We Traced The $6.3B Binance Hack, And Half Of It Is Already Frozen
The Binance hack took an estimated $6.3 billion in under three hours on Thursday night, and blockchain records now show where most of it went: about half is frozen, about $480 million in Ether sits in two wallets the attacker controls, and the rest is spread across other chains.
Key Takeaways
- Binance puts the total impact at about $6.3 billion, with about $3 billion frozen so far
- One Ethereum transaction emptied the hot wallet known as Binance 14, taking 167,464 ETH, 1.6 billion USDT and 62 other tokens
- The attacker used EIP-7702, an Ethereum feature added in 2025, and 50 signed approvals collected ahead of time
- Stablecoins were the attacker’s weak spot, as Tether and Circle locked about $2 billion inside its main wallet within hours
- About 214,700 ETH, worth roughly $480 million, has been moved to two new wallets that no one can freeze
Fathom first reported the outflows as they happened on Thursday night. This is the full picture after a night of tracing the money on chain.
The Night Hour By Hour
Times come from blockchain records or the posts linked below.
| Time (UTC) | What happened |
|---|---|
| Thu 15:59 | The attacker deploys the contract it will later install on Binance 14 |
| Thu 20:10 | First outflows from Binance hot wallets, according to Arkham |
| Thu 20:24 | Binance 14 is emptied in one transaction |
| Thu 20:38 | The attacker moves 195,460 ETH to a fresh wallet |
| Thu 20:41 | Binance Hot Wallet 34 sends 780 million USDC to the attacker |
| Thu 21:25 | Tether says it has frozen more than 1.567 billion USDT |
| Thu 23:05 | Last hot wallet outflow counted by Arkham |
| Fri 00:52 | Binance says “around $3 billion” is frozen |
| Fri 02:25 | Binance puts the impact at about $6.3 billion and blames a compromised engineer’s laptop |
| Fri 04:36 | Binance says withdrawals should restart within 48 hours |
| Fri 05:15 | The attacker sends 17,260 ETH from token sales to another new wallet |
Also Read: $2.8B Pours Out Of Binance Wallets In One Night In Suspected Hack
How Much Was Taken
Binance said the “estimated total impact sits at around $6.3B.” Blockchain analytics firm Arkham counted $6.01 billion leaving Binance hot wallets on nine blockchains, and Chainalysis put the figure at $6.4 billion. The gap between them mostly comes down to which prices each firm used and which smaller chains it counted.
Ethereum is where the biggest piece went, and every transfer there is public. The single sweep of Binance 14 took:
- 167,464.25 ETH, worth about $388 million at the $2,315 price at the time
- 1,615,409,498.97 USDT
- 62.6 million RLUSD, 27.8 million USD1 and 9.7 million USDe in other stablecoins
- 7.18 trillion PEPE, 198.4 million ENA, 6.19 million UNI, 2.26 million LINK and 127,853 AAVE
- 11,372 ounces of tokenized gold in XAUt and 1,898 in PAXG, plus 82.5 WBTC
Two more Binance wallets were drained into the same address. One sent 28,005.6 ETH and 55.7 million USDT, and Binance Hot Wallet 34 sent 780 million USDC and then 43 million more. The attacker also went back to Binance 14 twice, taking another 1,699.9 ETH and 204.3 million USDT.
In total, the attacker’s main Ethereum address received 197,169.8 ETH, 1.875 billion USDT and 823 million USDC from Binance. That is about $3.1 billion on Ethereum alone, before the dozens of smaller tokens and the losses on Bitcoin, TRON, Solana and other chains.
Where The Money Is Now
Following the main address on Etherscan gives a clear split.
Frozen stablecoins. The USDT and USDC contracts both list the main address as blacklisted. It still holds 1,175,464,712 USDT and 823,000,000 USDC, about $2 billion that cannot move. Another 700 million USDT was sent to two other addresses that are also blacklisted. Circle CEO Jeremy Allaire said the USDC freeze was done “in coordination with law enforcement.”
Other freezes. Binance co-founder Yi He thanked Ripple for freezing about $200 million, World Liberty Financial for freezing $27 million in USD1 and about $2 million in WLFI, and the Arbitrum Security Council for freezing about $30.5 million.
Ether the attacker still controls. The wallet that got 195,460 ETH, plus 2,000 more later, holds 197,460 ETH, worth about $442 million on Friday morning. It has not moved a coin since.
Sold tokens. The stablecoins were stuck, but the smaller tokens could still be sold. Over the night, the main address made more than 500 trades through Uniswap routers and about 90 through other swap routers, selling PEPE, SHIB, ENA, RSR, SAND and dozens more. Etherscan records show the sales brought in about 17,200 ETH, worth about $38 million. At 05:15 UTC that Ether went to a new address, which now holds 17,260 ETH. The main wallet is left with just 3 ETH.
Other chains. Arkham said about $2.9 billion in ETH, BTC, TRX, SOL and other tokens remained movable as of Friday morning. Binance has not yet broken down its losses by chain.
How The Attack Worked
Binance said its first findings point to “a compromised DevOps engineer’s laptop,” which let the attacker reach a service container and “submit unauthorized withdrawal transactions.” It said it found “no evidence of any wallet private key leak” and will publish a full technical report.
The Ethereum records show how a stolen laptop could empty a wallet without a stolen key. Security researcher 0xQuit traced the sweep to EIP-7702, an Ethereum upgrade from 2025 that lets a normal wallet borrow the code of a smart contract once its owner signs an approval. The attacker deployed its contract at 15:59 UTC. About four hours later it used a signed approval to install that contract on Binance 14, and the contract then sent everything out in one go.
The approvals were collected in advance. 0xQuit found that the drain transaction carried 50 approvals with numbers in sequence, a sign the attacker gathered signatures over time before using them. The account that sent the transactions was funded through Tornado Cash, a privacy tool, so its owner is hard to trace.
In plain terms, the attacker did not need Binance’s keys. It needed Binance’s own systems to sign the wrong thing, and an engineer’s laptop gave it a way in.
Who Is Behind It
Chainalysis said it has “a high degree of confidence” that North Korea carried out the attack. Its investigators saw money stolen in last month’s Bitget hack “commingling with funds stolen from Binance.” If that holds, it would be the second record crypto theft in a row tied to North Korea, after the FBI blamed it for the roughly $1.5 billion Bybit hack in February 2025. Binance has not named a suspect.
Bigger Than Every 2026 Hack Combined
| Victim | Date | Amount taken | Source |
|---|---|---|---|
| Binance | Oct. 29, 2026 | About $6.3 billion | Binance |
| Bybit (previous record) | Feb. 21, 2025 | About $1.5 billion | FBI |
| Bitget | Sept. 24, 2026 | $387.5 million | Bitget |
| Kelp DAO | April 18, 2026 | About $291 million (163,200 ETH shortfall) | CertiK, Kelp DAO |
| Drift Protocol | April 2026 | About $285 million | CertiK |
Security firm CertiK counted $1,315,676,432 lost across 344 security incidents in the whole first half of 2026. Binance lost almost five times that in one night. Even the Ether alone that the attacker still controls, about $480 million, is bigger than any other hack this year.
Why Half Of It Could Be Frozen
The Bybit hack in 2025 hit an Ether wallet, and no company can freeze Ether. This attacker took a lot of stablecoins, and that turned out to be its weak spot. Tether and Circle can block any address on their token contracts, and both did so within about an hour. Ripple, World Liberty Financial and Arbitrum’s security council used similar powers.
That is why Binance’s frozen total climbed from $2.54 billion at 23:22 UTC to about $3 billion by 00:52 UTC. It is also why the attacker spent the night selling smaller tokens for Ether, which cannot be frozen.
What Happens To Customers
Binance said it “will cover all losses from the SAFU fund and the company’s funds” and that user funds are safe. SAFU is the emergency fund Binance set up in 2018 to cover hacks. The exchange also plans to publish an updated proof of reserves. Deposits are working, while withdrawals stay paused as it rebuilds its withdrawal system, with a restart expected within 48 hours.
Founder Changpeng Zhao, who no longer runs the exchange, wrote on Friday: “It hurts, but we will survive.”
Markets took the hit calmly. On Friday morning BNB was down 5.2% over 24 hours at $715, Ether was down 3.6% at $2,237 and Bitcoin was down 2.2% at $78,409, according to CoinGecko data.
Read Next: Solana Hits $5B In Wall Street Style Tokens
What We Still Do Not Know
- How the attacker turned access to one laptop into 50 signed approvals, which Binance’s technical report should explain
- How much was lost on each chain outside Ethereum
- Whether the frozen $3 billion will be returned to Binance, and how fast
- Where the 214,700 ETH in the attacker’s two wallets goes next
