Binance · Closed coverage9 min read

Binance Hack: Impact on Bitcoin Flows

The hack interrupted the funding and payment route through Binance’s affected Bitcoin hot wallet. This dated account follows the theft, subsequent reserve transfers and deposits held upstream.

TrackBTC

Detailed tables verified through 30 October 2026 · 04:39:44 UTC · block 973,773. These tables do not yet include the subsequent deposits.

Before the hack, Binance used this Bitcoin hot wallet to send payments to exchanges and other recipients. A network of 3,445,588 customer deposit addresses and Binance reserve wallets funded it. Its average balance was 12,097 BTC from 1 August until the hack began on 29 October.

How the hack disrupted the payment route

The sequence below covers 29 October at 20:20 UTC through 30 October at 04:39 UTC. The latest incoming-deposit totals are shown above.

The hack removed 95.6% of the hot wallet’s balance

At 20:20 UTC on 29 October, eleven unauthorized transfers sent 18,270.2 BTC to the attacker. Transfers from Binance’s deposit addresses continued briefly afterward, sending another 970.43 BTC across eight transfers.

Follow the theft and subsequent transfers.

As of 04:39 UTC, payments are 96.2% below their historical average

External payments stopped at 20:48 UTC, while transfers from deposit addresses continued until 21:15 UTC. Later transfers moved 1,770 BTC to Binance’s established cold address, leaving 0.37 BTC in the hot wallet.

Over this reporting period, the wallet has sent 52.16 BTC to external recipients, against a historical average of 1,372.72 BTC. That is 1,320.56 BTC less paid out than during the same hours in the previous eight weeks. See the affected payment routes.

Incoming deposits are 75.5% below usual, but a much larger share remains held

As of 04:39 UTC, 329.99 BTC has arrived across 2,843 transfers since the hack began. Incoming deposits continue while onward transfers to the compromised hot wallet remain stopped.

87.4% of that Bitcoin remains at its original deposit address, compared with 30.1% historically. Less Bitcoin is arriving, yet a much larger share remains held: 288.27 BTC. See where the held deposits came from.

Live coverage continues in our reopening article

Follow the held deposits, changing funding routes and outgoing payments as Binance restores operations.

The payment and deposit comparisons use Thursday 20:20:06–Friday 04:39:44 UTC in each of the previous eight weeks, 03 September–23 October 2026. View the eight dated comparison periods.

01 · Incoming deposits and held funds

As of 04:39 UTC on 30 October, 288.27 BTC remains at deposit addresses

At this observation time, 329.99 BTC has arrived in 2,843 deposit transactions since the hack began. Of that amount, 288.27 BTC remains at the original receiving addresses.

87.4% of deposits received since the hack remains at the receiving addresses

288.265 BTC held at the original deposit addresses.

41.726 BTC moved. The main branch went through the hot wallet into the familiar cold transfers.

Earlier deposits are measured over eight Thursday 20:20:06–Friday 04:39:44 UTC periods, 03 September–23 October 2026. Across those periods, 30.1% of deposited value remained at its receiving address when the respective period ended. Deposits averaged 1,348.86 BTC per period; 329.99 BTC has arrived during 29 Oct 20:20:06–30 Oct 2026 04:39:44 UTC.

Sources of deposits held at this snapshot

Named sending platforms account for 114.641 BTC still held. Unnamed and mixed sources account for another 173.624 BTC.

Named sending platforms · 29 Oct 20:20:06–30 Oct 2026 04:39:44 UTC · BTC · largest held amounts first. Historical comparison: eight Thursday 20:20:06–Friday 04:39:44 UTC periods, 03 September–23 October 2026.
Sending platformHistorical daily average1 Aug–28 Oct 2026Historical average for these hoursDeposited since hackStill at deposit addresses
BIT.com (Matrixport)150.2638.5241.67941.679
Crypto.com72.9714.1817.83617.836
Upbit33.629.2713.39713.397
Coinbase395.7571.7112.8398.571
Bybit209.7461.018.0508.050
Kraken195.725.9619.0357.409
Gate78.4214.905.0035.003
Gemini5.892.254.6704.670
ViaBTC4.751.783.0623.062
Backpack Exchange7.050.194.0321.102
More sending platforms · 15 additional rows
Named sending platforms · 29 Oct 20:20:06–30 Oct 2026 04:39:44 UTC · BTC · largest held amounts first. Historical comparison: eight Thursday 20:20:06–Friday 04:39:44 UTC periods, 03 September–23 October 2026.
Sending platformHistorical daily average1 Aug–28 Oct 2026Historical average for these hoursDeposited since hackStill at deposit addresses
cryptonit.net8.912.270.9070.907
OKX332.33129.791.0360.716
KuCoin92.3523.130.6010.601
Paxos1.240.220.4350.435
Cobo.com60.890.070.3150.315
Luno2.080.670.3110.311
FixedFloat0.060.010.1660.166
CoinSpot1.420.020.1300.130
Deribit56.483.180.0920.092
Bitget93.345.830.0860.086
Robinhood0.330.090.0800.080
Coinbase Prime10.400.640.0070.007
HitBTC27.3710.640.0060.006
Bitvavo19.120.060.4260.005
bitFlyer2.520.200.0030.003

The names describe originating platforms, not individual customers. Displayed amounts are rounded; exact values remain in the downloadable figures. Daily averages cover complete days from 1 August–28 October 2026. The overnight comparison uses the eight dated periods listed in the payment history table.

Liquidity bottleneck in the deposit-to-payment route

As of 04:39 UTC, incoming deposits continue while outgoing payments from the compromised hot wallet remain stopped. Funds are being held at deposit addresses rather than forwarded to that wallet. The table compares their waiting times with earlier deposits before Binance moved them. Each row groups deposits by sending platform, such as Coinbase or Kraken.

Deposits waiting longer at this snapshot than 90% of earlier deposits from the same sending platform · updated through 30 Oct 2026 04:39:44 UTC
Sending platformHistorical median wait90% of earlier deposits moved withinOldest current depositBTC waiting longer than that timeEarlier deposits measured
BIT.com (Matrixport)1h 22m 50s2h 15m 21s7h 40m 08s35.86221
Crypto.com2h 20m 01s4h 47m 57s8h 19m 38s17.740177
Coinbase2h 33m 58s4h 50m 26s8h 19m 38s8.158781
Upbit1h 53m 34s4h 19m 14s7h 24m 32s8.058137
Kraken2h 34m 26s4h 57m 11s8h 19m 38s4.999237
Gemini1h 56m 01s3h 13m 33s7h 45m 08s4.67012
Bybit2h 11m 33s4h 53m 03s7h 51m 30s3.939169
OKX2h 04m 38s4h 33m 41s8h 16m 57s0.602190
KuCoin2h 09m 06s3h 44m 26s7h 45m 08s0.60045
ViaBTC3h 07m 25s5h 00m 02s8h 19m 38s0.4482,390
More deposit waiting-time comparisons · 12 additional rows
Deposits waiting longer at this snapshot than 90% of earlier deposits from the same sending platform · updated through 30 Oct 2026 04:39:44 UTC
Sending platformHistorical median wait90% of earlier deposits moved withinOldest current depositBTC waiting longer than that timeEarlier deposits measured
Luno2h 03m 53s4h 28m 03s7h 24m 32s0.28622
cryptonit.net2h 34m 38s5h 22m 52s8h 19m 38s0.275608
Paxos2h 33m 58s4h 56m 50s8h 19m 38s0.193309
CoinSpot3h 06m 25s4h 26m 51s7h 46m 55s0.11830
Deribit1h 59m 44s5h 35m 58s7h 15m 55s0.0928
Bitget2h 17m 08s4h 28m 06s8h 19m 38s0.08562
Robinhood2h 40m 55s4h 42m 49s7h 46m 55s0.015188
Coinbase Prime1h 58m 34s3h 44m 24s5h 22m 54s0.00720
HitBTC1h 59m 57s2h 47m 18s4h 44m 33s0.00640
Bitvavo2h 09m 40s3h 59m 40s8h 19m 38s0.00512
bitFlyer1h 29m 51s2h 45m 21s4h 33m 15s0.0035
Gate2h 12m 40s3h 42m 34s8h 16m 57s0.00354

The earlier deposits arrived during eight Thursday 20:20:06–Friday 04:39:44 UTC periods, 03 September–23 October 2026, and were subsequently moved. The median is the middle waiting time among the earlier deposits. “90% moved within” is the time by which nine out of ten measured deposits had left their original addresses. The BTC column counts only deposits at this snapshot that had already waited longer than that time. Waiting times use block timestamps; at least 4 valid earlier examples are required.

The ten largest later deposits, held addresses, and funds that moved
Largest deposits since the attack began · BTC
UTCSourceDepositedStill heldTransaction
29 Oct 20:52:49Unnamed45.9439727045.94397270View ↗
30 Oct 01:26:36BIT.com (Matrixport)30.0551000030.05510000View ↗
29 Oct 20:54:36Crypto.com12.6792160012.67921600View ↗
29 Oct 20:20:06Kraken11.625985000.00000000View ↗
29 Oct 23:16:50Upbit8.000000008.00000000View ↗
29 Oct 20:24:46Coinbase7.967232177.96723217View ↗
30 Oct 02:31:12Unnamed7.035291367.03529136View ↗
29 Oct 20:22:47Unnamed6.405000000.00000000View ↗
29 Oct 20:52:49Unnamed6.000000006.00000000View ↗
30 Oct 04:31:33Unnamed6.000000006.00000000View ↗
Addresses holding the most from these later deposits · BTC
Deposit addressDepositedStill held
1PL7KwQ…847Zov45.9439727045.94397270
1DQm1nk…9tdxYB35.9904433135.99044331
1gnC2tQ…d5b4MQ17.6788630017.67886300
1Ni1bjM…Fu8ACo14.0000000014.00000000
1BXaYQX…etyhS220.166948158.54096315
16a2f5j…1Ua4Ga8.000000008.00000000
1GkDDf6…ixN8Cr7.963758137.96375813
12gMS25…EXc2rt7.848841957.84884195
199JVFu…yP2GwG8.254062987.19600404
1JuMP1w…bmiJNZ7.035291367.03529136

Of the 41.72609060 BTC spent later, 41.72608235 BTC entered the hot wallet. Its connected spends delivered 41.66797525–41.72608235 BTC to the familiar cold address. The interval accounts for other inputs, fees and change.

A separate 825-satoshi deposit became a 636-satoshi payment and a 189-satoshi fee. Every spent deposit tracked in this period is accounted for.

02 · Outgoing payment interruption

As of 04:39 UTC on 30 October, outgoing payments remain stopped

The hot wallet has made no external payments since 20:48:14 UTC on 29 October. At this observation time, the interruption has lasted 7h 51m 30s.

During 29 Oct 20:20:06–30 Oct 2026 04:39:44 UTC, external payments total 52.16 BTC. The average for the same hours in the previous eight weeks was 1,372.72 BTC, a decline of 96.2%.

Payments are 96.2% below the average for the same hours in the previous eight weeks

52.16 BTC has been sent during this period, compared with an average of 1,372.72 BTC. Earlier periods ranged from 688.59 to 2,292.42 BTC.

All external recipients52.16 sent / 1,372.72 historical average · BTC

Each earlier period runs from Thursday 20:20:06–Friday 04:39:44 UTC, one week apart from 03 September–23 October 2026. The dated totals below exclude the attacker, known Binance wallets and funds returned to the same hot address.

Average of the eight dated periods belowSent after the attack began
External payments from the affected hot wallet · each period runs Thursday 20:20:06–Friday 04:39:44 UTC · BTC
Dates · UTCExternal payments · BTC
03 Sep–04 Sep 20261,318.79
10 Sep–11 Sep 20261,044.61
17 Sep–18 Sep 2026688.59
24 Sep–25 Sep 20262,292.42
01 Oct–02 Oct 20261,491.38
08 Oct–09 Oct 20261,909.23
15 Oct–16 Oct 20261,044.33
22 Oct–23 Oct 20261,192.44
29 Oct–30 Oct 2026After the hack52.16

Of the payments actually sent, 9.9172 BTC reached named platforms and 42.2472 BTC reached unnamed recipients.

Receiving platforms with payments below their historical range

Coinbase-linked wallets received at least 0.742 BTC in each of those eight Thursday–Friday periods. They have received 0.074 BTC during 29 Oct 20:20:06–30 Oct 2026 04:39:44 UTC.

Named receiving platforms · 29 Oct 20:20:06–30 Oct 2026 04:39:44 UTC · BTC. Historical comparison: eight Thursday 20:20:06–Friday 04:39:44 UTC periods, 03 September–23 October 2026.
Receiving platformHistorical daily average1 Aug–28 Oct 2026Historical average for these hoursMinimum–maximumSent since hackBelow historical averageEarlier periods with paymentsOut of 8
Coinbase483.00119.900.74–407.870.074119.838 / 8
Bullish.com215.9084.4034.40–145.800.00084.408 / 8
Bybit150.5138.841.42–160.940.08138.768 / 8
Crypto.com71.1031.330.69–75.900.12931.218 / 8
MEXC32.3015.150.02–67.080.00015.158 / 8
KuCoin40.5512.210.72–24.020.55311.658 / 8
Upbit40.1210.591.02–27.400.00010.598 / 8
Deribit35.887.910.01–62.750.0007.918 / 8
cryptonit.net9.511.791.01–4.490.0001.798 / 8
Revolut2.790.240.03–0.850.0000.248 / 8

For each highlighted platform, payments are below its smallest amount in the eight dated periods and at least 90% below its average. Names identify receiving platforms, including customer deposit addresses there.

All named receiving-platform comparisons · 30 rows

This wider ranking retains occasional routes and changes within their historical range. The overall payment total also includes unnamed recipients.

Named receiving platforms · 29 Oct 20:20:06–30 Oct 2026 04:39:44 UTC · BTC. Historical comparison: eight Thursday 20:20:06–Friday 04:39:44 UTC periods, 03 September–23 October 2026.
Receiving platformHistorical daily average1 Aug–28 Oct 2026Historical average for these hoursMinimum–maximumSent since hackBelow historical averageEarlier periods with paymentsOut of 8
Coinbase483.00119.900.74–407.870.074119.838 / 8
Bullish.com215.9084.4034.40–145.800.00084.408 / 8
OKX385.3570.305.89–184.899.08061.228 / 8
Bitfinex92.6042.920.00–136.320.00042.926 / 8
Bybit150.5138.841.42–160.940.08138.768 / 8
Nexo9.3331.250.00–250.000.00031.251 / 8
Crypto.com71.1031.330.69–75.900.12931.218 / 8
FalconX27.3020.690.00–142.500.00020.693 / 8
Flow Traders46.4118.740.00–80.000.00018.744 / 8
MEXC32.3015.150.02–67.080.00015.158 / 8
Wintermute321.0114.510.00–116.100.00014.511 / 8
Jump Crypto110.3814.110.00–56.150.00014.115 / 8
Bitstamp48.6413.380.00–40.660.00013.385 / 8
Copper80.5412.890.00–72.710.00012.893 / 8
KuCoin40.5512.210.72–24.020.55311.658 / 8
Upbit40.1210.591.02–27.400.00010.598 / 8
Deribit35.887.910.01–62.750.0007.918 / 8
HitBTC22.045.250.00–41.970.0005.255 / 8
BIT.com (Matrixport)81.314.040.00–17.360.0004.045 / 8
cryptonit.net9.511.791.01–4.490.0001.798 / 8
Galaxy Digital11.421.620.00–13.000.0001.621 / 8
Gate22.671.560.00–6.710.0001.567 / 8
HTX1.960.480.00–2.340.0000.485 / 8
Gemini1.740.430.00–3.430.0000.436 / 8
CoinSpot1.290.310.00–2.500.0000.311 / 8
Revolut2.790.240.03–0.850.0000.248 / 8
Cobo.com15.140.080.00–0.320.0000.088 / 8
ChangeNOW10.890.050.00–0.390.0000.051 / 8
Paxos0.540.040.00–0.120.0000.048 / 8
bitFlyer1.400.010.00–0.100.0000.014 / 8
03 · Historical operations

Historical funding network and wallet balances

The tracked network of Binance deposit addresses contains 3,445,588 addresses. Before the hack, Binance combined deposits from this network into transfers to the hot wallet. The hot wallet made payments and periodically moved funds to cold storage.

Incoming customer deposits3,445,588 addresses1Eqt1ZF…NEFMGSExample deposit address
Binance hot walletOne addressbc1qm34…j77s3hReceived sweeps and reserve refills
Outgoing fundsRecipients + cold storage3M219KR…DjxRP6Familiar cold destination

The deposit-address count is measured at block 973,130. The activity below follows this hot address and its connected routes.

Hot-wallet activity before the hack · BTC · funding, payments and reserve movements
MonthReceivedSentOutgoing transactionsClosing balance
2026-08200,653194,64523,65613,332.22
2026-09174,048174,44622,72212,932.75
2026-10Through 29 Oct, before the attack166,142159,96321,74819,110.75

Historical balance range: 8,109–17,122 BTC

Usual balance range19,110.75 before the attack0.37 at this snapshot

The middle 80% of time-weighted balances, 1 August–29 October before the attack. The average was 12,097.27 BTC.

Incoming customer deposits5,616 BTC / day

Average across complete days, 1 August–28 October.

Hot-wallet payments to external recipients5,109 BTC / day

Same days. Excludes known Binance destinations and change.

04 · Funding before the hack

Funding sources in the final pre-hack cycle

After the 26 October cold transfer, the hot wallet kept receiving funds and making payments. It held 19,110.75 BTC when the attack began.

26 Oct 09:29 UTC to the attack · exact balance account · BTC
Balance after the cold transfer14,882.98235345
Incoming funding35,605.88721779
Outgoing payments and transfers31,378.04960665
Network fees0.07055890
Balance before the attack19,110.74940569
Direct funding sources · 26 Oct 2026 09:29:07–29 Oct 20:20:06 UTC · BTC
SourceTransfersReceived by hot wallet
Binance customer deposit addresses1Eqt1ZF…NEFMGS40026,605.608
Binance reserve group1Pzaqw9…sENrE715,000.000
Binance reserve group378GLcv…zeG7JN14,000.000
Unnamed1KhaeRB…KnkNog150.179
Unnamedbc1qvzu…arwpcu10.048
Unnamedbc1qrkd…jfg6ku10.034
Unnamed3K6wTcS…GHDado10.014
KuCoinbc1qxzu…hdueja10.004
Unnamed3DnMU6k…pXdFgi10.000

Examples of deposits forwarded to the hot wallet

Each row follows a deposit from an outside sending wallet into a Binance customer address, then into the hot wallet. The deposit amount is before sweep fees.

Six examples from the largest named sources behind 400 transfers from Binance deposit addresses
Sending platform / walletBinance deposit addressDeposit · BTCDeposit time · UTCWait to sweepHot-wallet arrival · UTC
Krakenbc1qr3m…gj979w1BXaYQX…etyhS2Deposit ↗8.5949829 Oct 06:162h 43m 33s29 Oct 09:00Sweep to hot wallet ↗
Coinbase352zzNH…vHJQB21KbDEg1…QFaFx5Deposit ↗130.0000029 Oct 08:262h 46m 20s29 Oct 11:12Sweep to hot wallet ↗
Deribitbc1q78c…ur8j4712D5nC9…jaHLFJDeposit ↗99.9999729 Oct 09:431h 34m 46s29 Oct 11:17Sweep to hot wallet ↗
Bullish.com324H9uy…wk5CYq1KbDEg1…QFaFx5Deposit ↗47.1999429 Oct 15:221h 27m 24s29 Oct 16:49Sweep to hot wallet ↗
OKXbc1qlx8…74zh0v12Rx9Z3…E5ko6iDeposit ↗41.0664929 Oct 16:492h 25m 10s29 Oct 19:14Sweep to hot wallet ↗
Wintermute15DomY3…YCDmW21KbDEg1…QFaFx5Deposit ↗182.0000029 Oct 17:261h 48m 46s29 Oct 19:14Sweep to hot wallet ↗
05 · Hack and subsequent transfers

Theft of 18,270.2 BTC and subsequent cold transfers

The attacker stole 18,270.2 BTC in one block, removing 95.6% of the opening balance. Transfers from deposit addresses continued briefly before funds moved to the established cold address.

The sequence · UTC · all amounts in BTC
WhenWhat happenedAmount
29 Oct 20:20:0611 payments to bc1q0mt…hl2mnm18,270.20
29 Oct 20:48:14Last external payment; none follows for 7h 51m 30s52.16 total
29 Oct 21:15:12Final refill, 0h 55m 06s after the attack beganEight further transfers from deposit addresses arrived970.43
29 Oct 23:16:50Through 30 Oct 00:22:01Six transfers to the familiar cold address1,770.00
30 Oct 04:39:44Hot-wallet balance remaining0.37442392

Cold-transfer size relative to the available balance

The 11 earlier transfers occurred between 11 August and 26 October 2026. Each sent 32.2–42.8% of the hot wallet’s balance immediately before that transfer. The later 1,468-BTC transfer sent 93.6%. It is the same Binance-attributed cold address.

Later individual transfers to the familiar cold address · BTC
UTCHot-wallet balance before transferSentShare of that balance sent
29 Oct 23:16:50View ↗1,770.38202.0011.4%
29 Oct 23:16:50View ↗1,568.381,468.0093.6%
29 Oct 23:16:50View ↗100.389.009.0%
29 Oct 23:16:50View ↗91.3888.0096.3%
29 Oct 23:55:11View ↗3.371.0029.6%
30 Oct 00:22:01View ↗2.372.0084.2%
Transaction-by-transaction drain, refills and cold transfers
One chronological ledger · BTC · zero means no movement of that type in the transaction
UTC / transactionReceivedAttackerCold addressOther paymentsBalance after
29 Oct 20:20:06View ↗0.0000000044.200000000.000000000.0000000019,066.54933699
29 Oct 20:20:06View ↗0.00000000194.300000000.000000000.0000000018,872.24914539
29 Oct 20:20:06View ↗0.0000000067.200000000.000000000.0000000018,805.04905619
29 Oct 20:20:06View ↗0.00000000369.600000000.000000000.0000000018,435.44878269
29 Oct 20:20:06View ↗0.000000007,636.800000000.000000000.0000000010,798.64814069
29 Oct 20:20:06View ↗0.000000002,946.900000000.000000000.000000007,851.74758739
29 Oct 20:20:06View ↗0.000000004,696.600000000.000000000.000000003,155.14693169
29 Oct 20:20:06View ↗0.000000001,409.500000000.000000000.000000001,745.64640569
29 Oct 20:20:06View ↗0.00000000773.100000000.000000000.00000000972.54599569
29 Oct 20:20:06View ↗0.00000000112.100000000.000000000.00000000860.44586559
29 Oct 20:20:06View ↗0.0000000019.900000000.000000000.00000000840.54582419
29 Oct 20:20:06View ↗0.000000000.000000000.000000000.03766682840.50814562
29 Oct 20:20:06View ↗0.000000000.000000000.000000004.89948696835.60863516
29 Oct 20:20:06View ↗0.000000000.000000000.000000000.87428163834.73432263
29 Oct 20:20:06View ↗0.000000000.000000000.000000000.18817826834.54611477
29 Oct 20:20:06View ↗0.000000000.000000000.000000000.29881464834.24727363
29 Oct 20:20:06View ↗0.000000000.000000000.000000000.12565839834.12158219
29 Oct 20:20:06View ↗0.000000000.000000000.000000000.06399985834.05755219
29 Oct 20:20:06View ↗0.000000000.000000000.000000000.10905292833.94847322
29 Oct 20:20:06View ↗0.000000000.000000000.000000001.72760107832.22085540
29 Oct 20:20:06View ↗0.000000000.000000000.000000000.45613098831.76470192
29 Oct 20:20:06View ↗0.000000000.000000000.000000000.03098688831.73368384
29 Oct 20:20:06View ↗11.560785330.000000000.000000000.00000000843.29446917
29 Oct 20:22:47View ↗0.000000000.000000000.000000000.30490197842.98953630
29 Oct 20:22:47View ↗0.000000000.000000000.000000003.56122896839.42827939
29 Oct 20:22:47View ↗9.387035260.000000000.000000000.00000000848.81531465
29 Oct 20:24:46View ↗0.000000000.000000000.000000001.20365530847.61162900
29 Oct 20:33:48View ↗0.000000000.000000000.0000000022.31790154825.29370271
29 Oct 20:33:48View ↗0.000000000.000000000.000000000.09960944825.19406217
29 Oct 20:33:48View ↗0.000000000.000000000.000000002.70130000822.49275512
29 Oct 20:33:48View ↗0.000000000.000000000.000000004.23267265818.26004837
29 Oct 20:33:48View ↗0.000000000.000000000.000000007.30000000810.96004132
29 Oct 20:33:48View ↗0.000000000.000000000.000000001.42835677809.53165395
29 Oct 20:34:00View ↗0.000000000.000000000.000000000.02088915809.51074755
29 Oct 20:48:14View ↗0.000000000.000000000.000000000.01473665809.49599605
29 Oct 20:48:14View ↗0.000000000.000000000.000000000.16728032809.32869583
29 Oct 20:48:14View ↗167.529927890.000000000.000000000.00000000976.85862372
29 Oct 20:48:14View ↗95.908195600.000000000.000000000.000000001,072.76681932
29 Oct 20:48:14View ↗85.979277760.000000000.000000000.000000001,158.74609708
29 Oct 20:48:14View ↗77.999993220.000000000.000000000.000000001,236.74609030
29 Oct 20:48:14View ↗349.999996200.000000000.000000000.000000001,586.74608650
29 Oct 20:48:14View ↗134.999996200.000000000.000000000.000000001,721.74608270
29 Oct 21:15:12View ↗48.630367920.000000000.000000000.000000001,770.37645062
29 Oct 23:16:50View ↗0.000000000.00000000202.000000000.000000001,568.37583952
29 Oct 23:16:50View ↗0.000000000.000000000.000000000.000000001,568.37582472
29 Oct 23:16:50View ↗0.000000000.000000001,468.000000000.00000000100.37521362
29 Oct 23:16:50View ↗0.000000000.000000009.000000000.0000000091.37510757
29 Oct 23:16:50View ↗0.000000000.0000000088.000000000.000000003.37449987
29 Oct 23:55:11View ↗0.000000000.000000001.000000000.000000002.37447912
30 Oct 00:22:01View ↗0.000000000.000000002.000000000.000000000.37442082
30 Oct 01:02:10View ↗0.000003100.000000000.000000000.000000000.37442392

Network fees are included in each closing balance. Exact fees and transaction links are available in the downloadable figures.

06 · Operational status and recovery monitoring

Final recorded operational status

As of 02:18:04 UTC on 31 October 2026, the tracked Binance deposit addresses have received 1,370.12 BTC since 00:00 UTC on 30 October. Onward transfers total 0.00 BTC; these addresses hold 1,544.37 BTC.

Binance’s announcement describes unauthorized withdrawals through a service container and a temporary suspension of deposits and withdrawals. It reports no evidence of a private-key leak. The access mechanism is Binance’s finding; the movement history corroborates the interrupted route and subsequent response.

This coverage is closed. Our reopening article carries the subsequent operational updates and historical comparisons.

How the figures are built

TrackBTC reconstructs balances and transaction links, then compares source and recipient histories over matching periods. This report follows one Bitcoin hot wallet and its connected network of deposit addresses under a retained address-grouping snapshot.

Payments exclude change, known Binance destinations and the attacker. Historical comparison windows have the same weekday, start time and duration as the observed post-hack window. Zero activity is counted only where source coverage is complete.

Deposit waiting times measure original outputs through their later spends. Completed examples establish the median and 90th percentile; incomplete history remains attached to the underlying signals.

The estimated outgoing shortfall, reduced incoming volume and actual held deposits measure different effects. They are not added into one loss figure.

Download the figures, transaction links and source commitments.

Operational context for treasury and risk teams

Further operational coverage

TrackBTC reports track changes in balances, counterparties and payment activity. Related intelligence and institutional access are available below.

Explore Bitcoin intelligenceExplore a shadow pilot