The Binance hack started on the evening of October 29, 2026, and the exchange has been explaining it in public ever since. Binance puts the loss at about $6.3 billion. Elliptic counts $6.43 billion, and says it is the largest theft on record.
This post doesn’t try to solve the Binance hack. It lines up what Binance actually said, when it said it, and how the numbers moved. Every time below is UTC and comes from the post itself, not from a screenshot’s local clock.
Binance Hack Timeline: 20:05 To 21:29 UTC
Elliptic puts the first outflows at about 20:05 UTC on October 29, when five Binance wallets on the XRP Ledger sent 233 million XRP to one address. Over the next 30 minutes, hot wallets on nine more chains were drained. The biggest single movement on Ethereum landed at 20:24 UTC, per Elliptic’s write-up.
Binance’s first public line on the Binance hack came at 21:29 UTC, about 84 minutes after the first outflow. It said the team was aware of reports of a potential security issue and was investigating. It also said user funds were completely safe.
Two more posts about the Binance hack followed that night, one at 22:15 UTC about withdrawals and one at 23:06 UTC pausing Binance Alpha trading. Both repeated that user funds remained safe.
Frozen Funds In The Binance Hack: Three Counts
At 23:22 UTC Binance did something worth studying. It named a rival figure, $1.8 billion in frozen funds, said it was aware of it, and replaced it with its own verified total of $2.54 billion.
The frozen total kept climbing. At 00:52 UTC on October 30, Binance said the verified frozen amount was around $3 billion and that it would only share confirmed figures. Elliptic, counting on its own, has verified $2.84 billion as frozen, 44% of its total.
Most of that is Tether and Circle stablecoins. Elliptic’s chart splits the rest into what issuers can still freeze and what they can’t reach.
Times of Crypto Era published the same split earlier in the day from Elliptic’s 07:00 UTC snapshot, when the unreachable figure stood at $3.33 billion. It also checked the Ethereum leg on the chain itself. Its reporter framed what the split means:
Everything else sits on chains where no issuer can freeze it. That split defines this Binance hack, and it decides how much money Binance can realistically win back.
Times of Crypto Era, October 30, 2026
Read the full piece at Times of Crypto Era for the three loss counts side by side. Binance says about $6.3 billion, TRM Labs says $6.36 billion, and Elliptic says $6.43 billion. Elliptic’s figure leaves out $169 million it believes was Binance moving its own funds.
Binance Hack Cause: From Laptop To More Breach Points
The cause changed in public. At 02:25 UTC on October 30, Binance said its initial investigation suggested a compromised DevOps engineer’s laptop, which let an attacker reach a service container and submit unauthorized withdrawals. It added that it had found no evidence of a wallet private key leak.
At 08:47 UTC it posted an investigation update. The earlier theory, it said, was only part of it, since the inquiry had uncovered additional points of breach. It called the attack complex.
Elliptic’s reading of the chain is specific. It says the attacker abused EIP-7702 on Ethereum, sending one transaction at 20:20 UTC with 50 authorizations signed by the key of a Binance hot wallet known as Binance 14. Three and a half minutes later, the attacker’s contract emptied that wallet. Elliptic’s conclusion is that the attacker appears to have gotten Binance’s own systems to sign for them, rather than stealing private keys.
Binance hasn’t said what those points were. Of everything in the Binance hack, the cause is the least settled. Elliptic’s page points to access well beyond one laptop, and TRM Labs notes that no root cause has been published. TRM’s report attributes the attack to the North Korean group TraderTraitor with high confidence, while Elliptic calls North Korean involvement likely. As Elliptic’s own caveats say, no government has confirmed it, and Binance hasn’t named anyone.
What Teams Can Take From The Binance Hack
No team can script a loss this size. Still, the public record shows habits any team can copy. These are our reading of the public record, not a verdict on how Binance handled it.
First, dates and times. Because each Binance post carries an exact time, outsiders could check claims against the chain. The first line promised safety. By 00:13 UTC the line was a commitment to cover all losses. Both sit on the same timeline. Wording that ages badly stays visible.
Second, named numbers. Instead of ignoring the $1.8 billion figure, Binance quoted it and gave its own. Reporters could cite one corrected number rather than two competing ones. We cover the wider playbook in our first-hour hack guide.
Third, labels. The laptop line was introduced as an initial investigation, which made the later revision easier to read. Compare that with the Bybit case in our Bybit breakdown and the response to the KelpDAO exploit, where the order of statements also shaped coverage.
Still open in the Binance hack as of this writing: the root cause, the restart of withdrawals Binance expects within 48 hours, and the full post-mortem it said it would share. Binance’s X account is the place to watch.
News Coverage Agency helps crypto teams prepare incident statements before a Binance hack of their own, from the first holding line to the timed updates that follow. Tell us about your exchange or protocol and we’ll build the response plan with you.