Breaking Down the Binance Hack: Timeline, Laundering Routes, and How Polytrop Helps Businesses Spot Stolen Funds

On October 29, 2026, attackers drained between $6.3 billion and $6.43 billion from Binance hot wallets, by various estimates, in roughly 20 minutes. It is the largest crypto theft on record. Five days later, AMLBot is tracking up to $1.7 billion of it across thousands of wallets on Bitcoin, Tron and Ethereum, and each of those wallets is seeking a service that will accept a deposit. This breakdown covers what is known as of November 3, 2026: the timeline, how the attack worked, who is blamed, what was frozen and how the funds are being laundered. Our monitoring, Polytrop, also tracked the funds: the typical wallet on the trail was labelled almost two hours before it moved the money on.

Get Live Labels From the Binance Hack

Keep stolen Binance funds off your platform and make the attackers' job harder. AMLBot tracks more than 7,000 addresses linked to the hack and updates its labels as the funds move.

[Get the Addresses CSV] · [Get the Services CSV] · [Get API Keys]

What Polytrop Is, and Why It Matters Here

Polytrop is AMLBot's live labelling engine for stolen funds. When an incident breaks, AMLBot takes the attacker's known addresses, follows every outgoing transfer hop by hop, and labels each new receiving wallet within seconds before that wallet moves the money on. The crucial factor is timing. A blocklist protects a service only if the address is on it before the deposit arrives. Laundering scripts move funds in minutes. Manual lists are updated when an investigator gets to them. For every address, Polytrop records 2 timestamps: when we labelled it and when the funds left it. The gap between them is the lead time, the window a compliance team had to block the money.

Polytrop tells you a wallet holds stolen funds before that money reaches your platform, so you can block it instead of chasing it.

AMLBot in the Binance Case, at a Glance

• 8.6 hours. How long Polytrop had flagged the address that later sent $212 million in recorded value in a single five-minute burst.
• 3.2 seconds. The median time from a wallet receiving funds from the trail to Polytrop labelling it.
• 1 hour 56 minutes. How long the typical wallet had already been labelled before it sent the funds on.
• 5 to 7 minutes. The typical head start, even six to nine steps away from the source.
• 3,000+ Tron wallets labelled. According to The Block, the FBI list includes no Tron addresses.
• A timestamp on every label. For each address, AMLBot shows when it was flagged and when the funds left it, so a compliance team can see exactly how much warning it had.

In plain terms: Polytrop usually flags a wallet before the stolen money leaves it. That gives exchanges and swap services time to block the money before it reaches them.

How to Use Polytrop

1. Open the Binance Hack Page. It shows the incident totals, a flow-of-funds map across nine hops, every flagged address, and every service the funds reached, with the warning time for each.
2. Check an address or transaction. Paste any address or tx hash into the scanner's search bar to see whether it sits on the trail.
3. Plug the labels into deposit screening. Download the CSV blocklist or request an API key for the Binance case, and screen incoming deposits against labels that update as the funds move.
   
   [Get the Addresses CSV] · [Get the Services CSV] · [Get API Keys]
   

Chronology of the Binance Hack (All Times UTC)

Entries marked Polytrop come from AMLBot's own records. Every address and transaction in them can be checked on the Binance Hack case page or through the scanner's search.

⬇️ October 28. According to Arkham, the attacker's operator wallet was funded through Tornado Cash from the morning of October 28. TRM Labs puts the start of preparation at least 36 hours before the theft.

⬇️ October 29, early hours. Arkham reports that the attacker tested the attack code on two wallets and rehearsed the final version on a third.

⬇️ October 29, 20:05. According to TRM Labs, funds began leaving Binance wallets across ten blockchains, most of them within about 20 minutes.

⬇️ 20:20:59. Arkham says the attacker sent a single Ethereum transaction carrying 50 EIP-7702 authorizations to the wallet it labels Binance 14. The wallet was swept 3 minutes and 24 seconds later: 64 tokens worth $2.53 billion in one transaction.

⬇️ 21:01–22:26. Issuers started freezing. According to TRM Labs, Tether froze 971.1 million USDT at 21:01, Circle froze 823 million USDC at 21:04, Ripple froze 40.5 million RLUSD at 22:01, and World Liberty Financial froze USD1 at 22:10 and 22:26.

⬇️ 23:05–23:56. A second wave hit Avalanche and Polygon at 23:05, and the last sweep landed at 23:56, TRM Labs reports. At 23:35, Binance reported $2.54 billion verified as frozen.

⬇️ October 30, 00:08. The Arbitrum Security Council forced the transfer of 8,426 ETH and 74.6 million ARB, about $30 million.

⬇️ October 30, 01:38 — Polytrop flagged the first source address in the case: TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A on Tron.

03:48 — Polytrop flagged 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7, the address ZachXBT linked to the Bitget hack. It sent its first funds 45 minutes later, at 04:33.

04:41 — The first traced deposit reached a service: $3,437 into a THORChain contract.

⬇️ October 30, 10:15–10:20. Source address TSpe5…mtkyZ8A sent $212.3 million in recorded value to five new wallets in five minutes. Polytrop had flagged it 8.6 to 8.7 hours earlier.

⬇️ October 30, daytime. Chainalysis attributed the theft to North Korea's TraderTraitor group. ZachXBT linked it to the $388 million Bitget hack through a shared Ethereum address.

⬇️ October 31. The FBI named TraderTraitor as responsible and published 608 Ethereum, 19 Bitcoin and one Solana address, according to The Block. THORChain went into an emergency pause after an Ethereum reorg triggered a double refund.

⬇️ October 31 — The busiest day on the Tron and EVM trail so far: Polytrop recorded 1,753 transfers, up from 1,205 on October 30.

⬇️ November 1, 02:31 — The funds reached the ninth step from a source address, the deepest point on the trail so far.

⬇️ November 1. Binance resumed withdrawals in phases and said it had covered 95% of the stolen assets, TechCrunch reports.

⬇️ November 3. Funds are still moving. From 12:16 UTC, Bitcoin from the trail began reaching addresses Polytrop labels as mixers.

What Polytrop Recorded in the Binance Case

AMLBot labelled 3,391 wallets across 9 steps of the money trail. The typical (median) wallet was flagged 1 hour 50 minutes before it sent the funds on. All figures below come from AMLBot's own records on the live Binance Hack Case Page, as of November 3.

1. Scope. AMLBot's Binance Сase starts from 3,849 source addresses: 1,920 on Tron, 1,916 on EVM chains, 12 on Bitcoin and one on Solana. So far, 28 of them have sent funds on. Their first outgoing transfers carry at least $1.71 billion in recorded value, $1.46 billion of it on Bitcoin; six of those transfers have no recorded USD value. From there, Polytrop traced 3,391 transfers into newly labelled wallets: 3,124 on Tron, 126 on EVM chains and 141 on Bitcoin. The first traced Tron transfer left a source address at 04:12 UTC on October 30; the latest was at 18:56 UTC on November 3.
2. Labelling Speed. The median time from a wallet receiving funds from the trail to AMLBot labelling it is 3.2 seconds. 92% of wallets were labelled within 10 seconds.
3. Lead Time. The median wallet had been labelled for 1 hour 56 minutes before it sent funds on. 76% of transfers came from a wallet labelled at least 10 minutes earlier, and 57% from one labelled at least an hour earlier. In 32 of 3,250 transfers, the wallet was labelled less than a minute before the funds left it, or only afterward. The mean lead time is 7.6 hours. We quote the median because a few wallets held funds for several days.

Each step is one more transfer away from the source addresses. The “1st wallet” received funds directly from a source address, the “2nd” from a 1st wallet, and so on. Each bar shows how long that wallet had already been labelled by AMLBot before it passed the funds on. The figures are medians: the typical case at each step. The head start shrinks with each step: hours for the first two wallets, minutes from the third onward.

"Even six to nine wallets away from Binance, we had each wallet flagged about seven minutes before it moved the money. Automated deposit screening needs only seconds to block it." — Viacheslav Demchuk, CEO AMLBot

What This Means if You Accept Deposits

• The funds are already reaching services. Twelve traced Tron transfers have landed in decentralized exchange contracts, including THORChain, Meson and Across. For the four THORChain deposits, AMLBot had flagged the sending wallet 1.9 to 20.9 minutes earlier: enough time for automated screening to stop them.
• Bitcoin is heading for mixers. On November 3, 29 transfers from the Bitcoin trail reached addresses AMLBot labelled as mixers. Money that comes out of a mixer is much harder to trace, so the moment to catch it is before it goes in.
• Freezes still happen when someone acts in time. Two wallets on the trail have been frozen by a token issuer or an authority. AMLBot had flagged the wallets sending money to them as much as 37 hours earlier.
• One wallet can carry more than one hack. The address 0x15104a9…fe0feb7 mixed Binance funds with Bitget proceeds. AMLBot flagged it 45 minutes before it moved any money, and labelled each of the five wallets it paid within about five seconds. A service screening against these labels would have seen every one of them coming.
• It isn't over. AMLBot recorded 33 new transfers on the Tron and EVM trail on November 3 alone.

How the Hack Happened

Binance has not published a root cause yet. According to Arkham, Binance said that a compromised DevOps engineer's laptop gave the attacker access to an internal service, which was then used to submit unauthorized withdrawals. Cointegrity notes that Binance's account of the incident has changed three times, and Binance says it will publish a detailed incident report once its investigation ends.

The on-chain evidence points at the signing system rather than at stolen keys. TRM Labs assesses that the attacker likely gained the ability to make Binance's hot-wallet signing system sign transactions across chains. Cointegrity counts 17 hot wallets on 10 chains, with different key types, producing valid attacker signatures within about 30 minutes, and calls control of the signing requests “probable”. Two techniques did the work:

• EIP-7702 on Ethereum. EIP-7702 was the entry point. The attacker submitted a batch of 50 pre-signed authorizations covering consecutive nonces, so one was guaranteed to be valid. It turned a Binance hot wallet into a sweeper only the attacker could call.
• Ordinary signed transfers elsewhere. On the other nine chains, funds moved through normal signed transfers, which TRM Labs reads as compromised signing infrastructure.

Speed mattered for one simple reason: stablecoin issuers such as Tether and Circle can freeze their tokens, but no one can freeze ETH or TRX. So the attacker raced to swap stablecoins into ETH and TRX before the freezes landed. That race is why only part of the stolen money was frozen.

Who Is Behind It

On October 31, the FBI attributed the theft to North Korea, naming the group it calls TraderTraitor. According to The Block, the alert was issued jointly with the U.S. Secret Service and IRS Criminal Investigation.

Private investigators reached the same conclusion earlier, with different degrees of confidence: TRM Labs attributes the attack to TraderTraitor “with high confidence”, citing similarities with the Bybit (February 2025) and KelpDAO (April 2026) hacks. Chainalysis bases its attribution on Binance funds being mixed with proceeds of last month's Bitget theft, already attributed to North Korea. Elliptic calls North Korea the likely actor. Arkham links the attack to TraderTraitor, also known as Lazarus.

What This Means for Exchanges, Swaps, and Bridges

If you accept deposits, Binance funds are looking for you now. The FBI has asked instant exchanges, DeFi services and node operators to block transactions linked to the theft. With the attribution to North Korea now public, accepting these funds is a compliance issue as well as a reputational one. Three lessons stand out from the first five days:

1. Static lists arrive late. The laundering script creates new wallets every few minutes and forwards funds within two. Six to nine steps from the source, the typical wallet moved the money on about seven minutes after AMLBot flagged it. A list downloaded once cannot keep up.
2. Don't skip Tron. The FBI list has no Tron addresses. 3,124 of the 3,391 wallets AMLBot labelled on the trail are on Tron.
3. Rejection works, but only with labels in time. When a bridge rejected deposits, the script simply retried from new wallets.

What to do Today:

• Screen every incoming deposit on Bitcoin, Tron and EVM chains against labels that update in real time, not a list downloaded once.
• Treat any wallet funded through the Binance cluster as high-risk, even several hops away.
• Hold and review deposits that match, and report them to the relevant authorities.
• Request a Polytrop API key to screen against the Binance case labels (see below).

Get Live Labels From the Binance Hack

Keep stolen funds off your platform, protect your users and help stop the laundering of money taken in the Binance Hack of October 29, 2026. Polytrop gives you its live labels on the addresses and transactions linked to the hack, updated as the funds move. So far, AMLBot is tracking more than 7,000 addresses linked to the hack.

Take the data in the format that fits your workflow:

• [Get the Addresses CSV] Every address AMLBot has labelled on the trail, ready to load into your screening tools.
• [Get the Services CSV] The services the stolen funds have reached so far.
• [Get API Keys] Screen every incoming deposit automatically against labels that update in real time, and see when each address was flagged. Fill in the form below with your name, company, website and work email. We will email your API keys.

FAQ

What Happened in the Binance Hack?
On October 29, 2026, attackers drained between $6.3 billion and $6.43 billion from Binance hot wallets across about ten blockchains, most of it within roughly 20 minutes. It is the largest crypto theft on record. Binance has not yet published a root cause.

Who Is Behind the Binance Hack?
The FBI attributed the theft to North Korea's TraderTraitor group on October 31, 2026. TRM Labs, Chainalysis, Elliptic and Arkham had linked it to North Korea earlier.

How Much of the Stolen Binance Funds Has Been Frozen?
About $2.7 billion had been frozen as of October 30, according to TRM Labs, almost all of it stablecoins. Funds on Bitcoin, the XRP Ledger, Solana and NEAR have not been frozen.

Where Are the Stolen Binance Funds Going?
The funds are being moved through thousands of new wallets, mostly on Tron, and into decentralized exchanges and bridges such as THORChain. On November 3, Polytrop recorded Bitcoin from the trail reaching mixers.

How Can an Exchange Check Whether a Deposit Is Linked to the Binance Hack?
Screen the sending address against Polytrop's live labels. You can search any address or transaction on the Polytrop Binance Hack case page, download the addresses CSV, or connect through API to screen every deposit automatically.

What Is Polytrop?
It is AMLBot's live labelling engine for stolen crypto funds. It follows stolen money hop by hop and labels each new receiving wallet within seconds, so exchanges and swap services can block the funds before they arrive.

How Fast Does Polytrop Flag Wallets Linked to the Binance Hack?
On the Tron and EVM trail, AMLBot labels a new receiving wallet in a median of 3.2 seconds. The typical wallet was flagged 1 hour 56 minutes before it moved the money on, and even six to nine steps from the source, the head start was five to seven minutes.

Does the FBI List Include Tron Addresses from the Binance Hack?
No. According to The Block, the FBI list covers 608 Ethereum, 19 Bitcoin and one Solana address. AMLBot has labelled more than 3,000 Tron wallets on the trail.

How Do I Get Polytrop Data on the Binance Hack?
Download the addresses or services CSV from the Binance Hack case page, or request API keys with your name, company, website and work email. Our team will send an email with the keys.