The Binance hack, block by block: 50 signatures, a sub-$1 fee and a $200M top-up

Binance says about $6.3 billion was taken on the night of Thursday 29 October, most of it in about 20 minutes. It is the largest theft crypto has seen. It also happened in public, on blockchains anyone can read.

We run our own Bitcoin node and our own Ethereum archive node, so we went through the night block by block. Most of what follows comes straight from those nodes. Where it comes from someone else, we say so. All times are UTC.

The night, second by second

Fifty tickets

Every Ethereum wallet has a counter that goes up by one with each transaction. Since May 2025, a wallet can hand control to a program with a signed permission, but that permission only works at one exact count. Binance's wallet, known as Binance 14, was sending about 11 transactions a minute, so the count was a moving target.

The attackers brought 50 signed permissions, one for each number from 18,914,775 to 18,914,824. That range covered about six and a half minutes of the wallet's life, from 20:17:47 to 20:24:23. Their transaction landed at number 18,914,809, the 35th. The other 49 did nothing. One was enough.

Three minutes and 24 seconds

Then, nothing happened. For 204 seconds the wallet belonged to the attackers and carried on working as usual. Our node shows 15 more payouts going out in that gap.

The sweep itself was one transaction, worth about $2.5B on Elliptic's count. It paid 0.00041 ETH in fees, under a dollar. It wasn't the only thing to go through: Binance's system kept paying customers in USDC, through the same wallet, for another nine and a half minutes.

When Binance pulled the plug

Binance hasn't said when it stopped withdrawals. The chain does. The Ethereum wallets on its list were sending about 350 transactions every 10 minutes. The last one left at 20:44:59. Apart from the hijacked wallet and one top-up, they then sent nothing for two hours. On Bitcoin, the last payouts from its listed wallets came in the block at 20:48:14.

That is 39 minutes before its first public statement. It looks like the moment someone at Binance hit the switch.

The $200 million top-up

This is the part we haven't seen reported anywhere. At 21:42:59, 18 minutes after that first statement, a wallet on Binance's published list sent exactly 200,000,000 USDT to Binance 14. The attackers still controlled it.

That wallet had sent the same amount to the same place on 25 October and twice on 26 October, so this looks like a routine top-up that nobody had stopped. The sweeper took it 72 seconds later. But the sweeper's destination was the wallet Tether had frozen 41 minutes earlier, so the $200M went straight into the freezer. It's there now.

Where the money is now

Read from our nodes at 18:00 UTC on Friday:

• Frozen: $1.18B of USDT and $823M of USDC, in that one wallet. Binance puts all frozen assets at about $3B.
• Not frozen: 197,460 ETH sits in one wallet that has never sent a transaction.
• Bitcoin: all 18,270.2 BTC sits in 19 wallets, 17 of them holding exactly 1,000 BTC. None of it has moved since 20:48:14 on Thursday.

Our frozen stablecoin chart (Plus) shows the jump: $1.02B to $3.22B in one hour, when the biggest one-hour rise we had recorded before was $225M.

How they got in

Binance says a DevOps engineer's compromised laptop may have given access to a service container that could submit withdrawals. Co-CEO Richard Teng says it wasn't a single one-click action, no individual has been blamed, more points of breach have been found, and a self-destruct mechanism destroyed tools and traces.

Binance also says it has found no evidence that a private key leaked. TRM Labs points out that wallets on ten chains produced valid signatures within about half an hour, and thinks the attackers got control of the signing system itself. That is an assessment, not a finding.

TRM Labs attributes the theft with high confidence to TraderTraitor, a North Korean unit. Chainalysis says funds from this theft mixed on-chain with funds from September's Bitget theft. Elliptic calls North Korea likely but says the attribution isn't yet certain. No government has named anyone yet.

What to watch

Sunday: Binance hopes to reopen withdrawals. If customers leave in size, our free Binance bitcoin chart and Binance ether chart will show it. Hourly views are on Plus. Our Exchanges page is free too.

Monday: Binance promises a full proof of reserves. Our reserves check (Plus) sets its statement beside our own node's balance.

The 19 wallets: if that bitcoin moves, the laundering has started.

The price: recent buyers' average cost is about $76,000 on our short-term holder cost basis chart (Plus). Bitcoin is a little above it. On the Binance Spot Volume Delta (Pro), the spot buyers who held $80,000 up earlier in the week sold a net $104M in the hour of the hack.

How we read it

Binance publishes its proof-of-reserves wallets on its own website. We read that list every hour, and every figure above marked "our node" comes from the blocks and transactions themselves, on our own Bitcoin Core and Erigon nodes. We don't run an XRP Ledger or Solana node, so those parts come from TRM Labs and Elliptic. Binance's own statements come from its posts and from press reports of them. We publish no wallet addresses here. All of this is early, and Binance has promised a full post-mortem.