AnswersPublished33 sources
Binance’s $6.36 Billion Hack: What We Know About the Theft and Laundering
About $6.36 billion left Binance wallets across 10 blockchains on October 29, 2026, mostly within roughly 20 minutes. By November 4, reports said about 81% of the stolen SOL had left tracked attacker wallets.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- About $6.36 billion left Binance wallets across 10 blockchains on October 29, 2026, mostly within roughly 20 minutes.
- By November 4, reports said about 81% of the stolen SOL had left tracked attacker wallets.
- Frozen funds, assets still linked to attacker wallets and Binance’s customer loss coverage are different measures—not interchangeable forms of recovery.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What is known about the Oct. 29 Binance hack that stole approximately $6.36 billion across 10 blockchains, mostly within 20 minutes, includi. Article summary: The available sources support a roughly $6.3–$6.4 billion Binance theft on Oct. 29, 2026, North Korean attribution, substantial movement of stolen SOL, and a THORChain outage that inadvertently delayed laundering. They d. Topic tags: general, government, general web, user generated, news. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermar
The October 29, 2026, Binance theft moved an estimated $6.3–$6.4 billion in cryptocurrency across multiple blockchains, with most transfers occurring in about 20 minutes. The FBI attributed the theft to North Korea’s TraderTraitor group. Meanwhile, blockchain trackers followed stolen assets through cross-chain routes, and a THORChain outage briefly disrupted swaps. 1
12
58
The numbers are estimates from different investigations, not one reconciled ledger. It is also important to distinguish funds that have moved, funds that have been frozen, and customer losses Binance says it will cover.
What happened, and who was blamed?
TRM Labs estimated that about $6.36 billion left Binance wallets across 10 blockchains, mostly in roughly 20 minutes beginning at 20:05 UTC. Other analyses produced different totals and chain counts: Elliptic estimated $6.43 billion across 11 blockchains, while Bitquery tracked about $6.3 billion across nine. Those differences reflect separate analyses, rather than a single agreed total. 12
58
19
The FBI said North Korea was responsible and named the activity TraderTraitor. The bureau also said it had observed the actors converting stolen assets primarily into ether. 1 North Korea rejected the accusation. CoinDesk reported that Kim Yo Jong called the allegations a political provocation, while Reuters reported North Korea dismissing them as “absurd rhetoric.”
56
48
Reports have pointed to compromised systems connected to Binance’s wallet-signing process, but the material available here does not establish a complete forensic account of how the attackers gained access. 5
16
What happened to the stolen Solana?
By November 4, reports citing blockchain tracking said roughly 81% of the 970,522 SOL attributed to the theft had left wallets associated with the attackers. Arkham-tracked wallets reportedly held 182,443 SOL, valued at about $16.9 million at the time. 22
29
Reports described the SOL being split across wallets and routed through conversions and cross-chain swaps, including THORChain. Some accounts described a path involving USDC and Ethereum before funds moved toward bitcoin. These are tracking reports, not proof that every asset followed the same route or that transferred tokens were all sold or cashed out. 23
29
That distinction matters when considering market effects. One report noted a short-term SOL price decline during the period of the theft, but the sources available here do not establish how much the hack contributed to broader price movements or verify the wider claims about October performance, short positions, ETF flows or exchange deposits. A transfer to an exchange, by itself, does not confirm a sale. 28
Why THORChain paused swaps—and what reopened
On October 31, an Ethereum block reorganization affected a 10 ETH deposit on THORChain. Reports said the protocol issued a duplicate refund and then paused swaps as an emergency response. Chainalysis said the interruption inadvertently delayed laundering linked to the Binance theft because users, including the suspected attackers, could not swap through many of THORChain’s bridges during the pause. 38
46
After the v3.21.1 update, THORChain resumed swaps involving Bitcoin, Ethereum and nine other listed assets. Solana, BNB Smart Chain and Cosmos Hub remained paused, according to the reopening report. 41
A separate report attributed to Grey Ledger said 41 swaps associated with addresses it was tracking completed within 25 minutes of swaps reopening, with 368.12 ETH paid out. That is a reported tracking result, not a complete accounting of the stolen funds or proof that every receiving address was controlled by the same actors. 42
The FBI asked cryptocurrency services, including THORChain node operators, to restrict transactions tied to the theft. Its published list included 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address. THORChain’s independent node structure complicates any simple account of how such a request translates into action across the protocol. 34
40
60
Frozen funds, remaining balances and customer coverage
Elliptic reported that issuers Tether and Circle had frozen about $2.8 billion in stablecoins linked to the theft. Other estimates also put frozen or intercepted assets in the billions, but the totals vary by source and reporting date. 52
60
Separate estimates placed roughly $3.21 billion to $3.25 billion in addresses linked to the theft, mostly as bitcoin and ether. These are time-specific tracking estimates; an asset remaining in a linked wallet is not the same as an asset being recovered, and a frozen balance is not the same as an attacker’s remaining balance. 53
60
Binance said it would cover customer losses. A report published November 4 said the exchange had replenished about 98% of the affected amount. That customer coverage is distinct from recovering the stolen cryptocurrency from the people who took it. 27
50
What the evidence does—and does not—show
The strongest supported picture is a very large, rapid theft; an FBI attribution to North Korea’s TraderTraitor group, which North Korea denied; substantial movement of stolen SOL; and a THORChain pause that temporarily interrupted cross-chain swaps. 1
12
22
38
56
The available sources do not support treating every reported transaction route as confirmed, equating movement with successful cash-out, or assigning the hack a proven role in Solana’s broader price direction. Estimates of what was frozen, what remains in theft-linked wallets and what Binance has replenished describe different things—and should be read separately.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Binance’s $6.36 Billion Hack: What We Know About the Theft and Laundering"?
About $6.36 billion left Binance wallets across 10 blockchains on October 29, 2026, mostly within roughly 20 minutes.
What are the key points to validate first?
About $6.36 billion left Binance wallets across 10 blockchains on October 29, 2026, mostly within roughly 20 minutes. By November 4, reports said about 81% of the stolen SOL had left tracked attacker wallets.
What should I do next in practice?
Frozen funds, assets still linked to attacker wallets and Binance’s customer loss coverage are different measures—not interchangeable forms of recovery.
Sources
fbi.govNorth Korea Responsible for $6 Billion+ Binance Attack — FBI
trmlabs.comNorth Korea Steals USD 6.36 Billion From Binance in the ...
elliptic.coThe largest theft in history: North Korea behind the $6.4 billion Binance hack | Elliptic
bitquery.ioBinance Hack: $6.3B Drained on 9 Chains, $2.7B Frozen