# How We Tracked the $6B Binance Hack Live > Binance lost about $6.3B on Oct 29, 2026. Our live tracker of the attacker's wallets was online 30 minutes later, built on the Octav API and Arkham. - **URL:** https://octav.fi/blog/binance-hack-tracker - **Published:** 2026-11-03 - **Author:** Octav Team — Portfolio Intelligence for Digital Assets - **Topic:** API & Developers - **Tags:** api, developers, dashboard, security - **Source:** Octav, Practical guides on crypto NAV reporting, multi-chain portfolio management and digital asset APIs, from the team behind Octav. --- On October 29, 2026, attackers drained about **$6.3 billion** from Binance hot wallets across ten chains — the largest crypto theft on record. Ten minutes after the first drain we started building a tracker; the first version was online about **30 minutes** after the hack. It now follows **387 wallets across 9 chains** live at [binancehack.octav.fi](https://binancehack.octav.fi), built on the Octav API and Arkham, with Octav AI reviewing every run for new wallets to follow. ![The Binance drain tracker: $6B drained from Binance hot wallets on 9 chains, $2.84B frozen by token issuers, and where the rest stands — frozen, swapped, cashed out or still free](./images/binance-hack-tracker-overview.jpg) Below: what happened, where the money went, and how a live forensic dashboard of this size gets built in half an hour. ## What happened in the Binance hack? The attacker had Binance's signing set up in advance and executed it in one burst. On Ethereum, a hot wallet had been EIP-7702 delegated to a contract the attacker deployed hours earlier, so a single transaction could empty it. | Time (UTC) | Event | | --- | --- | | Oct 28 | Signer wallet receives 0.3 ETH from Tornado Cash, at least 36 hours before the theft | | Oct 29, ~16:00 | Same signer deploys the contract Binance Hot Wallet 14 is later delegated to | | 20:05 | First outflow: 233.46M XRP from five XRP Ledger wallets | | ~20:10 | Solana and Optimism hot wallets follow | | 20:20 | 18,270 BTC leaves the Bitcoin hot wallet; Tron's 612.7M USDT within two minutes | | 20:23 | One Ethereum transaction sweeps 167,464 ETH and 63 tokens, including 1.615B USDT | | 21:01 | Tether freezes the main attacker wallet; Circle follows at 21:04 | | 22:01 | Ripple freezes 40.5M RLUSD | | ~23:05 | Second wave on Avalanche and Polygon | | Oct 30, 00:08 | Arbitrum Security Council freezes ~$30M in ETH and ARB | | Oct 31 | Binance says it has replenished 90% of losses | Times are from [TRM Labs' analysis](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history) and the tracker's own on-chain timeline. ![The tracker's timeline: signer funded by Tornado Cash, contract deployed, hot wallet EIP-7702 delegated to it, then one transaction drains 64 tokens at 20:24 UTC, alongside live tracker events](./images/binance-hack-timeline.jpg) | Chain | Taken | Approx. value | | --- | --- | --- | | Ethereum | 200,630 ETH plus 185 tokens | $3.79B | | Bitcoin | 18,270 BTC | $1.47B | | Tron | 612.7M USDT, 46.4M TRX | $628M | | XRP Ledger | 233.46M XRP | $296M | | Solana | 970,500 SOL | $96M | | Arbitrum, Optimism, Base | incl. 74.6M ARB | $39M | | Avalanche | | $28M | | Polygon | | $10M | Source: TRM Labs, at prices when each asset was taken. **Who did it?** Nobody has proven it publicly. TRM Labs has linked the attack to TraderTraitor, a unit associated with North Korea's Lazarus Group, citing patterns shared with the 2025 Bybit hack: small Tornado Cash withdrawals, staging well ahead of time, and signatures collected in advance then executed in one burst. [NPR reported](https://www.npr.org/2026/10/31/nx-s1-6024426/binance-crypto-heist-cyber-criminals-north-korea) the FBI pointed the same way. North Korea has denied involvement. We don't attribute it ourselves — the tracker follows the money, not the people. ## Where did the $6B go? As of November 3, 15:05 UTC, the tracker splits the drained funds four ways: | State | Value | Share | What it means | | --- | --- | --- | --- | | Frozen | $2.84B | 47% | Locked by token issuers, checked on-chain | | Swapped | $733M | 12% | Turned into ETH and TRX, which cannot be frozen | | Cashed out | $40.3M | 1% | Sent to exchanges or off-ramps | | Still free | $2.38B | 40% | Not frozen and not yet swapped | ![Treemap of what the attacker holds: USDT $1.77B and USDC $825M fully frozen, BTC $1.41B and ETH $1.23B free to move, with smaller wBETH, SOL, XAUt and RLUSD balances](./images/binance-hack-holdings-treemap.jpg) The stablecoins are the frozen half. Tether, Circle, Paxos, Ripple, World Liberty, First Digital and Binance (for wBETH) have frozen about $2.8B between them. The attacker's response is visible in the flow map: race to swap everything else into assets no issuer can freeze. About 325M USDT went through UniswapX and other intent-based contracts for ETH, roughly 10% below market, according to TRM. ![Composite view of the tracker: the flow map of attacker wallets on EVM chains and Tron, $2.97B still at large against $2.81B frozen, and the attacker's Aave V3 position on Ethereum with a 1.060 health factor](./images/binance-hack-flow-overview.jpg) Some of the long tail is large relative to the token itself. The attacker holds 22% of Caldera's ERA circulating supply and 7.8% of Lagrange's LA — the kind of detail that matters to those projects and gets lost in a headline number. ![Token analysis table ranking every token in the attacker wallets by share of circulating supply, led by ERA at 22.09% and LA at 7.83%, with frozen status per token](./images/binance-hack-token-analysis.jpg) ## Why does DeFi decoding matter for tracking stolen funds? Because the attacker doesn't just hold tokens. They supplied 60M USDT to Aave V3 and borrowed 19,763 WETH against it — converting freezable stablecoins into ETH without selling them. ![The attacker's Aave V3 position on Ethereum: $59.9M supplied as 60.0M USDT, $44M borrowed as 19,763 WETH, health factor 1.060, near liquidation if ETH rises about 6%](./images/binance-hack-aave-position.jpg) A balance-only view of that wallet gets it wrong in both directions. It misses the 60M USDT entirely (it sits in Aave, not the wallet), and it sees 19,763 WETH as an asset with no debt against it. The real position is $15.9M net, with a 1.060 health factor: if ETH rises about 6%, it gets liquidated and part of the USDT collateral is sold to repay the loan. The Octav API returns that position decoded — supplied, borrowed, health factor — in the same call as the wallet's tokens. Why lending positions need this treatment is in [Tracking Aave Positions](/tracking-aave-positions), and why it moves reported net worth so much is in [Why Portfolio APIs Disagree About Net Worth](/why-portfolio-apis-disagree). ## How did we build a live tracker in 30 minutes? By not building any of the hard parts. The three problems a tracker like this has to solve were already solved: | Problem | Source | What it gives the tracker | | --- | --- | --- | | What does each wallet hold, on every chain? | [Octav API](/crypto-portfolio-api-guide) | Balances on all 9 chains, Tron included, plus decoded DeFi positions | | Who is on the other side of each transfer? | [Arkham Intel API](https://docs.intel.arkm.com/openapi) | Entity labels: exchanges, bridges, mixers, DEXes | | Which wallets should we follow next? | Octav AI, on our own servers | A review of every run that adds new attacker wallets to the tracking list | ![Octav x Arkham: how we tracked 337 wallets live on October 30, with $2.81B of $5.97B frozen by token issuers and the attacker's Aave V3 position](./images/binance-hack-337-wallets-card.jpg) With balances and labels taken care of, the tracker is a loop: 1. **Find new wallets.** Outflows from tracked wallets are followed, and Octav AI reviews each run for wallets to add (more below). 368 of the 387 wallets were found automatically, not entered by hand. 2. **Read every wallet.** Octav returns each wallet's tokens and DeFi positions across chains, so a wallet that bridges from Ethereum to Tron doesn't need a second integration. 3. **Label the exits.** Arkham identifies where funds land — OKX, HTX, the Circle and LayerZero bridges, SUN.io, a privacy mixer — so the flow map ends at named entities rather than anonymous addresses. 4. **Check freezes on-chain.** Frozen balances are read from the token contracts, not taken from press releases. 5. **Repeat every 5 to 10 minutes.** 138 runs so far. ![Every wallet the tracker follows, sorted by current holdings: the main Ethereum wallet with $2.11B frozen, 20 Bitcoin split addresses holding $1.41B, ETH vaults, the Tron main wallet and newly found wallets](./images/binance-hack-wallets.jpg) The slow part of a build like this is usually position decoding across chains and protocols. A token-balance API would have shown the Aave wallet wrong and needed separate handling for Tron, Solana and Bitcoin. Starting from decoded, multi-chain data, the remaining work is product: the flow map, the freeze logic and the timeline. ## How does the tracker find new wallets on its own? After every run, Octav AI reads what the run produced: each wallet's balances and DeFi positions from Octav, the Arkham label on every counterparty, and the new outflows since the last run. It looks for addresses that behave like the attacker's own — fresh wallets receiving split funds, staging addresses before a swap or a bridge — rather than an exchange, a bridge or a DEX, and adds them to the tracking list for the next run. Octav AI is Octav's own AI, and it runs on our own servers, so every run can be reviewed without sending the investigation's data to a third-party model. That makes the tracker self-growing. Each run follows more wallets, which gives the next review more data to work from: | Layer | Role in each run | | --- | --- | | Octav data | What every tracked wallet holds, on every chain, DeFi positions included | | Arkham | Who is on the other side of each transfer | | Octav AI | Which wallets to add before the next run | Nobody has to watch the attacker around the clock to keep the list complete. ## Can you build something like this? Yes — the data the tracker reads is the same data available to any Octav user, through whichever interface fits the job: | Tool | Use it when | | --- | --- | | [Octav API](/crypto-portfolio-api-endpoint-reference) | You're building a dashboard or pipeline, like this tracker | | [MCP server](/crypto-portfolio-mcp-server) | You want an AI assistant to answer "what did these wallets do in the last hour?" | | [CLI](/octav-cli-rust) | You want shell pipelines, cron jobs or a sandboxed agent | | [Portfolio at Block](/portfolio-at-block-guide) | You need what a wallet held at an exact block, such as the one before a drain | For a step-by-step build of a portfolio dashboard on the same API, see [Build a Crypto Portfolio Dashboard](/build-crypto-portfolio-dashboard). For how agents consume this data, see [AI Agent Tools for Crypto Portfolio Data](/ai-agent-tools-crypto-data). The tracker is live at [binancehack.octav.fi](https://binancehack.octav.fi). Every wallet in it opens in Octav at [pro.octav.fi](https://pro.octav.fi).