The Binance Hack Timeline: How a 93-Cent Transaction Drained $6.3 Billion

Video Chapters and Timestamps

Use these timestamps to jump to the matching part of the video. Times are minutes and seconds from the start.

How Binance Keeps Your Money

Binance is the biggest crypto exchange in the world. It says it has 335 million registered users and around $160 billion of their crypto in its care. Exchanges are supposed to keep most customer funds in cold wallets, where the keys are kept offline. Cold storage is slow to move and very hard to steal.

People withdraw all day, so an exchange also keeps a smaller amount in hot wallets that are always online and can pay out in seconds. A hot wallet is meant to be the cash register, not the vault. On Thursday one of Binance's cash registers was holding billions of dollars.

Binance has been robbed before. In 2019 hackers took 7,000 bitcoin, about $40 million, and this theft was about 150 times bigger. The company was founded in 2017 by Changpeng Zhao, known as CZ, and Yi He. In 2023 Binance pleaded guilty to breaking US anti-money-laundering law and paid $4.3 billion, and CZ served four months in prison. President Trump pardoned him about a year ago. CZ no longer runs Binance, but he was the first big name to call the incident a hack in public.

Video time: 0:50 to 2:05.

The Heist, Minute by Minute

The attack did not start on Thursday. On Tuesday 27 October, Binance said it had blocked several attacks that week, linked to North Korea and involving fake job interviews and coding tests, with no money lost. Nobody has shown any link between those attempts and what came next.

On Wednesday a brand-new wallet received about a tenth of one ether through Tornado Cash, a service built to hide where money comes from. That wallet became the attacker's remote control. According to TRM Labs and the security firm Blockaid, between Wednesday and Thursday the attacker put a small program, a sweeper built to empty a wallet in one move, on the Ethereum blockchain. It only takes orders from the remote-control wallet. The attacker tested it on two wallets and ran a full rehearsal on a third, at a cost of a few dollars per run, then waited about four hours. Investigators have not said why.

What followed hit about 10 blockchains in a single evening:

• 4:05 PM: five Binance wallets on the XRP Ledger start sending. In four minutes about $300 million in XRP goes to one address. Minutes later, Binance wallets on Solana and Optimism are drained.
• 4:20 PM: Binance's bitcoin hot wallet sends 18,270 bitcoin, about $1.5 billion.
• Within two minutes: on Tron, $612 million in the stablecoin USDT.
• To each blockchain these look like signed, valid withdrawals. As far as the chain can tell, Binance is simply paying someone.

In the same minute as the bitcoin transfer, something stranger happened on Ethereum. Since May 2025 Ethereum has had a feature called EIP-7702. It lets an ordinary wallet sign a note saying that from now on a particular program runs the account. It was built to make wallets easier to use.

Picture the wallet as a vault, and the note as handing the vault to a robot that follows its own instructions. At 4:20 and 59 seconds a transaction reached Binance's main Ethereum hot wallet, labelled Binance 14. Inside were 50 of those notes, each pointing the wallet at the attacker's program.

Why 50? Every transaction a wallet sends carries a number in sequence. Binance 14 was busy handling withdrawals, so its number kept climbing and the attacker could not know which number it would be on. They brought a note for each of the next 50, and one of them had to fit. One did. Every one of those notes carried a valid Binance signature, and nobody has fully explained that yet. The fee for that transaction was about 93 cents.

At 4:24 and 23 seconds, three minutes and 24 seconds after the handover, the program moved everything in one transaction: about 167,000 ether, $1.6 billion in USDT and dozens of other tokens. Most of the money left Binance in about 20 minutes. At 4:32 the earliest public alarm we could find went up on X: "unconfirmed but possibly massive Binance hack".

To be clear, Ethereum itself was not hacked. The attacker used a normal feature as a getaway car, and on the other chains used ordinary signed withdrawals. The attacker now had a problem: much of what was taken was stablecoins, which their issuers can freeze.

Video time: 2:05 to 5:22.

The Race to Freeze It

Crypto dollars such as USDT and USDC can be frozen by the companies that issue them. Bitcoin and ether cannot be frozen by any issuer. So a race began. According to TRM Labs, the attacker swapped stolen USDT for ether at a loss of more than 10%, and put another $60 million into the lending app Aave to borrow ether against it.

Sit with that: crypto is meant to be decentralized, yet nearly half of what was stolen was frozen because a handful of companies pressed a freeze button.

Then comes the detail that matters most. Binance announced that withdrawals were paused at 6:33 PM. That should have ended it, and it did not. The attacker's program did not need Binance's withdrawal system, because it already controlled the wallet. As fresh money landed in Binance 14, it swept it out at least six more times after the main sweep, and two of those came after Binance's pause. At 7:05 PM a second wave hit Binance wallets on Avalanche and Polygon, with no program involved, just more signed withdrawals. The last unauthorized Ethereum sweep landed at 7:56 PM, 83 minutes after Binance said withdrawals had stopped.

Why so long? Part of the answer, according to Blockaid, is that changing a wallet's keys does not undo this kind of handover. The wallet has to sign a new note taking control back. According to the data firm Bitquery, that happened at 8:10 PM, almost four hours after the program took charge.

Video time: 5:22 to 7:47.

"One Laptop"? What Binance Has Said

At around 10:30 that night Binance gave its first explanation. The incident, it said, may involve a compromised DevOps engineer's laptop. From there the attacker reached a service container, an internal system that can submit withdrawals. Binance said it found no evidence that any wallet's private key had leaked.

By the early hours Sky News was running the headline "largest bank heist in human history", but that left a lot unexplained. According to Blockaid, 11 separate hot wallet keys signed transfers to the attacker, on about 10 blockchains, without anything stopping it. By Friday morning Binance had widened the story itself: it had found additional points of breach, and co-CEO Richard Teng wrote that the attacker did not simply use one engineer's permissions and that this was not a single one-click action. Binance's own updates are linked in the references.

So what did the attackers actually get, the keys or the system that uses them? Experts do not agree:

• Blockaid does not think a key was leaked, and Check Point told the BBC the attackers did not steal the private keys.
• Former Mt. Gox chief Mark Karpeles told Reuters he thinks the attackers likely got the keys to at least two Binance wallets.
• Hong Kong lawyer Joshua Chew put it simply: the attacker may not have stolen the vault key, and may instead have hijacked the system that tells the vault to release money.

One more question Binance has not answered: why a single hot wallet, the cash register, could give up about two and a half billion dollars in one transaction. Binance has promised a full technical post-mortem, which should explain how that laptop was compromised and whether Tuesday's fake interview attempts had anything to do with it.

Video time: 7:47 to 9:31.

Who Did It?

Binance has not said who did this, but blockchain investigators already have a name. TRM Labs says with high confidence it was TraderTraitor, a North Korean state hacking unit that the FBI links to the Lazarus Group. The Chainalysis CEO said it was likely the same group, and a TRM investigator told the Wall Street Journal this was "absolutely North Korea".

Their reasons are fingerprints from earlier heists: seed money through Tornado Cash, long quiet staging, and pre-signed approvals fired all at once. The on-chain detective ZachXBT found money from this hack at the same address as money stolen from Bitget, another exchange robbed five weeks earlier. The group's playbook is well documented:

• February 2025: Bybit loses $1.5 billion after a developer's computer at a wallet company is hacked. The FBI blamed TraderTraitor.
• 2024: Japan's DMM Bitcoin loses about $300 million after a fake recruiter sends a coding test to an employee at a partner firm.

The biggest crypto heists of recent years did not start with broken code. They started with a person. But the case is not closed. Elliptic still calls North Korea likely, not certain. The shared address holds only about $39,000 of Binance money, and one laundering service can serve many clients. This attacker has also converted stablecoins slowly and laundered differently from the Bybit pattern, which Elliptic says is unusual for North Korea. No government has confirmed anything, and North Korea has not responded; it routinely denies these accusations.

If it was North Korea, the scale is hard to take in. Chainalysis says North Korea stole a record $2 billion in crypto in all of 2025. This one night was about three times that, and more than every crypto thief on earth stole in all of last year combined. By some estimates around 40% of North Korea's stolen crypto ends up funding weapons.

Video time: 9:31 to 11:38.

Where the Money Is Now

The bitcoin has not moved. All 18,270 coins sit in 19 wallets, 17 of them holding exactly 1,000 bitcoin each, and not one has moved since Thursday afternoon. No company can freeze those coins. As one wallet founder told Bloomberg, that bitcoin is in the hacker's hands.

The ether is moving. By Arkham's count the attacker holds close to half a million ETH across about 10 addresses, and more than $1 billion of it moved to new wallets overnight. Depending on who is counting, between $2.4 billion and $3.3 billion is now out of any company's reach, according to the tracker on Chain Lens. The twist is that the coins that could be stopped mostly were stopped, and the coins built so nobody could ever stop them got away.

The market felt it. Bitcoin fell to a six-week low of $76,368, and BNB, Binance's own token, fell between 5% and 10%. About $1.5 billion in leveraged bets were wiped out, although crypto was already falling on a tech sell-off, so not all of that is the hack.

Binance says users will not lose a cent. It says it has set aside more than $6.3 billion of its own money to cover losses, on top of what is frozen. Its emergency fund, SAFU, holds about $1 billion and, according to the trade publication Insurance Business, there is no conventional insurance policy behind it. This is Binance paying from its own pocket, and the fact that it can promise that shows how big Binance is. Withdrawals were still paused when the video was recorded, and Binance said they should start reopening around 1 November, in phases (see the recovery update in the references). Its next proof of reserves, reportedly due the same day, should show whether the stolen coins have really been replaced.

Scammers are targeting worried users with fake fund-recovery pages, according to security firms. Never share your seed phrase or keys with anyone claiming to be Binance support. Nobody legitimate will ask for them.

Some people online say AI did this. There is no evidence of that: Binance has not said it, and investigators have not said it. Every step on record is an old technique. Google's researchers have caught a different North Korean unit using AI to write phishing messages, and apparently a deepfake of a crypto CEO on a fake video call, and Blockaid says its own AI system flagged the drain less than two minutes after the main sweep, before any public report. That is the backdrop, but there is no sign AI was the weapon here.

Video time: 11:38 to the end.

What This Means for Exchanges and Their Users

The real lesson is older than any of the technology involved. A wallet that should have held pocket money held billions, and by Binance's own account, near the start of it was one person's computer.

For exchanges, the incident points to a short list of controls: keep hot wallets small, limit what any single transaction or service can release, make delegation and signing changes visible and slow to approve, and treat engineer workstations as high-value targets, especially against fake recruiter and coding-test lures.

For users, the practical steps do not depend on one company. Keep on an exchange only what you could live without for a while, move long-term holdings to self-custody, protect your account with a passkey or authenticator app, and treat any "recovery" message as a scam. Our guides cover this in detail: 10 ways to keep your funds safe on a crypto exchange and how to protect your crypto. We are following developments in our daily cybersecurity news briefing.