Binance Exploit: Latest Findings and Response

What it is

Chainalysis's 30 October 2026 incident update on the theft of about $6.4 billion from Binance hot wallets, which began around 4:20 p.m. Eastern on 29 October 2026. Chainalysis attributes it to North Korean group TraderTraitor. The summary covers the attribution evidence. This note adds the timeline and the attacker's handling of freezable assets.

How it works

On Ethereum, the attacker used an operational wallet funded through Tornado Cash. It submitted valid signed authorizations that let a Binance hot wallet run attacker-deployed code, then called that wallet to sweep its assets to attacker-controlled addresses. Other affected Binance wallets appeared to send funds through ordinary signed transfers. Transfers across all affected chains totaled about $6.4 billion.

The attacker raced stablecoin issuers' freezes:

• Roughly $500 million in stablecoins went to a wallet built to swap freezable assets into non-freezable ones.
• Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH.
• Ten minutes later it sent the remaining $175 million in stablecoins to stopover wallets, likely to outrun a blacklist.
• The first freezes landed at 5:14 p.m. Eastern, about 54 minutes after the first outflows.

Chainalysis announced the TraderTraitor attribution at 12:30 a.m. Eastern on 30 October.

The laundering is automated: thousands of transactions in a short period, with funds circulated among addresses and often returned to earlier ones. Many addresses first receive exactly 1 TRX, then more funds, then forward them. Chainalysis says it has not seen this pattern before.

What to do

The page gives no commands, addresses or detection rules. Its response guidance is limited to this: stolen-fund leads were shared with industry partners and issuers, and freezes worked best when parties acted in parallel and quickly. About $2.8 billion has been frozen so far. Chainalysis says every exchange should be prepared to respond quickly to an attack.

Caveats

• The attribution is a Chainalysis intelligence assessment based on on-chain behavior in the hours after the hack, not a law enforcement finding.
• The page does not say how the signing authority or keys were compromised.
• The investigation is ongoing, and Chainalysis expects the funds to keep moving in the coming days.
• The $2.8 billion frozen figure is current only as of the post.