This report draws on 203 dated observations from 144 independent hosts — incident snapshots, asset breakdowns, 156 market observations and 25 historical comparisons — covering October 29 to November 1, 2026. Figures are contemporaneous estimates in US dollars, charted by observation time; repeated reports of the same metric are shown as separate dated points, never summed. This 2026 exchange breach is distinct from Binance's 2019 exchange breach and the 2022 BNB Chain bridge exploit (~$586M), which appear below only as historical comparisons.
Each dot is one source's dated estimate; hover for the source. Stolen estimates converged from $5.5–5.9B upward to $6.3–6.36B. Frozen ≠ permanently recovered: it reflects issuer freezes and seizures reported at that moment. "Attacker-held" is the residue each source believed was still beyond control — contemporaneous snapshots disagree, which is why we never add them.
Blockchain-intelligence firms attributed the theft with high/likely confidence to North Korea-linked TraderTraitor, a cluster often associated with the Lazarus ecosystem (securityweek.com, thenextweb.com). This is an analytical attribution, not a law-enforcement judgment: Binance said its own investigation had not conclusively identified the attackers, and North Korea denies cyber-theft allegations. Binance described "a complex attack" with malware built to erase its own traces (jpost.com).
Only token categories individually reported by sources are shown (~$6.0B of the ~$6.3B total); they are separate reports, not a complete reconciled breakdown, and the small altcoin figure covers coins the attacker dumped on-market.
The $3.0B stablecoin figure (Tether + Circle combined) overlaps the USDC line beneath it — bars are alternative dated reports, not additive.
Min–max span of dated source estimates, Oct 29–31. Lower stolen figures are early (funds still moving); the attacker-held range is widest because freezes were landing while sources published.
Each dot is one reported BTC price with its observation time. BTC fell from ~$80K toward a six-week low near $76.3–76.4K before a partial rebound — reported after the news, not proven to be caused solely by the hack.
Reported ETH prints clustered around $2.18K–$2.24K after the news, down roughly 3–5.7% in most reports.
BNB took the sharpest hit: from ~$744 to intraday lows near $679–693, including a reported 8.17% fall in about 23 minutes (20:24–20:47 UTC).
Every dot is one source's reported change. Clusters: BTC mostly −2% to −5%, ETH −3% to −6%, BNB −5% to −9%. A few sources reported small rebounds.
Reports are overlapping windows, not additive: early prints near $590–630M in the first hour grew to $1.3–1.6B over 24 hours (heavily long positions, ~84% in one tally), then fell back to ~$398M for the following 24h window. Liquidations are forced closures of leveraged bets — a market-stress gauge, separate from the $6.3B theft itself.
One bar per deduplicated incident, at reported contemporaneous value. Colour marks attribution: dark = attributed by researchers to North Korea-linked actors; grey = other or unattributed. Attribution is analytical, not a conviction. Mt. Gox and FTX's collapse appear in sources at much larger later valuations ($13B, $8B) but are losses of a different kind and era, so the chart uses incident-time theft figures.
Sum of stolen value in the ranked incidents above, split by attribution. North Korea-linked attributions (Binance 2026, Bybit 2025, Ronin 2022, DMM 2024, Drift 2026) dominate by value — driven overwhelmingly by the Binance figure itself.
Binance said user balances were safe and committed roughly $6.34B — about the full estimated loss — from company resources and the SAFU fund (jpost.com, shattered.io). Keep seven figures distinct: the ~$6.3B theft; billions temporarily frozen by issuers (not yet permanently recovered); the residue reported attacker-controlled; Binance's coverage commitment; token price declines; derivatives liquidations; and any market-cap change, which measures repricing of all holders' coins, not money taken. From these rows, this was a sharp crypto-specific risk-off shock — not evidence of a global financial crisis.
| Section | Item / observation | Key figure | Observed (UTC) | Source |
|---|
Method: 203 researched rows from 144 independent hosts covering the Oct 29–Nov 1, 2026 Binance exchange hack — incident snapshots, asset breakdowns, market observations (BTC/ETH/BNB prices, % changes, liquidations) and historical comparisons. Dollar figures are contemporaneous USD estimates charted at each report's observation time; repeated reports of one metric are plotted separately, never summed. Frozen means reported frozen at that time, not permanently recovered; attributions are analytical (TRM Labs, Chainalysis, researchers), not legal findings. Reuters-syndicated/major news, primary research and direct Binance statements were preferred where sources disagreed. Charts omit rows lacking the relevant field; a few undated rows appear only in the table.