ETH.
Source evidence: Cointelegraph
- #25
EIP-7702 didn’t cause Binance hack, but may have amplified losses
Blockaid analysis indicated that compromised signing systems were the root cause of the Binance hack, and EIP-7702 may have helped attackers bypass security checks and drain wallets in a single sweep, though it was not necessary for the attack.
State after update: The Binance ~$6.3B hack remains under investigation; multiple breach points have been confirmed, about $3B in assets has been frozen, losses will be covered by the company, and analysts attribute the attack to North Korea's TraderTraitor. New onchain analysis shows attacker-linked addresses holding 18,270 BTC and 508,621 ETH. Security firm Blockaid indicated that compromised signing systems were the root cause, and EIP-7702 may have amplified losses but was not necessary.
Source evidence: Cointelegraph
- #26
Binance Reserves Over $6.34B in Company Funds to Cover Hack Losses, Including $5
Binance said it has reserved over $6.34 billion in company funds to cover hack losses, including $5 billion already held in affected tokens; it is purchasing the remaining tokens through market and OTC channels, said the reserved funds are separate from about $3 billion in frozen assets, and will publicly verify user assets through Proof of Reserves.
State after update: The Binance ~$6.3B hack remains under investigation; multiple breach points have been confirmed, about $3B in assets has been frozen, and losses will be covered by the company. Binance has reserved over $6.34B in company funds to cover losses, including $5B in affected tokens, is buying the remainder through market and OTC channels, and will verify user assets via Proof of Reserves. Analysts attribute the attack to North Korea's TraderTraitor. New onchain analysis shows attacker-linked addresses holding 18,270 BTC and 508,621 ETH. Security firm Blockaid indicated that compromised signing systems were the root cause, and EIP-7702 may have amplified losses but was not necessary.
Source evidence: wublockchainenglish · Cointelegraph
- #27
Bitcoin price metrics hint at rebound as $1.6B liquidations follow Binance hack
Bitcoin held above $76,000 after touching $76,320 as markets absorbed a reported $6.3 billion Binance hack and a concurrent US tech-stock sell-off, with over $1.5 billion in crypto liquidations in 24 hours and four-hour RSI showing a bullish divergence.
Source evidence: Cointelegraph
- #28
TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor
Binance said it reserved over $6.34B of company funds to cover losses and began recovering affected assets; reporting added attack mechanics, laundering/freeze details, and high-confidence TraderTraitor attribution.
State after update: TRM Labs and Chainalysis attribute the ~$6.36B Binance hack to North Korea's TraderTraitor; Binance has reserved over $6.34B to cover losses and is recovering assets, with about $3B frozen.
Source evidence: Decrypt
- #29
Binance working with FBI to recover assets following $6.3B hack
Binance confirmed it is working with the FBI and other law enforcement to recover stolen assets, saying industry partners have frozen about $3 billion and that it has reserved over $6.34 billion in company funds, $5 billion of which is in the exact stolen tokens.
State after update: The Binance ~$6.3B hack remains under investigation; multiple breach points have been confirmed, about $3B in assets has been frozen, and losses will be covered by the company. Binance has reserved over $6.34B in company funds to cover losses, including $5B in affected tokens, is buying the remainder through market and OTC channels, and will verify user assets via Proof of Reserves. Binance is working with the FBI and other law enforcement to recover frozen and stolen assets. Analysts attribute the attack to North Korea's TraderTraitor. New onchain analysis shows attacker-linked addresses holding 18,270 BTC and 508,621 ETH. Security firm Blockaid indicated that compromised signing systems were the root cause, and EIP-7702 may have amplified losses but was not necessary.
Source evidence: Cointelegraph
- #30
【币安联席 CEO：将于下周一前公布完整储备金证明】
Binance co-CEO Richard Teng said Binance will release a complete proof-of-reserves report by Monday, possibly with an initial version beforehand, and user withdrawals remain expected to resume by Sunday. He also disclosed that attackers used EIP-7702 to gain on-chain execution authorization over a hot wallet, bypassing normal approval processes, and that additional breach points and self-destruct mechanisms were found.
State after update: The Binance ~$6.3B hack remains under investigation; Binance co-CEO Richard Teng said a complete proof-of-reserves report will be released by Monday and user withdrawals are expected to resume by Sunday; attackers used EIP-7702 to obtain on-chain execution authorization over a hot wallet, and additional breach points and self-destruct mechanisms were found. Binance has reserved over $6.34B in company funds to cover losses, including $5B in affected tokens, is buying the remainder through market and OTC channels, and is working with law enforcement to recover assets.
Source evidence: foresightnews
- #31
How the Binance hack happened on-chain on Ethereum
An on-chain analysis explains how attackers drained Binance's Binance 14 hot wallet by obtaining EIP-7702 authorizations — brute-forcing nonce values across 50 signed delegations — to install a sweeper contract that then moved the wallet's ether and tokens.
Source evidence: Protos
- #32
Elon Musk, CZ Trade Blows Over SpaceX Shares After $6.4B Binance Hack
TRM Labs and Chainalysis attributed the ~$6.4B Binance hack to North Korea-linked hacking group TraderTraitor; separately, CZ publicly rebuked Elon Musk over his mockery of Binance, and co-CEO Yi He said annual revenue is sufficient to cover losses without selling SpaceX shares.
State after update: The Binance ~$6.3B hack remains under investigation; TRM Labs and Chainalysis attributed the attack to North Korea-linked TraderTraitor; Binance has reserved over $6.34B in company funds to cover losses and continues working with law enforcement to recover assets; CZ and Musk publicly clashed over the incident, with co-CEO Yi He saying Binance does not need to sell SpaceX shares to cover losses.
Source evidence: Decrypt
- #33
Binance Sets Aside $6.34B to Cover Hack Losses, CEO Says 'Your Assets Are Safe'
Binance CEO Richard Teng said the exchange will cover all losses from this week's hack using more than $6.34 billion of company reserves — including $5 billion in the affected tokens — after an attacker used a self-destruct mechanism and an EIP-7702 delegation to bypass normal approval controls, with withdrawals targeted for restoration by Sunday and a full proof of reserves by Monday.
Source evidence: Decrypt
- #34
Coinbase leads crypto stock selloff following $6.3B Binance hack
Crypto-linked stocks sold off sharply following the $6.3B Binance hack, with Coinbase falling over 13% and Circle, Strategy, IREN, and Figure dropping 8-10%.
State after update: Markets are absorbing the $6.3B Binance hack, with Bitcoin holding above $76,000 while crypto-related equities sold off sharply, led by Coinbase down over 13%.
Source evidence: Cointelegraph
- #35
Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million
The U.S. Secret Service joined the Binance hack investigation; Circle froze approximately $823 million in USDC and Tether froze approximately $975.1 million in USDT connected to the attack, with both stablecoin issuers coordinating with law enforcement.
State after update: The Binance ~$6.3B hack remains under investigation; the FBI and Secret Service are involved; TRM Labs and Chainalysis attributed the attack to North Korea-linked TraderTraitor; Circle and Tether froze about $823M in USDC and $975.1M in USDT respectively; Binance has reserved over $6.34B in company funds to cover losses and continues working with law enforcement to recover assets.
Source evidence: Decrypt
- #36
Binance Hack: Why Bitcoin Didn't Crash Like It Did in 2018
Decrypt added market-impact and recovery details: Bitcoin fell only about 4%–6% from its post-Fed level, roughly $1.3 billion in leveraged bets were liquidated; the attacker still holds about 420,000 ETH and 18,270 BTC (~$2.4 billion that stablecoin issuers cannot freeze); Binance says about $3 billion is frozen and it is buying missing tokens on the open market and over the counter, with withdrawals expected to resume in about 45 hours.
State after update: The Binance ~$6.3–6.4B hack remains under investigation; the FBI and Secret Service are involved; TRM Labs and Chainalysis attributed the attack to North Korea-linked TraderTraitor; Circle and Tether froze about $823M in USDC and $975.1M in USDT respectively; Binance says about $3B is frozen, it is buying missing tokens on the open market and over the counter, and withdrawals are expected to resume in about 45 hours; the company has reserved over $6.34B to cover losses. Market reaction has been relatively limited: Bitcoin is down about 4%–6% from its post-Fed level, roughly $1.3B in leveraged bets were liquidated, and the attacker still holds about 420,000 ETH and 18,270 BTC (~$2.4B that stablecoin issuers cannot freeze).
Source evidence: Decrypt
- #37
Binance Hack Shows Why Offshore Exchanges Need US Oversight, CFTC Chair Says
CFTC Chairman Michael Selig publicly cited Binance's ~$6.4 billion hack to argue for U.S. federal oversight of offshore crypto exchanges; separately, Binance said its investigation uncovered “additional points of breach,” with CEO Richard Teng calling it a more complex attack process that did not simply use one engineer's permissions.
State after update: The Binance ~$6.4B hack remains under investigation; the FBI and Secret Service are involved, and TRM Labs and Chainalysis attributed it to North Korea-linked TraderTraitor; Circle and Tether froze about $823M in USDC and $975.1M in USDT respectively; Binance says about $3B is frozen, it is buying missing tokens, and it has reserved over $6.34B to cover losses; the latest investigation indicates “additional points of breach” beyond the compromised DevOps engineer's laptop, and the CFTC chair is citing the hack to push for U.S. oversight of offshore exchanges.
Source evidence: Decrypt