October 31, 2026
Binance hack: what we learned in the last 24 hours
Yesterday we laid out the timeline of the $6.3B attack. On Oct 30 new facts came out — here is what matters. Times are UTC, status as of the evening of Oct 30.
Not just a laptop
- 08:47 — Binance: beyond the compromised DevOps engineer's laptop, the investigation "uncovered additional points of breach". A complex attack; the investigation is coordinated with law enforcement.
- 14:34 — co-CEO Richard Teng: the EIP-7702 delegation did not pass through Binance's normal approval controls, and the attacker then used a self-destruct mechanism to erase traces. Only hot wallets were hit; most customer assets sit in cold storage.
The DPRK trail — now on-chain
- 04:51 — ZachXBT: funds stolen from Binance, after passing through THORChain, were commingled at one address (0x1510…feb7) with funds from the $388M Bitget exploit. The Bitget exploit was earlier attributed to North Korea's TraderTraitor.
- Chainalysis sees the same commingling and names DPRK with a high degree of confidence. It puts the loss at $6.4B.
- MistTrack: stolen TRX went through the Bitget Wallet bridge, and the destination address had previously been used by the Phemex hacker.
How the funds are being laundered
- Chainalysis describes a pattern it has never seen before: thousands of transactions in a short period — clearly automated. Funds are cycled among addresses and sent back to earlier ones to confuse tracing.
- The attacker made a mistake: 18 tokens worth $3.32M went to the NEWT token contract address. Admin rights on that contract were renounced in 2025 — nobody can recover them.
What Binance is doing
- It set aside $6.34B of company funds. $5B is already held in the same assets (USDT, USDC, BTC, ETH, BNB); the remaining altcoins are being bought on the market and OTC. The ~$3B frozen is not counted.
- Withdrawals remain paused, with a target restart in about 40 hours, before Sunday. A reserves snapshot is promised first, a full proof-of-reserves by Monday. Deposits work.
Market
- BTC dipped below $77,000; liquidations reached about $1.57B.
- 13:57 — Aave re-enabled deposits and borrowing on V3 and V4. USDT, USDC, XAUT and PAXG can't be used as collateral for new loans for now.
What this means for you
- "Compensation" or "fast-track withdrawal" offers in DMs are phishing. Binance posts updates only on its official channels.
- The attacker's funds keep moving through THORChain, bridges and DEXs. Receiving them down the chain via P2P or OTC means a freeze risk.
- Check an incoming transfer before you send the money onward.
👉 Check an address: https://t.me/amlconsensus_bot?start=en
AML