Binance: about $5.78B hack on Arbitrum, Avalanche, Base, Bitcoin, Ethereum, Optimism, Solana, TRON

2026-10-28. Reported by public sources (confirmed by DeFiLlama). Amounts are as reported; the trace below shows what the chain says.

On October 28, 2026, at 18:51 UTC, reports began of a large outflow from Binance wallets, and Cointelegraph reported that Binance was investigating a potential multibillion-dollar hack. Reports put the total at about $5.8 billion, and the amount later reported rose to $6.3 billion. KadenaTrace's automatic trace shows $1,588.0 million moved out of the address 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c, with $1,357.2 million still held in traced wallets, and the funds were split across several wallets and swapped on Uniswap and other DEXs [KT-13 trace]. Tether froze $971.1 million USDT at that address, and Circle later froze more than $800 million in USDC. Investigators told Decrypt that the attacker group matches North Korea's TraderTraitor, and Chainalysis and TRM are cited as tying the hack to it. Binance has stated it holds $6.34 billion to cover losses

Amount: about $5.78B (reported). Networks: Arbitrum, Avalanche, Base, Bitcoin, Ethereum, Optimism, Solana, TRON.

What is known

Reported

By Crypto Briefing, Cointelegraph, @cz_binance, @spreekaway and 46 more.

Confirmed

Confirmed by DeFiLlama. The amount is as reported.

Recorded on Kadena

As KT-13 and KT-14 and KT-16 and KT-17 and KT-18 and KT-19: each move of the funds is written to a public contract.

Attacker address

6 addresses attributed by the reports.

Exchange deposits

None seen so far.

Frozen

$972.5M frozen by issuers, read from their contracts.

Returned

No return of funds recorded here.

Trace coverage

The coverage of this trace was not recorded (traced before Oct 31, 2026); totals are lower bounds until the next refresh.

Addresses attributed to the attacker

• 0xa97bf7…ae8d10 on Ethereum
• 0xc2096a…2d850a on Ethereum
• bc1q0mtc…hl2mnm on Bitcoin
• TSpe5HC3…tkyZ8A on TRON
• TRBdWqHn…A2PRki on TRON
• AffzFDKZ…igBEaU on Solana

Where the funds went

From the trace so far: at least $1.36B still held; $2K bridged via MetaMask Bridge; $469 bridged via LifiIntentsBridge. A deposit at an exchange is not a freeze or a recovery.

$1.59B followed across 123 addresses so far from 0x5227f6…cb2f8c.

Recorded on Kadena as KT-13 and KT-14 and KT-16 and KT-17 and KT-18 and KT-19: every move of the funds is written to a public contract.

Sources

• Crypto Briefing: Binance wallets see $2.5B outflow across five blockchains amid hack suspicions
• Crypto Briefing: Tether freezes $971M USDT linked to suspected Binance hack
• Cointelegraph: Binance investigates potential multibillion-dollar hack
• @cz_binance
• @spreekaway
• Crypto Briefing: Binance founder says suspected hack appears safe for user funds
• Crypto Briefing: Tether freezes over $1.567 billion in USDT tied to suspected Binance hack
• Decrypt: Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 Billion
• @binance
• @odysseas_eth
• @jerallaire
• @WazzCrypto

Timeline

1. 2026-10-31 0.0824 stETH moved to Swap (hop 4) transaction
2. 2026-10-31 3,079,082.8705 TRX moved to TNhpfKq8…zH6F (hop 1) transaction
3. 2026-10-31 231,128.0371 TRX moved to TNh7oqQN…8wf1 (hop 1) transaction
4. 2026-10-31 2,927,933.6209 TRX moved to TNhpfKq8…zH6F (hop 1) transaction
5. 2026-10-31 513,366.9965 TRX moved to TXSt1DTj…8Rmd (hop 1) transaction
6. 2026-10-31 486,195.637 TRX moved to TFyXz53e…umXu (hop 1) transaction
7. 2026-10-31 334,858.4141 TRX moved to TV1vu51c…BLbc (hop 1) transaction
8. 2026-10-31 112,709.9649 TRX moved to THNBexyn…Caeo (hop 1) transaction
9. 2026-10-31 2,766,312.1734 TRX moved to TNhpfKq8…zH6F (hop 1) transaction
10. 2026-10-31 446,252.2943 TRX moved to TFyXz53e…umXu (hop 1) transaction
11. 2026-10-31 777,972.7981 TRX moved to TQ27Lngy…EHhn (hop 1) transaction
12. 2026-10-31 595,504.2274 TRX moved to TFyXz53e…umXu (hop 1) transaction
13. 2026-10-31 2,621,340.6364 TRX moved to TEg5ncDH…mJrm (hop 1) transaction
14. 2026-10-31 572,626.1444 TRX moved to TXSt1DTj…8Rmd (hop 1) transaction
15. 2026-10-31 587,915.97 TRX moved to TXSt1DTj…8Rmd (hop 1) transaction
16. 2026-10-31 744,898.0604 TRX moved to TV1vu51c…BLbc (hop 1) transaction
17. 2026-10-31 2,478,123.151 TRX moved to TNhpfKq8…zH6F (hop 1) transaction
18. 2026-10-31 108,002.9188 TRX moved to TVuXrdY6…Ek59 (hop 1) transaction
19. 2026-10-31 162,033.5984 TRX moved to TNh7oqQN…8wf1 (hop 1) transaction
20. 2026-10-31 2,371,398.0692 TRX moved to TNhpfKq8…zH6F (hop 1) transaction
21. 2026-10-31 583,768.2593 TRX moved to TV1vu51c…BLbc (hop 1) transaction
22. 2026-10-31 747,302.1136 TRX moved to TV1vu51c…BLbc (hop 1) transaction
23. 2026-10-31 477,929.4929 TRX moved to TQKkLTBo…aYQf (hop 1) transaction
24. 2026-10-31 2,226,830.879 TRX moved to TNhpfKq8…zH6F (hop 1) transaction
25. 2026-10-31 637,451.1499 TRX moved to TXSt1DTj…8Rmd (hop 1) transaction

Read: Tracing stolen crypto across chains and bridges.

Facts about addresses and transactions, never about people. Trace a wallet · Check an address · All live incidents