DeltaSignal Research

Research · Event reports

The Binance Hack, in Full

Event report · October 31, 2026 · PDF, 14 pages

Abstract

On October 29, 2026, about $6.3 billion left Binance in roughly twenty minutes, across ten blockchains: the largest crypto theft on record. Binance’s proof of reserves showed the money was there. It could not show who was able to move it. This report is the full record. The money was taken through a compromised engineer’s laptop that reached the service used to submit withdrawals; there is no evidence that a wallet private key leaked. Of what was taken, $2.84 billion stands independently verified as frozen, against Binance’s own figure of about $3.0 billion frozen in total, and the report prints both, with their owners, side by side. Nothing has been returned by the attackers. Binance states it has replaced about 90 percent of the stolen assets from its own money, with the ten largest tokens fully backed again, and $6.34 billion set aside so users bear nothing. TRM Labs and Chainalysis attribute the theft to North Korea’s TraderTraitor group, and on October 31 the FBI made the same attribution officially. Two checks remain: withdrawals reopen in phases from Sunday, November 1, and the full zero-knowledge proof of reserves is estimated for Tuesday, November 3; a fresh snapshot, taken at 00:00 UTC on October 31, is already published.

Inside the report

• The money, chain by chain: what left, where it went, and what is frozen
• The timeline: twenty minutes on October 29, and the days that followed
• How the signing failed: one engineer’s laptop and the withdrawal service
• How the freezes work: Tether, Circle, and the partner freezes
• Replaced, not returned: Binance’s own money and the $6.34 billion set aside
• The tripwires: what to watch, and the two checks, November 1 and November 3

Get the report

Leave your email and we send you the full report, with a link that saves it to your shelf on our site. One email. No password, nothing to install.