How We Tracked the $6B Binance Hack Live

On October 29, 2026, attackers drained about $6.3 billion from Binance hot wallets across ten chains — the largest crypto theft on record. Ten minutes after the first drain we started building a tracker; the first version was online about 30 minutes after the hack. It now follows 387 wallets across 9 chains live at binancehack.octav.fi, built on the Octav API and Arkham, with Octav AI reviewing every run for new wallets to follow.

Below: what happened, where the money went, and how a live forensic dashboard of this size gets built in half an hour.

What happened in the Binance hack?

The attacker had Binance's signing set up in advance and executed it in one burst. On Ethereum, a hot wallet had been EIP-7702 delegated to a contract the attacker deployed hours earlier, so a single transaction could empty it.

Times are from TRM Labs' analysis and the tracker's own on-chain timeline.

Source: TRM Labs, at prices when each asset was taken.

Who did it? Nobody has proven it publicly. TRM Labs has linked the attack to TraderTraitor, a unit associated with North Korea's Lazarus Group, citing patterns shared with the 2025 Bybit hack: small Tornado Cash withdrawals, staging well ahead of time, and signatures collected in advance then executed in one burst. NPR reported the FBI pointed the same way. North Korea has denied involvement. We don't attribute it ourselves — the tracker follows the money, not the people.

Where did the $6B go?

As of November 3, 15:05 UTC, the tracker splits the drained funds four ways:

The stablecoins are the frozen half. Tether, Circle, Paxos, Ripple, World Liberty, First Digital and Binance (for wBETH) have frozen about $2.8B between them. The attacker's response is visible in the flow map: race to swap everything else into assets no issuer can freeze. About 325M USDT went through UniswapX and other intent-based contracts for ETH, roughly 10% below market, according to TRM.

Some of the long tail is large relative to the token itself. The attacker holds 22% of Caldera's ERA circulating supply and 7.8% of Lagrange's LA — the kind of detail that matters to those projects and gets lost in a headline number.

Why does DeFi decoding matter for tracking stolen funds?

Because the attacker doesn't just hold tokens. They supplied 60M USDT to Aave V3 and borrowed 19,763 WETH against it — converting freezable stablecoins into ETH without selling them.

A balance-only view of that wallet gets it wrong in both directions. It misses the 60M USDT entirely (it sits in Aave, not the wallet), and it sees 19,763 WETH as an asset with no debt against it. The real position is $15.9M net, with a 1.060 health factor: if ETH rises about 6%, it gets liquidated and part of the USDT collateral is sold to repay the loan.

The Octav API returns that position decoded — supplied, borrowed, health factor — in the same call as the wallet's tokens. Why lending positions need this treatment is in Tracking Aave Positions, and why it moves reported net worth so much is in Why Portfolio APIs Disagree About Net Worth.

How did we build a live tracker in 30 minutes?

By not building any of the hard parts. The three problems a tracker like this has to solve were already solved:

With balances and labels taken care of, the tracker is a loop:

1. Find new wallets. Outflows from tracked wallets are followed, and Octav AI reviews each run for wallets to add (more below). 368 of the 387 wallets were found automatically, not entered by hand.
2. Read every wallet. Octav returns each wallet's tokens and DeFi positions across chains, so a wallet that bridges from Ethereum to Tron doesn't need a second integration.
3. Label the exits. Arkham identifies where funds land — OKX, HTX, the Circle and LayerZero bridges, SUN.io, a privacy mixer — so the flow map ends at named entities rather than anonymous addresses.
4. Check freezes on-chain. Frozen balances are read from the token contracts, not taken from press releases.
5. Repeat every 5 to 10 minutes. 138 runs so far.

The slow part of a build like this is usually position decoding across chains and protocols. A token-balance API would have shown the Aave wallet wrong and needed separate handling for Tron, Solana and Bitcoin. Starting from decoded, multi-chain data, the remaining work is product: the flow map, the freeze logic and the timeline.

How does the tracker find new wallets on its own?

After every run, Octav AI reads what the run produced: each wallet's balances and DeFi positions from Octav, the Arkham label on every counterparty, and the new outflows since the last run. It looks for addresses that behave like the attacker's own — fresh wallets receiving split funds, staging addresses before a swap or a bridge — rather than an exchange, a bridge or a DEX, and adds them to the tracking list for the next run.

Octav AI is Octav's own AI, and it runs on our own servers, so every run can be reviewed without sending the investigation's data to a third-party model.

That makes the tracker self-growing. Each run follows more wallets, which gives the next review more data to work from:

Nobody has to watch the attacker around the clock to keep the list complete.

Can you build something like this?

Yes — the data the tracker reads is the same data available to any Octav user, through whichever interface fits the job:

For a step-by-step build of a portfolio dashboard on the same API, see Build a Crypto Portfolio Dashboard. For how agents consume this data, see AI Agent Tools for Crypto Portfolio Data.

The tracker is live at binancehack.octav.fi. Every wallet in it opens in Octav at pro.octav.fi.