Investigators have identified a $4 million transfer that was sent to three Binance deposit addresses after the massive hot‑wallet theft on October 29, 2026. The funds appear to have been routed through third‑party exchanges before reaching Binance, a common technique used to distance stolen assets from their source.
Background of the theft
On October 29, 2026 attackers drained approximately $6.3 billion from Binance’s hot wallets across about ten blockchain networks. The operation moved the assets in under 30 minutes and involved multiple chains.
How the $4 million moved
The recent deposit consists of three separate Binance addresses that received the funds after likely passing through external exchanges. Public fund‑flow reports have not yet provided additional details about the ownership of these addresses or the next steps for the assets.
Investigation findings
Blockchain analytics firms TRM Labs and Chainalysis have linked the attack to the North Korean hacker group TraderTraitor, which has been associated with prior incidents such as the Bybit hack. The FBI also attributed the theft to this group and identified over 600 related addresses.
Technical cause
Early analysis suggests the breach originated from a compromised laptop belonging to a DevOps engineer, granting the attackers access to Binance’s wallet‑management infrastructure without compromising private keys directly.
Response and market impact
Stablecoin issuers froze roughly $2.7 billion to $3 billion of the affected assets. Binance pledged to reimburse all customer losses using its Secure Asset Fund for Users (SAFU) and other reserves, and began processing withdrawals on November 1, 2026.
The $4 million deposit provides investigators with a potential lead, as funds entering a regulated exchange are subject to identity verification and transaction monitoring.
Outlook
Key points to monitor include confirmation of the three deposit addresses by Binance or analytics firms, the possibility of additional stolen funds appearing at centralized exchanges, and the overall traceability of the remaining assets, which largely consist of non‑freezable Bitcoin and Ethereum.
