How did $6 billion leave Binance?

I wanted to understand the Binance hack beyond the number in the headline. More than $6 billion. That is already difficult to imagine. But the part that kept my attention was how those transfers could happen in the first place.

On October 31, 2026, the FBI attributed the theft to North Korea, calling the activity TraderTraitor. Binance had already acknowledged the incident. So I wanted to follow the sequence: what happened, what connects it to North Korea, and how much of the money actually came back?

That last question turns out to be more complicated than it sounds. Frozen, recovered, replenished. They sound close enough when you skim a headline, but they mean very different things.

Here is what I could put together from public sources, checked on November 2, 2026. The investigation is still developing, so I’ll keep the gaps visible too.

First, let’s put the events in order

I’m using UTC throughout this timeline. In Bangkok, add seven hours: 20:05 on October 29 becomes 03:05 on October 30. The date can look different depending on where you read the news.

October 28–29: preparation

Blockaid’s reconstruction describes an operator wallet funded through Tornado Cash, small rehearsals, and deployment of the eventual sweeper contract at approximately 15:59 UTC on October 29. These transactions date visible preparation; they do not tell us when the attacker first entered Binance’s systems.

October 29, around 20:05: the first reported drains

TRM Labs places the first theft on the XRP Ledger between 20:05 and 20:09, when five Binance wallets sent approximately 233.46 million XRP to one address. Solana and Optimism activity followed. Around 20:20, a Bitcoin hot wallet transferred approximately 18,270 BTC; Tron transfers followed within minutes.

October 29, 20:20–20:24: Ethereum delegation and sweep

Blockaid identifies an authorization transaction at 20:20:59. It carried 50 signed authorizations for Binance 14, a busy Ethereum hot wallet, covering consecutive transaction counters. One matched the wallet’s counter and delegated execution to the attacker’s code. The major sweep followed at approximately 20:24, moving roughly $2.5 billion. Blockaid’s technical account

October 29, later that evening: disclosure and containment

Crystal Intelligence’s timeline records Binance’s public investigation statement around 21:16 and announcements of substantial Circle and Tether freezes shortly afterward. An announcement’s timestamp is not necessarily the timestamp of the underlying freeze transaction.

TRM reports repeated sweeps of new funds arriving at the Ethereum wallet, extending through 23:56. Its estimate that most of the theft occurred in about 20 minutes should not be read as the duration of the entire operation. TRM’s reconstruction

October 30–November 1: intervention, attribution and reopening

At 00:08 UTC on October 30, Arbitrum’s Security Council acted to secure assets associated with the exploit. The FBI published its attribution on October 31. Binance began restoring withdrawals in phases on November 1, a reopening independently reported by Reuters. Arbitrum’s record, FBI alert, Reuters, via MarketScreener

The part I find unsettling: a valid signature

Usually, when I think about a stolen wallet, I think about someone getting the key. That is an easy picture to hold in my head. This case makes me think more about the machinery around it.

Binance’s initial announcement said a compromised DevOps engineer’s laptop may have allowed access to a service container that submitted unauthorized withdrawals. A subsequent update identified additional breach points and said investigators had found no evidence of leaked wallet private keys. That is a preliminary account, not a completed explanation.

On Ethereum, the public reconstruction centers on EIP-7702. This feature allows an ordinary account to authorize execution using another address’s code. The Ethereum specification describes that delegation and its signature checks. Giving the wrong code that authority can have consequences beyond a single payment.

Imagine a vault with a machine that opens the door when it receives a signed instruction. You keep the key inside a secure box. But someone gains control of the system that asks the box to sign. The key can stay exactly where you left it while the machine receives instructions you never intended to approve.

That is the distinction I want to hold onto here. A signature can be valid while the action is unauthorized. We still have to ask who requested it, what they were allowed to request, and why the system accepted it.

Crystal’s investigation describes abuse of this delegation mechanism. It does not establish a break in Ethereum’s cryptography. Nor can EIP-7702 explain the Bitcoin transfers: a broader compromise must account for activity across different signing systems. The full internal sequence still needs Binance’s forensic report. Crystal’s analysis

What connects the theft to North Korea?

The FBI’s alert is an official attribution. It names TraderTraitor and describes investigators observing conversion of stolen assets primarily into ETH. It also publishes associated addresses and asks services to block linked transactions. The alert does not disclose the complete intelligence behind that conclusion. FBI statement

The detail I find more useful than “this looks like an earlier hack” comes from Chainalysis. Its investigators say Binance proceeds mixed with funds from the earlier Bitget theft attributed to North Korean actors. They say that connection strengthened their TraderTraitor assessment. There is a specific money trail to examine, even though it does not identify every person involved.

For context, the FBI previously attributed the approximately $1.5 billion Bybit theft of February 21, 2025 to TraderTraitor. That earlier case helps explain the investigative background. It is not, by itself, proof of responsibility for Binance. FBI’s Bybit alert

Did they get the money back?

This is where I had to slow down. The reports contain several enormous numbers, and it is easy to put them together as if they describe the same thing.

Figure	What it describes
About $6.3 billion	Binance’s estimate of the stolen assets.
$6.36 billion	TRM’s estimate of the theft.
$6.43 billion	Elliptic’s estimate of the theft.
About $3 billion frozen	Binance’s reported containment total.
More than $6.34 billion allocated	Company resources Binance said it set aside to cover losses.
95% replenished	Binance’s November 1 statement about replacing affected assets.

Sources: Binance Update #2, TRM, Elliptic, Binance Update #4.

Frozen funds are not automatically returned funds. Freezing stops movement. Getting those assets back is another step. Replenishment means something else again: Binance says it bought replacement tokens using company resources.

If someone takes your money and you replace it from another account, you have filled the gap. The person who took it may still have the original money. That is why I would not read “95% replenished” as “95% recovered from the attackers.”

Elliptic reported approximately $2.85 billion frozen or seized in its November 1 update. Its total should retain that date and methodology, rather than being silently substituted for Binance’s rounded figure. Elliptic’s findings

Trying to stop the money from moving

Some tokens have issuers able to freeze balances. Native assets such as Bitcoin and Ethereum’s ETH have no equivalent issuer-operated freeze. That creates an incentive to convert stolen tokens before restrictions arrive. Chainalysis describes rapid stablecoin-to-ETH swaps during the response. Chainalysis investigation

Arbitrum provides a different example. Its Security Council announcement records emergency action over 8,425 ETH and 74,559,805.2 ARB. The assets were moved to an address whose funds require an ArbitrumDAO governance vote to move again. This was a network-governance intervention, not an issuer freezing Ethereum mainnet ETH.

Customer access was another part of the response. Binance’s November 1 update described a phased reopening, with further asset/network combinations dependent on checks. Restoration on selected networks should not be described as universal availability.

After reopening, Binance reported approximately $4.65 billion in withdrawals and $1.01 billion in deposits through 15:30 UTC on November 1. The resulting $3.64 billion net outflow was customer activity following the incident, separate from the theft itself. The Block’s reporting

The money did not stop moving when the first withdrawals stopped. In its October 31, 22:41 UTC update, Elliptic tracked about $196 million leaving a main Tron distribution wallet for roughly 200 wallets. It put the pace at $7–11 million an hour. That is one observed part of the laundering, at that time, rather than a total for the whole theft. Moving funds between wallets also does not establish that the attacker cashed them out.

What I’m still waiting to understand

I still want to know how the attacker got from an initial foothold to this much authority. Which controls should have stopped the requests? What were the additional breach points? Those are questions for the promised post-incident report. “A compromised laptop” leaves a lot of the journey unexplained.

Reserve reporting also needs precise dates. Binance’s October 31 update said an October 31 snapshot was available and estimated the full zero-knowledge proof for November 3. Earlier material targeted November 2. This article has not independently verified completion of that full proof or audited Binance’s finances.

Finally, automation is not proof of AI. Elliptic describes patterns consistent with scripted laundering, including repeated transfers and activity through the night. It explicitly says on-chain data cannot determine whether AI agents or conventional scripts performed the work.

What stays with me is the signing problem. We put so much attention on keeping a secret safe, and we should. But I also want to know what the system holding that secret can be persuaded to do.

The money makes this story enormous. That smaller question is what makes it worth understanding: what are we trusting when we accept a valid signature?

Okay, one video before we go

Joma Tech’s reaction to the hack feels like a good place to end this one :D

Sources and scope

Links beside each claim lead to the relevant announcement or investigation. Binance is the primary source for its own operational statements; those statements are not independent assurance. The FBI supplies the official attribution. Blockchain analysis firms supply reconstructions and assessments. Arbitrum documents its own intervention, while Reuters and The Block provide reporting on the response.

The main references, grouped by what I used them for:

• FBI: Binance attribution alert — official attribution, October 31, 2026. Its Bybit alert supplies the separate historical context.
• Binance: initial incident statement and Update #2 — the company’s preliminary account and funding statements, October 30.
• Binance: Update #3 and Update #4 — reserve-proof timing, replenishment and phased reopening, October 31–November 1.
• Blockaid: Binance incident analysis — preparation, signed authorizations and the Ethereum sweep.
• TRM Labs: theft reconstruction — the timeline across blockchains and its theft estimate.
• Crystal Intelligence: investigation and response timeline — delegation analysis and public-response chronology.
• Ethereum: EIP-7702 specification — how account-code delegation works; background, not an incident report.
• Chainalysis: tracing the North Korea link — the Bitget connection and swaps ahead of freezes.
• Elliptic: theft analysis and laundering analysis — dated totals, frozen/seized funds and observed automation.
• Arbitrum: Security Council emergency action — the network’s own intervention record, October 30.
• Reuters, via MarketScreener: withdrawal reopening and The Block: customer outflows — reporting on November 1.

This article does not claim an independent forensic reproduction. The Ethereum authorization transaction cited by Blockaid could not be retrieved through the research tool. Transaction-level details here remain attributed to the investigators. Figures and service status describe the dated sources, not a live incident dashboard.

The banner is AI-generated artwork, imagining a vault, diverted transaction paths, and an anonymous hacker at a laptop. It is a visual metaphor, not a depiction of Binance’s systems, an identified attacker, or evidence of the attack.