Investigators have traced billions through cryptocurrency wallets, while nearly $3 billion has been frozen. But where is the remaining money?
The investigation into the $6.34 billion Binance hack of 29 October 2026 has uncovered an elaborate operation involving fake recruitment interviews, infected developer tools and compromised internal systems.

According to Binance's latest report, released on 3 November, the hackers began preparing their attack at least four months before stealing funds from the world's largest cryptocurrency exchange.
The FBI has identified North Korea's TraderTraitor hacking group as responsible. Pyongyang denies the accusation.

Although Binance detected suspicious activity, replaced the computer and changed credentials, the attackers had obtained valuable information about the company's wallet infrastructure.

“How the hackers entered Binance The first breach occurred in June, when a Binance engineer downloaded a modified software installation tool while attempting to install an AI programming application.”

EuroAsia.News

In September, another engineer was approached through a legitimate recruitment platform.
The supposed employer arranged two interviews, including a video meeting with the alleged CEO of a fictitious company.
The engineer was subsequently instructed to download a programming assignment containing malicious code.

On 20 October, the attackers exploited the compromised computer and an internal AI tool to access additional engineers' systems.
Nine days later, stolen credentials enabled the deployment of malicious software into Binance's wallet-signing infrastructure.
The hackers did not need to steal the wallets' private keys. They manipulated systems authorized to approve transactions.

$6.3 billion transferred in hours
The theft began shortly after 20:00 UTC on 29 October.
Within four minutes, five Binance wallets transferred 233.46 million XRP to an attacker-controlled address.

Other transfers followed across Bitcoin, Ethereum, Solana, Tron and additional networks.
Blockchain investigator TRM Labs estimates that the hackers extracted approximately $3.79 billion from Ethereum wallets, including stablecoins, and 18,270 Bitcoin worth about $1.47 billion.

Another $628 million left Tron wallets, approximately $296 million was stolen in XRP and $96 million in Solana tokens.
On Ethereum, the attackers exploited the EIP-7702 authorization mechanism, submitting 50 signing transactions to establish malicious permissions.
These permissions allowed transfers to continue even after Binance began suspending normal withdrawals.
The final unauthorized transaction, involving 2,961.9 ETH, was confirmed at 23:56 UTC.

Where did the money go?
The hackers immediately began converting freezable stablecoins into cryptocurrencies such as Ethereum.
Chainalysis identified one operation in which $325 million in stablecoins was exchanged for approximately $285 million in ETH in less than 20 minutes.
The attackers effectively sacrificed $40 million to move assets beyond the direct freezing authority of stablecoin issuers.
Investigators also observed thousands of automated transactions through newly created addresses.
Elliptic reported activity involving approximately 12,000 wallets across 11 blockchains and roughly 40,000 transactions.

According to Bitquery's analysis on 3 November, the attackers still controlled approximately $3 billion, primarily in Bitcoin and Ethereum.
Eight large Ethereum wallets held most of the tracked ETH, while 18,270 Bitcoin remained distributed across 19 addresses.
Some funds moved through decentralized services including THORChain, Relay and SunSwap.

Bitquery traced 685 million TRX distributed to 220 addresses and identified additional transfers through cross-chain exchange services.
However, much of the stolen cryptocurrency remained in apparently inactive wallets. The traced holdings do not establish that the funds reached North Korea or were converted into conventional currency.

Nearly $3 billion frozen
Binance reports that approximately $2.85 billion has been frozen or intercepted, equivalent to roughly 45% of the stolen assets.
The FBI published 628 cryptocurrency addresses linked to the theft and urged exchanges and decentralized-finance operators to block suspicious transactions.
The $6.34 billion attack is more than four times the approximately $1.5 billion stolen from Bybit in February 2025.
The scale is extraordinary even by conventional financial-crime standards.

What happens to Binance customers?
Binance says it will cover the losses using its Secure Asset Fund for Users and corporate reserves.
By 31 October, the exchange reported replenishing 98% of affected token assets, although subsequent statements have used different measures of restoration.
According to Reuters, Binance experienced $4.72 billion in net customer withdrawals by 2 November — approximately 3% of assets held on the platform.

Withdrawals have since largely normalized.
The biggest unanswered questions concern the security failures that allowed hackers to compromise several employees, the ability to revoke malicious wallet permissions quickly and the eventual destination of the stolen funds.

The investigation demonstrates a fundamental weakness in digital finance: sophisticated cryptographic protection cannot compensate for compromised operational systems.
For now, billions remain visible on public blockchains — but visibility does not mean recovery.