Binance Hack Timeline: Lazarus Group and the Largest Crypto Theft in History

At 16:20 New York time on October 29, 2026, funds began flowing out of Binance hot wallets across several blockchains at once. In about 20 minutes, most of the assets worth US$6.3 billion had moved to the attacker's wallet.

This Binance hack is recorded as the largest crypto theft in history, and its on-chain trail points to Lazarus Group through the TraderTraitor unit. The following Binance hack timeline is compiled from reports by Chainalysis, TRM Labs, and Binance statements.

Key Takeaways

• About US$6.3 billion (Chainalysis count: US$6.4 billion) vanished from Binance wallets across 10 blockchains, most of it within 20 minutes.
• Chainalysis and TRM Labs pointed to TraderTraitor, a unit assessed to be part of Lazarus Group. The FBI stated that North Korea was responsible on November 1.
• About US$3 billion was frozen, Binance claims 95% of losses have been covered, and withdrawals opened gradually from November 1.

Binance Hack Timeline: From Preparation to Freezing

Preparation took place before the attack. According to Chainalysis, the hackers funded an operational wallet through Tornado Cash. On Ethereum, that wallet sent a valid signed authorization so that Binance's hot wallet executed code created by the hackers, and its contents were then diverted to addresses they controlled.

Execution began around 16:20 ET, or 03:20 WIB on October 30. TRM Labs data recorded funds withdrawn from 10 blockchains, including 18,270 BTC. According to Reuters, the method was similar to the 2025 Bybit hack that the FBI linked to North Korea.

After that, the attackers raced against asset-freezing efforts. They moved US$500 million in stablecoins to exchange wallets, then swapped US$325 million of that into US$285 million in ETH in almost 20 minutes, wrote Chainalysis. 

The first freeze was recorded by 17:14 ET at the latest. Reuters reported that Tether froze about US$1.57 billion and Circle more than US$800 million.

Breakdown of assets drained from Binance hot wallets on Ethereum, Bitcoin, and Tron as of October 29, 2026, at 17:30 ET. The final figure later rose to about US$6.3 billion across 10 blockchains. Source: Hyperdash. 

Binance then suspended deposits and withdrawals. The company said it had not found evidence of a private key leak, according to Associated Press. 

Initial suspicions pointed to a compromised laptop belonging to a DevOps engineer, and Binance later acknowledged another intrusion point. How the laptop was breached has not been explained.

An attack of this size is a reminder of the importance of choosing the right platform. If you want to start crypto investing on a licensed Indonesian exchange, register on Bittime now.

Read Also: Alleged Binance Hack: US$5.7 Billion in Crypto Assets Moving Draws Scrutiny

Lazarus Group and the North Korean Hacker Trail

Source: ZachXBT

Chainalysis linked this attack to TraderTraitor, a North Korean cyber group. The strongest evidence emerged when Binance's stolen funds mixed on-chain with proceeds from last month's Bitget theft, which had already been attributed to North Korea.

The laundering pattern was also unusual. Thousands of transactions occurred in a short time, and many addresses first received exactly 1 TRX before the funds arrived. That is a sign of automation, said Chainalysis.

TRM Labs stated its assessment with a high degree of confidence, while Elliptic linked this hack to Lazarus Group. Analysts view TraderTraitor as part of Lazarus Group, according to CBS News. 

Independent investigator ZachXBT said the perpetrator was most likely Lazarus, as quoted by Bitcoin.com News.

On November 1, the FBI stated that North Korea was responsible for the theft of more than US$6 billion, according to CBS News. Previously, Binance only said it was working with law enforcement to confirm the perpetrator's identity. North Korea has routinely denied such allegations, Reuters wrote.

Read Also: Binance Red Packet November 2-3, 2026: Free Crypto Codes Today!

Impact on the Market and the Fate of User Funds

The market reacted immediately. Bitcoin fell to US$76,368, its lowest level in six weeks, and Ether touched US$2,178, a two-month low, before the market stabilized, according to Reuters. Coinbase shares, which said they were not affected, weakened 4.8%.

Binance moved to cover losses. The company used corporate cash and the Futures Insurance Fund to buy replacement assets, wrote Yahoo Finance. As of November 1, Binance claimed about 95% of affected assets had been covered, up from 90%, and stressed that losses would not be passed on to users, according to CoinDesk.

Withdrawals opened gradually starting November 1 at 06:00 UTC or 13:00 WIB. Binance recorded net outflows of US$3.64 billion, about 2.1% of total assets of US$171 billion, according to CNBC. Binance founder Changpeng Zhao wrote that 98% of users chose to stay.

Binance said about US$3 billion in stolen funds had been successfully frozen, Associated Press reported. The investigation is still ongoing, and Binance promised to release technical details after the investigation is complete.

Read Also: Binance Word of the Day November 2-3, 2026

Conclusion

This Binance hack shows that even large exchanges can be breached through an operational gap, not by breaking the blockchain. 

Several analytics firms and the FBI pointed to North Korea, with Lazarus Group as the umbrella for the perpetrator unit. Binance stated it would bear the losses, but full recovery depends on the investigation results and remaining funds that have not yet been frozen.

Check the price of Bitcoin (BTC), Ethereum (ETH), XRP, Solana (SOL), GRAM, and BNB as well as leading memecoin DOGE. You can trade directly on Bittime!

Bittime is a Digital Financial Asset Trader (PAKD) platform licensed and supervised by the Financial Services Authority (OJK) — where you can buy Bitcoin in Indonesia and hundreds of other crypto assets starting from Rp10,000. The registration process is fast, secure, and can be started today.

Monitor USDT to IDR conversions and your favorite crypto asset price movements in real time. All available in one crypto investment app that can be downloaded for free on the Play Store.

Ready to start? Register now on Bittime and execute your investment strategy with a platform trusted by millions of users in Indonesia.

FAQ

Is the Binance hack larger than the Bybit hack?
Yes. Bybit lost about US$1.5 billion in February 2025, the previous record. The Binance figure is almost four times that.

Who is Lazarus Group?
Lazarus Group is a hacker group linked to the state of North Korea. It has been accused of attacking Sony Pictures in 2014, according to CBS News.

Are Binance user funds safe?
Binance stated that deposits were not affected and that the company would bear the losses. The remaining roughly 5% of assets are still being purchased because they are insufficiently liquid in the market.

Why do North Korean hackers steal crypto?
Experts assess that the stolen proceeds help fund North Korea's sanctions-strained economy and nuclear program, according to Associated Press.