Twelve graphs built from 182 dated, sourced observations — 12 running estimate snapshots, 145 market observations from Oct 29–31 2026, 7 token-level rows and 13 cleaned historical hack incidents — drawn from 108+ independent news and research hosts. Research current through October 31, 2026. All dollar figures are USD; hack sums in billions.
TRM Labs and Chainalysis attributed the operation with high or likely confidence to the North Korea–linked TraderTraitor cluster, associated in reporting with the Lazarus ecosystem (securityweek.com). This remains analytical attribution, not a public final criminal judgment: Binance has not conclusively named the attackers, and North Korea denies such cyber-theft allegations.
Reporting points to compromised transaction-signing infrastructure. The initially suspected DevOps laptop was only part of a more complex intrusion with additional breach points, and malware reportedly deleted evidence of its own activity (thenextweb.com, jpost.com). Binance said it found no evidence that wallet private keys leaked. Attack-chain illustration (not a graph):
This was a severe crypto-market shock, not a global financial crisis. Freezes by Tether, Circle, Ripple and others locked billions within hours; later reporting put frozen or recovered assets as high as $5.67B. Binance committed SAFU and company resources, set aside about $6.34B and said users would be made whole (shattered.io). Prices fell 3–8% and partially rebounded; not every move in those days was caused solely by the hack.
Sources disagree on totals: stolen estimates span $5.5–6.4B, frozen/recovered $2.4–5.67B and still-exposed $1.85–3.3B at different times — these are dated snapshots and are never added together here. Attribution confidence varies by firm; the single-source $5.67B recovery figure and some token-level amounts (e.g. the XRP and ARB rows) rest on one outlet each and should be read cautiously. Reuters-syndicated, major-news, Binance, Arkham, TRM and Chainalysis reporting was preferred over aggregators.
| Observed (UTC) | BTC $ | ETH $ | BNB $ | Liq. $B/24h | Source |
|---|
Method: 182 deduplicated web observations gathered Oct 29–31 2026 across 108+ hosts: 12 running-total snapshots (stolen / frozen / exposed / coverage, USD billions), 145 market observations (spot prices in USD, reported %-change windows of varying length, 24h liquidation totals in USD billions — overlapping windows, never summed), 7 token-level rows (null = not established) and 18 historical incidents cleaned to 13 (duplicate Coincheck/Mt. Gox/Binance rows and one null row removed). Charts omit nulls and one implausible sub-$100 ETH price; percentage plots keep values between 0 and −12%. Detail text trimmed for space.