The $6.3 Billion Binance Hack Is Crypto’s Biggest Stress Test. What Happens to the Stolen Funds Next?

On October 29, 2026, an attacker used Binance’s own withdrawal infrastructure to move approximately $6.3 billion across ten blockchains, most of it within roughly 20 minutes, making it the largest crypto theft on record.

Stablecoin issuers began freezing funds within the hour. By then, the attacker had already moved hundreds of millions of USDT out of the addresses they were trying to block.The race to stop the stolen funds was only the beginning. Global Ledger’s Ethereum and Bitcoin analysis helps piece together how the theft unfolded, what happened to the money, and where the remaining assets could move next. The routes already identified also show where further opportunities to stop the funds may arise.

How Hackers Stole $6.3 Billion From Binance

Binance’s initial investigation linked the incident to a compromised DevOps engineer’s laptop, which may have given the attacker access to an internal service container used for withdrawals.

Binance has since reported additional possible entry points, but the exact cause of the breach remains unclear. The exchange found no evidence of leaked private keys, even though the unauthorized withdrawals carried valid signatures. How the attacker obtained them is still under investigation.

Meanwhile, the stolen funds had already spread across ten blockchains, according to initial reports. Ethereum and Bitcoin accounted for the largest amounts, and Global Ledger Research has traced the transactions on both networks. Here is how the reported withdrawals broke down:

Sources: Binance’s incident disclosure and published multi-chain incident reporting; Global Ledger Research’s Ethereum and Bitcoin fund-flow analysis.

How the Attacker Prepared the Ethereum Drain

The Ethereum attack had been in preparation for at least 36 hours.

On October 28, three small withdrawals from Tornado Cash funded the wallet later used in the theft. The next day, the attacker deployed and tested malicious code before targeting Binance 14, one of the exchange’s busiest Ethereum hot wallets.

The attack relied on EIP-7702, an Ethereum feature that allows a wallet to authorize smart-contract code to execute transactions on its behalf. For the malicious code to work, the authorization had to match Binance 14’s current transaction counter, known as a nonce. That was difficult to predict because the wallet was constantly processing withdrawals.

At 20:20 UTC, the attacker submitted 50 signed authorizations covering consecutive nonce values. One matched the wallet’s current nonce, allowing the malicious code to execute withdrawals. The signatures were valid, although exactly how the attacker obtained them remains unclear.

Four minutes later, 167,464 ETH and 63 tokens, including 1.615 billion USDT, were transferred to an attacker-controlled address.

Another 823 million USDC was stolen from a Binance smart account that used Binance 14 to execute transactions.

The attacker also made ordinary signed withdrawals from other wallets, including 28,006 ETH from a second Ethereum hot wallet. These transfers are documented in Aave’s incident report.

Why the Theft Continued After Binance Paused Withdrawals

The malicious authorization stayed active after the first major Ethereum withdrawal. Whenever new funds arrived in Binance 14, the attacker could transfer them out again. Six more sweeps followed that evening, with the last taking place at 23:56 UTC.

One of them, at 21:44 UTC, moved approximately 200 million USDT out of Binance. Tether had already frozen the receiving address, so the tokens were blocked as soon as they arrived and remained potentially recoverable.

Binance reportedly paused customer withdrawals at 22:33 UTC. However, published onchain reconstructions show further sweeps through 23:56 UTC. The malicious EIP-7702 authorization was finally revoked at 00:10 UTC on October 30.

The attacker was therefore still able to use Binance 14 after customer withdrawals had been suspended.

How the Industry Responded to the Binance Hack

As Binance worked to stop the withdrawals, stablecoin issuers were trying to freeze the money that had already left. Both sides were moving quickly, but the attacker had a head start. The timeline shows how much happened before the first major freezes took effect.

Sources: Ethereum transaction timeline, Bitcoin withdrawal analysis, Aave’s incident report, and Arbitrum’s Security Council announcement.

How $729 Million in USDT Moved Before Tether's Freezes

Tether eventually froze approximately 1.76 billion USDT, about 71% of the $2.49 billion stolen on Ethereum and Tron. By then, approximately $729 million USDT had already moved beyond the addresses Tether was targeting.

Of the 11 attacker-linked wallets Tether blacklisted, six were empty when they were frozen. One had transferred 130 million USDT less than a minute earlier. By 21:25 UTC, Tether CEO Paolo Ardoino had reported more than $1.567 billion frozen, and the amount continued to grow as more addresses were blocked.

The attacker exchanged approximately $435 million for ETH and another $234 million for TRX through SunSwap. The remaining $60 million was deposited into Aave, a decentralized crypto lending protocol, as collateral for an ETH loan. That allowed the attacker to borrow ETH while leaving the USDT in the lending pool.

The Attacker Paid Millions to Convert USDT Before It Could Be Frozen

Those rushed conversions were expensive. In one group of trades, the attacker exchanged approximately 325 million USDT for 122,300 ETH through UniswapX and other orders filled by professional market makers. The transaction sequence shows the large UniswapX orders.

ETH was trading around 2,300–2,350 at the time, but the attacker effectively paid about $2,650 per ETH. The difference amounted to an estimated $38–44 million in unfavorable execution on those trades alone. Some orders through UniswapX and 1inch Fusion carried premiums of around 15%.

Despite those losses, the swaps moved hundreds of millions of dollars beyond Tether’s freeze controls.

The trades also brought professional market makers and other liquidity providers into contact with the stolen funds within minutes of the attack. For OTC desks and liquidity providers, checking the source of funds before filling an order could have helped identify that exposure.

The September Bitget hack showed a similar pattern, with laundering activity beginning before the unauthorized withdrawals had ended. During the Binance attack, hundreds of millions of dollars were already being converted while issuers were still working to freeze the receiving wallets.

What the Binance Hack Revealed About Real Control Over Crypto Assets

The race to freeze the stolen funds also showed how much control different parties have over crypto assets. Tether and Circle could block their own stablecoins, while Arbitrum went further and moved stolen assets directly. Aave restricted lending activity, but the attacker’s BTC and Ethereum-mainnet ETH remained transferable.

How Arbitrum Intervened to Secure $30 Million

At 00:08 UTC on October 30, the Arbitrum Security Council used an emergency contract upgrade to move approximately $30 million in stolen ETH and ARB from the attacker’s address without their authorization. The assets were transferred to a restricted address, where they will remain until an ArbitrumDAO governance vote determines what happens next.

This was not Arbitrum’s first intervention of this kind. In April 2026, the network used similar powers to restrict 30,766 ETH linked to the KelpDAO exploit. Both incidents show that Arbitrum One’s emergency governance can override a wallet holder’s control over assets, including ETH. That matters for institutions deciding how to hold and settle assets on the network.

Stablecoin issuers have their own procedures for deciding when to intervene. Circle reportedly coordinated its Binance freeze with law enforcement. In an earlier case covered by Global Ledger’s H1 2026 research, Circle required a court order or law-enforcement request before freezing funds. Such requirements can affect how much money is still available to block by the time an issuer acts.

How the Emergency Response Affected Other Market Participants

The response to the hack also affected users who had nothing to do with the theft. Aave offers a clear example. After the attacker deposited 60 million USDT as collateral and borrowed 19,762 WETH (wrapped ETH), worth approximately $44.6 million, the lending protocol restricted new deposits and borrowing across 292 reserves to prevent further use of stolen assets.

Those restrictions changed conditions for existing borrowers. As suppliers withdrew funds from reserves that could no longer accept new deposits, utilization in several major stablecoin markets rose to 92–100%. Variable borrowing rates climbed to 10–36% APR, with some markets potentially reaching 55% at full utilization. LlamaRisk proposed temporary reductions to ease the pressure.

Borrowers also lost the option to add collateral to frozen reserves, leaving repayment as their main immediate way to protect their positions. Aave reported no immediate losses for suppliers, although the restrictions affected lending markets holding billions of dollars belonging to other users.

Binance Withdrawals and Market-Maker Exposure

The disruption also reached companies holding assets on Binance. The exchange suspended withdrawals and temporarily paused deposits while securing its systems, and pledged to cover customer losses.

Trading firms disclosed their exposure as well. Wintermute reported that its Binance exposure was below 20% of net equity, while GSR put its figure below 5%. Neither had reported realized losses at the time.

The emergency response had stopped or restricted billions in stolen assets, but it had also affected lending users and trading firms. Meanwhile, large BTC and ETH holdings remained in the attacker’s hands.

What Is Happening to the Remaining $3.2 Billion?

By 06:43 UTC on October 30, a published assessment of attacker-linked wallets identified approximately $3.2 billion in remaining holdings. Binance separately reported around $3 billion frozen out of the $6.3 billion stolen. These estimates came from different sources and cutoffs, so they do not represent the same calculation.

Here is where the main remaining assets stood that morning:

Sources: published Bitcoin wallet analysis, reported October 30 wallet balances and Global Ledger Research’s Ethereum and Bitcoin fund-flow reconstructions. Balances and prices refer to the 06:43 UTC snapshot; frozen tokens are excluded.

The ETH balance had grown to 508,621 ETH, roughly 2.5 times the 200,630 ETH originally withdrawn. Much of that increase came from converting stolen stablecoins and other tokens into ETH.

Global Ledger’s Ethereum and Bitcoin reconstructions below show how those transactions unfolded and where the funds ended up.

Ethereum: Token Wallets and DEX Routes

On Ethereum, the attacker moved different tokens through separate wallets before converting them. Global Ledger’s graph shows UNI, LINK, PEPE, ONDO, WLD, MORPHO, USDe and RLUSD leaving the main receiving address for token-specific wallets. Many received about 0.5 ETH to cover transaction fees.

From there, the funds passed through DEXs including Uniswap, SushiSwap, PancakeSwap, ShibaSwap, ParaSwap and Curve. Some tokens were sold in several transactions before the proceeds reached ETH consolidation wallets.

Global Ledger Research: Ethereum fund-flow reconstruction showing the initial withdrawals, token-specific wallets, DEX routes, the Aave position and ETH consolidation.

These routes make it possible to follow the stolen funds even after the original tokens have been exchanged. Some transactions simply move the same assets between attacker-controlled wallets, while others convert them into something else. Following those connections helps investigators identify the proceeds without counting the same money more than once.

Bitcoin: Repeated 1,000 BTC Splits and Recombination

Bitcoin moved through a different set of transactions. Global Ledger traced 18,270 BTC as the attacker repeatedly divided the funds, eventually reaching 19 attacker-linked end addresses. The initial withdrawal involved 11 transactions from one Binance wallet.

Global Ledger Research: Initial Bitcoin transfers from the compromised Binance wallet to the attacker-controlled receiving address.

One branch shows approximately 6,636.8 BTC becoming 5,636.8 BTC and then 4,636.8 BTC as separate 1,000 BTC amounts were moved out. Another follows 3,696.6 BTC, then 2,696.6 BTC and 1,696.6 BTC. The attacker also combined smaller amounts, including 388.89 BTC and 611.11 BTC, into a new 1,000 BTC output.

Global Ledger Research: Bitcoin fund-flow reconstruction showing the initial withdrawal, repeated 1,000 BTC splits, recombination and 19 attacker-linked end addresses.

Most of the resulting balances were close to 1,000 BTC, although some contained approximately 437.7 BTC or 832.5 BTC. None of the traced outputs had been spent since 20:48 UTC when the morning snapshot was taken.

These addresses provide specific points to monitor for further movement. The 19 end addresses do not necessarily mean 19 separate recipients, since Bitcoin transactions can also create change outputs.

Large BTC and ETH Holdings Slowed After the First Night

After the first wave of withdrawals, swaps and transfers, activity in the largest wallets slowed considerably. ETH was still being consolidated between 05:15 and 06:36 UTC, including a transfer of 17,260 ETH, but seven of the nine major ETH wallets had not sent transactions. The large Bitcoin outputs also remained unspent.

Some smaller TRX balances continued moving. After approximately 02:45 UTC, part of the TRX was converted back into USDT on SunSwap, putting those tokens within reach of Tether’s freeze controls again.

The attacker had already paid an estimated $38–44 million to convert USDT quickly. Selling another 508,621 ETH, worth roughly $1.14 billion, could be similarly expensive if large trades moved market prices against them. That may help explain why major ETH sales had slowed, although it does not explain the lack of ordinary transfers between wallets.

Waiting before moving stolen assets has happened in previous attacks. In Global Ledger’s Bitget investigation, approximately $339 million in stolen ETH and XRP remained in early attacker wallets during the first days. The available onchain evidence does not reveal why the Binance attacker is holding the funds.

For exchanges and OTC desks, those funds remain a risk even while they sit idle. When they move again, they may reach a platform after passing through several intermediary wallets.

Is the Binance Hack Linked to Earlier Attacks?

The movement of stolen funds through THORChain has raised questions about a possible connection to earlier hacks. At 04:51 UTC, ZachXBT reported Binance-linked transfers through the service, separate from the large BTC and ETH holdings covered in the morning snapshot.

Public reporting has also cited a private-sector assessment linking the Binance attack to TraderTraitor, a North Korean state-linked group. The FBI previously identified TraderTraitor as responsible for the February 2025 Bybit theft of $1.5 billion.

As of October 30, neither Binance nor law enforcement had publicly confirmed who carried out the Binance attack. The TraderTraitor assessment and the reported links between Binance and Bitget funds therefore remain separate pieces of evidence.

Binance and Bitget Proceeds Reached a Reported Shared Address

ZachXBT reported that funds from the Binance and Bitget hacks reached the same address after moving through THORChain. He suggested that the same actor was likely behind both attacks.

Much depends on who controls that address. If it belongs to an exchange, OTC desk or another intermediary, the funds could have come from different customers. If the address is controlled by the attacker, the overlap would provide stronger evidence of a connection between the hacks.

The two incidents also share some similarities. Global Ledger’s Bitget investigation traced $387.5 million across 21 transfers, eight blockchains and 2 hours and 52 minutes. The attacker began swapping funds before the unauthorized withdrawals had ended. Bitget described a compromised backend wallet process, with no reported private-key theft.

Binance likewise reported unauthorized transactions with valid signatures, followed by rapid conversions of stolen assets. The known technical details of the two attacks differ, however, so these similarities alone cannot establish who was responsible.

Global Ledger has also identified recurring laundering intermediaries in its investigations of the Bybit and Zoth hacks. Such connections can help investigators identify shared infrastructure, although several attackers may use the same services.  As new links are identified, earlier transactions may also need to be reassessed, including deposits that appeared less risky when they first reached an exchange.

If the Binance attack is eventually attributed to TraderTraitor, institutions may also need to consider the sanctions implications of their exposure, depending on the jurisdiction and the funds involved.

What Happens Next to the Stolen Funds?

Much of the stolen BTC and ETH was still sitting in attacker-linked wallets on the morning of October 30. The next transactions will help show whether the attacker plans to split the holdings further, exchange them, move them between blockchains or keep them untouched.

There are six developments worth watching:

How long the attacker will wait remains unclear. Global Ledger’s H1 2026 research found that the average time between public disclosure of a hack and the first identified arrival of stolen funds at a VASP or mixer increased from 50.8 hours in H1 2025 to 75.5 hours in H1 2026.

That measurement covers a later stage of laundering than the initial Binance swaps, so it offers context for previous attacks rather than a timetable for this one.

Some of the stolen money may also become recoverable without further movement. Frozen stablecoins remain locked pending additional action, while the assets restricted by Arbitrum require a governance decision. If identifiable proceeds reach an exchange or custodian, investigators may be able to request a hold and pursue recovery.

Conclusion: The Laundering Stage Will Shape the Outcome

The first hours of the Binance hack showed how quickly billions could leave an exchange and how difficult it could be to stop the money once it started moving. Stablecoin issuers and Arbitrum managed to restrict billions in stolen assets, while large BTC and ETH balances remained outside their direct control.

What happens next will depend on where those assets go. New Bitcoin transfers, ETH conversions and cross-chain transactions may reveal further opportunities to identify or restrict the funds, especially if they reach exchanges or other intermediaries.

Global Ledger’s Ethereum and Bitcoin reconstructions provide a starting point for following those movements. We will report further confirmed findings and any substantiated links to earlier attacks as the investigation develops.