Live incident tracker · Theft on October 29, 2026, from 20:05 UTC
Binance hot-wallet theft: where the money is going
A live trace of the stolen funds on Ethereum, Bitcoin and Tron, built from public ledgers. Each dot moving along a line is value flowing between wallets. The tracker re-checks every wallet, every freeze and every new transfer every three minutes.
TRM Labs attributes the theft to North Korea's TraderTraitor group with high confidence. Chainalysis reached the same assessment independently, citing stolen funds seen mixing in real time with funds from last month's Bitget exploit, which had already been attributed to North Korea. Binance has not named an attacker and has not published a root cause. Totals are provisional and differ between trackers. This is an independent analysis, not affiliated with Binance.
Reported stolen (all chains)
Frozen by issuers, verified on-chain
Still movable by the attacker
Moved in the last hour
Wallets under watch
Live flow map
Left to right: Binance wallets, then attacker wallets, then each hop the funds took, then where they ended up. Circle size shows what a wallet holds now, and line width shows how much has flowed along it. Hover over anything for details, or click a wallet to open it in a block explorer.
Movement log
Every transfer above $50k into or out of the wallets we track, newest first.
| Time (UTC) | Flow | Amount | |
|---|---|---|---|
| Loading… | |||
Where it went
Value that left attacker wallets, by type of destination, at current prices. Moves between the attacker's own wallets are not counted.
Freezes reported by issuers
As reported by TRM Labs on October 30 at 00:30 UTC. Chainalysis puts total freezes at about $2.8B, ZachXBT at more than $2.83B, and Binance at about $3B.
| Issuer / body | Asset | Frozen |
|---|---|---|
| Tether | USDT (ETH, TRON, AVAX, Polygon) | ~1.77B |
| Circle | USDC | ~825M |
| Ripple | RLUSD | 40.5M |
| Arbitrum Security Council | 8,426 ETH + 74.6M ARB | ~$30M |
| World Liberty Financial | USD1 | 27.8M+ |
| Total (TRM) | ~$2.7B |
Tron watchlist: wallets set up but not yet funded
A new Tron wallet has to receive some TRX before it can be used. Chainalysis describes laundering wallets that each get exactly 1 TRX before larger amounts arrive. These wallets received exactly 1 TRX from an attacker wallet, or from the account that activated one. The tracker checks each wallet on-chain: used means it has handled funds since, unused means it has only the 1 TRX so far and is worth watching.
Bitget-exploit link check
Chainalysis' main attribution evidence is Binance-theft funds mixing with funds from September's Bitget exploit, which has been linked to North Korea. We watch the two Bitget-exploiter wallets TRM published, plus the wallets they paid, and flag any transfer connecting them with this trace on Ethereum.
By chain
The "reported" figures are TRM Labs' per-chain totals. Ethereum, Bitcoin and Tron are tracked live. The other chains show reported figures only, because no full attacker addresses for them had been published in the sources we checked.
How it unfolded
All times are UTC and come from public reporting; sources are listed below. The mechanism is as reported and has not been confirmed by Binance.
- Three small Tornado Cash withdrawals fund the attacker's operator wallet. TRM, drk.vc
- Rehearsal EIP-7702 delegations on throwaway accounts. The final "sweeper" contract is deployed at 15:59, and a last test sends funds back to the operator. drk.vc, TRM
- Five Binance XRP wallets send 233.46M XRP. TRM
- Outflows begin on Base, Optimism, Bitcoin and Tron. At 20:20 a Binance Bitcoin hot wallet sends 18,270 BTC, and a Tron hot wallet sends 612.7M USDT and 46.4M TRX. drk.vc, TRM
- A type-4 transaction with 50 pre-signed EIP-7702 authorizations takes over Binance 14: the wallet's code now points to the attacker's sweeper contract. drk.vc, Blockaid
- Sweep 1 moves about 167,464 ETH plus 63 tokens (about $2.5B) from Binance 14 to the exploiter hub. drk.vc
- The loot is split. $500M of stablecoins goes to a swap wallet; over about 20 minutes, $325M of it becomes $285M of ETH (about 122k ETH, consolidated in one wallet). The other $175M goes to a stopover wallet, where it is later frozen. 60M USDT is posted to Aave to borrow 19,762 WETH, and about 195,460 ETH is parked in one wallet at 20:38. Chainalysis, drk.vc, TRM
- 780M USDC is pulled from Binance Hot Wallet 34, which lists Binance 14 as an operator, with another 43M at 20:59. drk.vc
- Tether and Circle freeze the hub. drk.vc and TRM put the first freeze at 21:01; Chainalysis dates the start of freezes to 21:14. Later sweeps follow at 21:04 and 21:44. drk.vc, TRM, Chainalysis
- A second wave hits Binance wallets on Avalanche and Polygon. At 23:35 Binance reports $2.54B verified frozen. TRM
- Binance co-founder Yi He confirms the hack and says Binance will cover all losses. At 00:08 Arbitrum's Security Council forces funds out of the attacker's wallet. TRM, cryptoticker
- The delegation on Binance 14 is revoked. At 02:30 Binance updates its estimate of the total impact to about $6.3B. drk.vc, cryptoticker
- Chainalysis announces its TraderTraitor attribution. It describes automated laundering: thousands of transactions, funds cycled back to earlier addresses, and new wallets that each receive exactly 1 TRX before larger amounts arrive. Chainalysis
Published attacker addresses (tracking seeds)
These are the full addresses published in on-chain reporting, each checked against live balances before tracking began. Every wallet further along the map was found by following the money from these.
Method and caveats
- Data sources: Ethereum through Blockscout, Bitcoin through mempool.space and Tron through TronGrid. Prices come from CoinGecko, mempool.space and Blockscout. Every value is shown at current prices, so totals drift with the market.
- How wallets are added: starting from the published attacker addresses, any wallet that receives ≥ $500k (ETH/TRON) or ≥ $3M (BTC) from a tracked wallet becomes tracked itself, up to a set depth. Smaller transfers are counted but not followed. Contracts such as DEX pools, lending markets, bridges and mixers count as destinations and are not followed further.
- Frozen: "verified" means the tracker called the issuer's blacklist function on-chain (USDT isBlackListed, USDC isBlacklisted) and got true. USD1 and XAUT on the hub are counted as frozen because issuers reported it; the tracker can't check those directly.
- Labels: names like "Binance 14" or "Hot Wallet 34" come from block-explorer tags, or from matching the truncated addresses given in reporting. "Hop wallet" only means the money passed through that address. It is not an attribution.
- What this cannot see: trades made off-chain (OTC desks, exchange internal ledgers), the XRP, Solana and smaller-chain legs, and anything the tracker hasn't linked yet. A hop wallet first active during or after the theft, and funded by attacker wallets, is treated as attacker-controlled. A hop that was already active before October 27 is marked "unclear". It is probably an exchange, market maker or OTC desk handling other people's money too, so it is left out of the totals and not followed.
- If you're an investigator: treat this as leads to check, not as evidence. Always confirm on the explorer links.
Sources
- TRM Labs: North Korea steals USD 6.36 billion from Binance (per-chain totals, freezes, attribution)
- Chainalysis: Binance exploit, latest findings and response (~$6.4B total, ~$2.8B frozen, swap and stopover flows, attribution evidence)
- drk.vc: How Binance 14 was emptied through an EIP-7702 delegation (attacker addresses, mechanism, timeline)
- CryptoTicker: Binance hack on-chain analysis (hub and parking-wallet balances)
- CoinDesk · The Block · TechCrunch · Axios