Part of the loot from the October 29 hot wallet drain appears to be heading back to the exchange it was taken from, likely via third-party platforms
The hacker behind the Binance hot wallet drain has deposited $4 million into three Binance deposit addresses. The funds likely arrived by way of third-party exchanges.
The deposit is a small slice of a much larger theft. On October 29, 2026, attackers drained approximately $6.3 billion from Binance’s hot wallets across around ten blockchains. Hot wallets are the internet-connected wallets exchanges use to process day-to-day withdrawals.
Following the money back to Binance
The $4 million moved into three separate Binance deposit addresses. The route likely ran through third-party exchanges first, a common way to put distance between stolen coins and their origin.
Public fund-flow reports have not yet offered further corroboration or context for the deposit. That leaves open questions about who controls the receiving addresses and what happens to the funds next.
The move fits a broader laundering pattern investigators have been tracking. The attackers have been shifting non-freezable assets such as Bitcoin (BTC) and Ethereum (ETH) through complex conversions. Mixers like Tornado Cash have also been part of the playbook.
The focus on BTC and ETH is no accident. Stablecoin issuers can freeze tokens on their own networks, and they did. Bitcoin and Ether have no central issuer with a freeze button, so they are the attackers’ most portable assets.
How the heist unfolded
The attack itself was fast. Attackers moved roughly $6.3 billion to $6.36 billion in under 30 minutes, with the full operation spanning a window of roughly 20 to 30 minutes. It was also enough to touch around ten different chains.
Early investigations point to a compromised laptop belonging to a DevOps engineer. That access likely gave attackers a way into Binance’s wallet management infrastructure. From there, the system processed withdrawal transactions without any evident compromise of private keys.
Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean hacker group. The same group has been linked to earlier incidents, including the Bybit hack.
The FBI attributed the theft to TraderTraitor on or about October 31, 2026. The bureau also listed over 600 addresses associated with the operation.
Freezes, refunds and a rush for the exits
Stablecoin issuers moved quickly after the breach. They froze an estimated $2.7 billion to $3 billion in affected assets.
Binance pledged to cover all customer losses. The exchange said it would use its Secure Asset Fund for Users (SAFU) along with other reserves.
Withdrawals came back in phases starting November 1, 2026. Net outflows reached around $3.6 billion to $4.9 billion within the initial hours.
What this means for Binance and the broader market
For investigators, the $4 million deposit is a potential thread worth pulling. Funds landing at a major exchange, even through intermediaries, enter an environment with identity checks and transaction monitoring.
The suspected entry point was not an exotic cryptographic flaw. It was an employee device connected to critical infrastructure.
For the market, the open question is the unfrozen remainder. Billions in stolen assets were not caught by stablecoin freezes, and much of the movable portion sits in BTC and ETH.
The next things to watch are whether Binance or analytics firms confirm the status of the three deposit addresses, whether more stolen funds surface at centralized exchanges, and how much of the haul investigators can ultimately trace.
