Seven Days After $6.3B: What Actually Happened
Reconstructing the key moments of the largest exchange theft on record across three tracks: official notices, law-enforcement statements and market reaction. Only publicly disclosed facts are recorded; anything still under investigation is flagged as such.
10.29 · 20:05 UTC | The attack begins
Hot wallets across several Binance chains saw unauthorised withdrawals. The move was completed in roughly 20 minutes and touched USDT, USDC, BTC, ETH, BNB and others. TRM Labs later counted about $6.36B moved out of wallets spanning ten chains.
10.30 · Market | Majors dip
Bitcoin briefly broke below $79,000 intraday, down about 3.7% at its worst. ETH and other majors followed, and total crypto market cap pulled back sharply.
10.30 · Notice #1 | Engineer laptop in focus
Binance said the initial investigation pointed to a compromised laptop belonging to a DevOps engineer, used to reach service containers and submit unauthorised withdrawals. The exchange paused withdrawals, revoked approvals on affected addresses, and said it had found no evidence of private-key leakage.
10.30 · Notice #2 | $6.3B confirmed
Official estimate: about $6.3B affected. Binance set aside more than $6.34B of company funds for reimbursement, roughly $5B of it already held in the corresponding tokens, with about $3B frozen on-chain.
10.31 · Law enforcement | FBI names TraderTraitor
The FBI attributed the breach to the North Korea-linked group TraderTraitor and warned that stolen funds would be swapped and laundered. Pyongyang publicly rejected the accusation, calling it a "grave political provocation".
10.31 · Reimbursement | About 90% of the gap covered
Binance said roughly nine-tenths of affected balances had been made whole. BTC, ETH, USDT, BNB, SOL and USDC were fully backed at 100%; the remainder were thinner long-tail tokens bought in batches through secondary-market orders and OTC channels.
11.01 · 14:00 UTC+8 | Withdrawals resume in batches
The first wave covered 15 networks and their assets. Withdrawal requests spiked briefly, then normalised, while deposit inflows stayed elevated.
11.02 · Flows | Net withdrawals around $4.72B
By 2 November, customers had withdrawn about $4.72B net. Binance put net outflow since reopening at roughly 3% and launched fee rebates plus higher yields on earn products.
11.03 · Tracing | About $2.4B still with attackers
What was frozen is mostly stablecoins: roughly $1.57B from Tether, over $800M from Circle, about $200M from Ripple. BTC and ETH have no issuer to freeze them, so attackers still hold more than 420,000 ETH and about 18,000 BTC — roughly $2.4B.
Sources: Binance official security incident notices (30 Oct and 2 Nov 2026), FBI public statements, and reporting by Reuters, People's Daily and others. Compiled from public information; not investment or legal advice.