researchismOn Oct. 29, 2026, at 4:24 p.m. Eastern, a Binance hot wallet sent nearly everything it held away in a single transaction. The fee: 96 cents. Binance estimates the total impact at about $6.3 billion.
Within the hour, Tether and Circle froze the attacker’s main wallet, before Binance had said a word in public. Using the public ledger, Binance’s own statements and the posts of the people who raced to freeze the money, we follow it from one hot wallet to where it sits now, and keep apart what is confirmed, what is reported and what is still a theory. This story is still developing.
How to read our sources
In the film, a small dot lights up where a claim is made, then slides into the right margin and becomes a note: a number, the source and its year. That number is the number below. researchism.tv/binance-hack-where-did-6-billion-go/#5 takes you straight to source 5.
The brightness of the dot is our certainty, the lamp code:
Lit: established. A court finding, an admission in a plea, an official record.
Half: reported or alleged. Indictments, prosecutors’ claims, press reports, an investigator’s own account.
Dark: unknown or unverified. We looked and could not confirm it.
The dot rates the claim as the film makes it. A line like “prosecutors said” can be lit: the record proves they said it, not that it is true. The dot’s shape tells you what kind of source it is:
primary recordsecondary: press or an investigatortestimony or our own estimate
Every source shows when it was published and when we last looked at it. “Accessed” is the day we retrieved and read it. “Link checked” is the day its link last opened for us. Where a site blocks automated checks, we say that the link was not confirmed.
Sources
The 3 sources numbered on screen, in order. Timecodes show where each number appears in the film; the small dot is its brightness at that moment.
- 1
“Security Incident Update (2026-10-30)”
Accessed
Binance’s own account: an estimated total impact of about $6.3 billion, about $3 billion frozen on-chain, no evidence of a wallet private key leak, an early finding that an engineer’s laptop may have been compromised, and a promise to cover all losses. Updated on Oct. 30, 2026 (7:36 a.m. ET, per the page’s data) with a note that deposits “remain unaffected and continue to operate as normal”; withdrawals stay suspended.
established
In the film 1:14
- 5
Ethereum transaction 0x53bd…e2f3: the sweep out of Binance 14, network fee 0.000414 ETH
Accessed
Our own check: one call moved more than 60 tokens and ether from Binance 14 to the attacker’s main wallet (0x5227…2f8c), among them 1,615,409,499 USDT. Transaction ID shortened; the link opens the block.
established
In the film 1:15
- 11
“Tether froze more than 1.567B USDT related to a potential Binance exchange hack.”
Accessed
Read first via The Block (#24), CoinDesk (#23) and Cointelegraph (#27); a crop of the post is shown in the film (#66).
established
In the film 1:14
Further reading
Everything else we used to research this episode, with the same numbering. These do not appear with a number in the film.
Government
- 19
“North Korea Responsible for $1.5 Billion Bybit Hack”
Accessed
About the Bybit hack of 2025, not about Binance. The top of the page is shown in the film (#87).
- 22
“Binance and CEO Plead Guilty to Federal Charges in $4B Resolution”
Accessed · link not confirmed on : the site blocks automated checks
Background only. The film leaves Binance’s legal history out of this story.
- 55
Letter from Senator Blumenthal to the acting Attorney General on the Binance monitorships
Accessed · link not confirmed on : the site blocks automated checks
Background reading.
Also: fortune.com
Ledger and data
- 4
Ethereum transaction 0xad99…298b: 50 EIP-7702 authorizations for Binance 14, a Binance hot wallet
Accessed
Our own check of the public ledger: one transaction from the attacker’s wallet (0x7C86…5CA0) carrying 50 authorizations, each signed for Binance 14 and all pointing to the same contract. Transaction ID shortened; the link opens the block.
- 6
Transfers from Binance Hot Wallet 34 and Binance 16 into the attacker’s main wallet
Accessed
780,000,000 and 43,000,000 USDC pulled from Hot Wallet 34 (0xEe7a…4055) via Binance 14 at 4:41:23 and 4:59:47 p.m. ET; 28,005.6 ETH and 55,739,800 USDT sent by Binance 16 at 4:24:47 p.m. ET. Transaction IDs shortened; the link opens the block with Binance 16’s transfers.
- 7
- 8
- 9
The attacker’s wallet 0x7C86…5CA0: its funding and the test runs before the attack
Accessed
Funded in part with small withdrawals from a mixing service; test delegations and sweeps on brand-new wallets in the hours before the attack, the last ones with the same contract. The film does not name the mixer.
- 10
Tether’s and Circle’s blacklist events for the attacker’s main wallet 0x5227…2f8c
Accessed
Tether froze the wallet at 5:01:35 p.m. ET, with about 971 million USDT inside, and Circle at 5:04:59 p.m. ET, with 823 million USDC, read from the contracts’ own event logs. The links open the two blocks.
Also: eth.blockscout.com
Used in the film 0:53 2:34 3:34 3:43 3:51 3:58 4:10 7:13 7:24
- 18
CoinGecko API: exchanges ranked by 24-hour trading volume, and prices
Accessed
Basis for “the largest crypto exchange by trading volume” (Binance 173,391 BTC in 24 hours at 11:24 p.m. ET on Oct. 29; the next exchange 64,111 BTC) and for the ether price behind the 96-cent fee (#58).
- 57
[About $144 billion in assets on known Binance addresses before the hack]
We did not read DefiLlama’s page ourselves.
Used in the film 1:27
- 106
Social media
- 2
[Binance’s statements on X and to the press during the night of the hack]
Accessed
Includes the first post, later edited to “User funds are completely safe” (#63), the frozen totals (#84, #85), the suspension of deposits and withdrawals (#88) and a spokesperson’s statement to TechCrunch (#26).
- 12
“we have frozen more than 800M USDC associated with the incident”
Accessed
Excerpt; the post says the freeze was made in coordination with law enforcement. Read first via The Block (#24), CoinDesk (#23) and CryptoTicker (#34); a crop is shown in the film (#67).
- 13
“User funds are safe! It does look like a hack on Binance.”
Accessed
Read first via The Block (#24), CoinDesk (#23), TechCrunch (#26) and CryptoTicker (#34); the post itself is #78.
- 14
“User funds are safe. Binance will cover all hacking losses.”
Accessed
Read first via The Block (#24) and CryptoTicker (#34); the post itself is #89.
Used in the film 6:14
- 17
[Further freezes by World Liberty Financial, Ripple, the Arbitrum Security Council and First Digital]
Accessed
World Liberty Financial: $27 million in USD1 and $2 million in WLFI (6:36 p.m. ET). Ripple: about $200 million in RLUSD, an amount given only by Yi He (#82). Arbitrum Security Council: about $30.5 million, announced by Yi He at 8:24 p.m. ET. First Digital: FDUSD (10:21 p.m. ET).
Used in the film 4:35
- 59
[The attacker’s Aave loan: 60 million USDT supplied and 19,762 wETH borrowed, minutes before the first freeze]
Accessed
Aave’s suppliers were not at risk, they said. The film says only “minutes before the first freeze”: the timings in some reports (“about three minutes”, “about 40 minutes” before it) are not supported by the freeze times on the ledger (#10).
Used in the film 4:10
- 70
Accessed
Excerpt. The film quotes the post in our type; its diagram is not shown.
- 78
“User funds are safe! It does look like a hack on Binance. …”
Accessed
Excerpt (#13). The film shows the post’s text in our type.
Named in the film 3:58
- 82
[Post thanking Ripple for freezing approximately 200 million]
Accessed
The amount comes only from this post (#17).
Named in the film 4:35
- 83
- 84
“verified total frozen is $2.54 billion”
Accessed
Excerpt. Binance’s first frozen total; at 8:52 p.m. ET it said about $3 billion (#85).
Named in the film 4:37
- 89
“Binance will cover all hacking losses.”
Accessed
Excerpt (#14). The film shows the post’s text in our type.
Named in the film 6:14
- 91
[Post estimating the outflows at about $5.3 billion, including 17,985 bitcoin]
Accessed
The film names the estimate; glassnode’s chart is not shown.
- 92
[Post estimating the theft at about $5.912 billion at the time it happened]
Accessed
Named in the film 6:46
- 101
Accessed
Deposits “continue to operate as normal”; withdrawals expected to resume “in the next 48 hours”. Binance’s own update (#1) still said deposits were suspended. Read at our fact refresh before the narration was recorded (Oct. 30, 12:38 to 12:55 a.m. ET).
- 109
Accessed
Its initial investigation suggested a possibly compromised laptop; its “subsequent investigation has uncovered additional points of breach”. Also: “still on track” to resume withdrawals “in 45 hours”, deposits “remain unaffected”, about $3 billion frozen. Read via the public api.fxtwitter.com mirror. After the film’s stand, not in the film.
Press
- 20
“FBI links largest crypto hack ever to North Korean hackers”
Accessed
Reports the FBI’s attribution of the Ronin theft to “Lazarus Group and APT38”.
Used in the film 5:11
- 21
“FBI links North Korean hackers to $308 million crypto heist”
Accessed
Both report the statement of Dec. 23, 2024, by the FBI, the Defense Department’s Cyber Crime Center (DC3) and Japan’s National Police Agency: the DMM Bitcoin theft is attributed to “TraderTraitor” and began with a fake recruiter and a “pre-employment test”. We have not linked the FBI’s own statement.
Also: thehackernews.com
- 23
“Binance loses over $6 billion in 'biggest crypto hack in history'”
Accessed
First published as a story on a “potential multi-billion” hack. Source of “ZachXBT and Blockaid said North Korea was likely behind the hack” (shown as a clipping in the film), Arkham’s count of more than $5.7 billion including about $1.5 billion in bitcoin, DefiLlama’s $144 billion (#57) and the size of Binance’s SAFU fund. A later CoinDesk headline, “North Korea’s Lazarus Group, likely behind Binance hack: blockchain sleuths”, is redrawn in the film; we read only that headline.
Used in the film 0:47 1:17 4:51 5:11 5:29 6:14 6:38 6:46 6:53
- 24
“Binance investigating hack as suspicious outflows reach up to $5.8 billion”
Accessed
Quotes from CZ, Yi He, Tether and Circle; the first public alarm by Spreek; estimates of up to $5.8 billion and, by Blockaid, of about $3.3 billion.
- 25
“Bitcoin slides below $77,000, BNB drops amid Binance hack”
Accessed
Market moves at 10 p.m. ET: bitcoin −4.5%, BNB −7.1%, ether −5.2%; $1.55 billion in liquidations (CoinGlass).
Used in the film 6:26
- 26
“Binance pauses withdrawals as hackers suspected of stealing billions in crypto”
Accessed
Binance’s spokesperson: withdrawals temporarily suspended on multiple networks; “user funds are completely safe”.
Used in the film 6:03
- 27
[Live blog on the Binance hack]
Accessed
Frozen totals, the suspension of deposits, the further freezes (#16, #17), estimates by Chainalysis ($5.912 billion) and Arkham ($5.84 billion), Blockaid’s first estimate (about $3.3 billion) and its “key misuse”, and LlamaRisk’s account of the attacker’s Aave loan (#59).
- 28
“Biggest-ever crypto hack impacts $6.3 billion …”
Accessed
Confirms Binance’s figures and the suspension. The film redraws the headline as we recorded it; on Oct. 30, 2026, the article’s headline read “$6.3 billion Binance hack is largest crypto theft on record”.
Used in the film 0:32
- 29
“Billions in crypto frozen in Binance hack. Here's what happens next”
Accessed
Why issuers can freeze stablecoins but nobody can freeze bitcoin or ether; TRM Labs’ estimate that about $2.4 billion in bitcoin and ether was still with the attacker; recovery “can take months or years”. Headline as we recorded it; on Oct. 30, 2026, it read “Binance's $6.3 billion hack: What we know and what comes next”.
- 30
“Binance mounts an urgent response …”
Accessed
Exchange balances are not insured like bank deposits (quoted in the film). Headline as we recorded it; on Oct. 30, 2026, it read “Binance targeted in $6.3 billion crypto heist, the largest ever”.
Used in the film 6:21
- 31
“Crypto platform Binance confirms major hack, more than $2.5bn frozen”
Accessed
The FBI and the Justice Department “did not immediately respond”. Headline as we recorded it; the story was updated on Oct. 30, 2026, as “Crypto platform Binance confirms 'complex' $6.3 bn hack”.
Used in the film 4:57
- 32
“Binance probes potential $5.8 billion crypto-theft hack”
Accessed
The on-chain analyst StarPlatinum’s “$2.53B across 64 different tokens” for the first drain; Arkham’s count of about $5.78 billion across 55 addresses; Binance’s warning about scam messages.
- 33
“Inside the $5.8B Binance Hack: What’s Confirmed and What Isn’t”
Accessed
Blockaid: the attacker rehearsed on test wallets; unexplained bitcoin and Tron outflows; no report of an insider.
- 34
“Crypto Crash After Binance Hack: The Timeline of the Night”
Accessed
A timeline of the night: Spreek’s alarm at 4:32 p.m. ET, Binance 16’s 28,005.6 ETH, the ether in the sweep. Partly written with AI help, so every number we took from it was checked against the ledger or a second source.
Also: cryptoticker.io
- 35
“ZachXBT: Binance Hacker Suspected to Be North Korean Hacker Group Lazarus Group”
Accessed
ZachXBT’s own post was not read; his view is reported here and by CoinDesk (#23). An attribution by an investigator, not a finding.
- 36
“ZachXBT Comments on Binance Attacker’s Identity”
Accessed
Reports the attribution as tentative (“may be linked”); background for keeping it a theory.
- 37
“Binance hack may involve private key ‘misuse,’ not theft: Blockaid CEO”
Accessed
Ido Ben-Natan, Blockaid’s chief executive: “key misuse”, “We don’t think a key was leaked”, “very, very similar” to Bybit; of 50 authorizations, one matched. We link the copy on cryptonews.net (8:40 p.m. ET).
- 38
“Does the Binance Hot-Wallet Drain Follow the Pattern of North Korea’s Biggest Exchange Thefts?”
Accessed
No firm or government had formally attributed the hack; also reports the Arbitrum freeze.
- 39
“Binance Hack: Statement Edited Twice to Say Funds Are Safe”
Accessed
How Binance’s first statement (about 5:16 p.m. ET) was edited to “User funds are completely safe”.
- 40
“Binance halts withdrawals after over $5 bln hack”
Accessed
Glassnode’s estimate: about $5.3 billion, including about $1.66 billion in USDT, 17,985 bitcoin (about $1.45 billion) and $767 million in USDC. Headline as we recorded it; on Oct. 30, 2026, it read “Binance halts withdrawals after record hack; digital assets, crypto stocks slump”.
- 41
“Suspected Binance Hack Prompts Asset Freeze, Triggers Crypto Selloff”
Link checked
Behind a paywall: we did not read it and did not rely on it. Bloomberg’s news sitemap now lists this address under the headline “Binance Suspends Deposits, Withdrawals After $6.3 Billion Hack Shakes Industry”.
- 42
[Headlines only: “Binance's possible hack triggers $3 billion freeze in crypto assets” (Reuters) and “Cryptocurrencies Slide as News of Major Hack Spooks Markets” (The Wall Street Journal)]
Seen only as headlines in a list of related stories on #40; not verified and not used.
- 43
“UN probing 58 alleged crypto heists by North Korea worth $3 billion”
Accessed
The UN Panel of Experts on 58 suspected North Korean crypto attacks, 2017 to 2023. Background reading.
- 44
- 45
“Trump pardons Binance cryptocurrency founder Changpeng Zhao”
Accessed
Background only. The film leaves Binance’s legal history out of this story.
- 46
“Crypto Exchange Giant Binance Reports a Hack of 7,000 Bitcoin”
Accessed
The 2019 hack: the hot wallet held about 2% of Binance’s bitcoin. Bloomberg now headlines it “Hackers Steal $40 Million Worth of Bitcoin From Binance Exchange”.
- 47
- 48
“Binance reopens deposits and withdrawals a week after $41M hack”
Accessed
Background: how Binance restarted after its 2019 hack.
- 49
- 50
- 51
[Reports on the $387.5 million Bitget hack; its chief executive pointed to North Korea, unconfirmed]
Accessed
Background reading.
Also: decrypt.co
- 52
Accessed
Background reading.
- 53
“Binance Pleads Guilty, Loses CZ, Pays Fines to End Legal Woes”
Accessed
The 2023 plea deal: about $4.3 billion ($1.8 billion fine, $2.5 billion forfeiture) and monitors. Background reading.
- 54
- 56
- 103
“Blockchain analysis firm TRM says North Korea behind Binance crypto theft”
Accessed
Reports TRM Labs’ attribution; no comment from Binance, the FBI or any government, and no government attribution. We read the copy in The Korea Times, not reuters.com. Headline as we recorded it at 12:33 a.m. ET; the updated story was titled “Binance freezes assets after $6.3 bil. heist, crypto industry's biggest”.
- 104
“BTC news: Binance hacker took over 18,270 bitcoin that no one can freeze”
Headline only, seen via Google News; it matches TRM Labs’ 18,270 bitcoin (#102).
Used in the film 6:38
- 105
“Binance Exploiter Swaps $911 Million Into ETH and TRX, Arkham Says”
Link checked
Headlines only; the articles did not load for us. The second link is The Defiant’s “MistTrack Links Binance Theft Route to Phemex-Connected Address”. Not used in the film.
Also: thedefiant.io
Other
- 3
“Predict (PREDICT) Listing Will Be Postponed”
Accessed
Context only: still Binance’s newest announcement at our re-checks on Oct. 30, between 12:40 and 3:23 a.m. ET.
- 15
“customer funds and services are secure and operating normally”
Accessed
Binance.US is a separate platform; it said it was not affected. Context only.
- 16
[Aave’s statement that it froze its DAO-operated V3 and V4 markets and that its contracts were not affected]
Accessed
Aave’s own post on X is #83.
Used in the film 4:35
- 58
[Our calculations: the 96-cent fee (0.000413776 ETH × $2,315), the three and a half minutes between delegation and sweep, about $3.3 billion not frozen ($6.3 billion minus about $3 billion), $6.3 billion as about 4% of $144 billion, and the value of the ether wallet]
Our own estimates. “Roughly half” not frozen is our subtraction, not an official net-loss figure.
- 102
“North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History”
Accessed
Attributes the attack to “TraderTraitor, North Korea’s elite hacking unit” “with high confidence”: a private firm’s judgment, not a government finding. Also its estimate (about $6.36 billion at the time of each transfer, across ten blockchains) and 18,270 bitcoin sent to an attacker address.
- 107
[Checked, nothing new: Binance’s announcements, the FBI’s IC3 notices, ZachXBT’s Telegram channel and the Cointelegraph live blog]
Accessed
No post-mortem, no new proof of reserves and no FBI notice on Binance at that time.
- 108
[Our re-check before the final render: the ether wallet untouched, Binance’s update unchanged, withdrawals still paused, no government statement]
Accessed
The ether wallet still held 197,460 ETH with no outgoing transaction at 3:23 a.m. ET. Binance on X, 12:36 a.m. ET (the link): “Withdrawals remain paused …”, “We expect to resume within 48 hours.” No statement by the FBI, the Justice Department, the Treasury or any other government. The film’s “as of Oct. 30, 2026, 3:25 a.m. ET” rests on this check.
Also: x.com
Used in the film 4:31
- 110
“The $6.4 Billion Binance Exploit: Tracing the North Korea Link”
Accessed
Judges the hack to be the work of North Korea’s TraderTraitor group: a private firm’s judgment, not a government finding. Chainalysis CEO Jonathan Levin first posted the assessment on X at 12:14 a.m. ET, and the company at 12:31 a.m. ET (the links), before the film’s stand; it is not in the film.
Image and footage credits
Unless a license is listed, third-party screenshots appear under fair use (17 U.S.C. § 107) for news reporting and commentary: short excerpts, framed, discussed by our narration, with the site or account named on screen. We do not use news agency photos, and all third-party clips are muted.
Wallet addresses and transaction IDs are shortened on screen and on this page. The glass vault, the permission slips, the control rooms, the ether pile and the theory board are our own illustrations, labeled on screen; the price chart is drawn by us from CoinGecko data.
Block-explorer pages
Public pages of Etherscan and Blockscout, captured by us on the night of Oct. 29, 2026 (Eastern Time). Full addresses and transaction IDs are barred or shortened.
- 60
Blockscout: token transfers of the sweep transaction 0x53bd…e2f3
Accessed
Fair use: a framed excerpt of the public page, captioned; full addresses barred. The link opens the block, not the transaction.
- 68
Etherscan: the address page of Binance 14, a Binance hot wallet (0x28C6…1d60)
Accessed
Fair use: a framed excerpt of the public page, captioned; full addresses barred. We do not link the full address.
In the film 1:43
- 69
Blockscout: the 50 authorizations in the delegation transaction 0xad99…298b
Accessed
Fair use: a framed excerpt of the public page, captioned; full addresses barred. The link opens the block, not the transaction.
In the film 2:08
- 71
Etherscan: the sweep transaction 0x53bd…e2f3
Accessed
Fair use: a framed excerpt of the public page, captioned; full addresses barred. Etherscan’s own commentary box barred. The link opens the block, not the transaction.
In the film 2:23
- 80
Etherscan: the address page of the ether wallet 0x8532…43D4, labeled “Binance Hot Wallet Exploiter 8”
Accessed
Fair use: a framed excerpt of the public page, captioned; full addresses barred. We do not link the full address.
In the film 4:24
- 81
Etherscan: the 195,460 ETH transfer to that wallet, 0x551d…2c76
Accessed
Fair use: a framed excerpt of the public page, captioned; full addresses barred.
In the film 4:24
Posts on X and Binance’s update
Crops of public posts by companies, their executives and a researcher, captioned with the account and the time. Binance’s update is set in our type, word for word.
- 61
Binance, “Security Incident Update”, set in our type word for word (#1)
Accessed
Quoted for news reporting and commentary, captioned with the source and the time.
- 62
Binance on X: the laptop finding and the $6.3 billion estimate (crop of the post)
Accessed
Fair use: a framed crop of the post’s text, captioned with the account and the time.
- 63
Accessed
Fair use: a framed crop of the post’s text, captioned with the account and the time.
In the film 0:43
- 66
Paolo Ardoino on X: Tether froze more than 1.567B USDT (crop of the post, #11)
Accessed
Fair use: a framed crop of the post’s text, captioned with the account and the time.
In the film 1:14
- 67
Jeremy Allaire on X: Circle froze more than 800M USDC (crop of the post, #12)
Accessed
Fair use: a framed crop of the post’s text, captioned with the account and the time.
In the film 1:14
- 73
Spreek (on-chain researcher) on X: the first public alarm (crop of the post)
Accessed
Fair use: a framed crop of the post’s text, captioned with the account and the time. Cut before a sentence we do not use.
In the film 3:08
- 85
Binance on X: “around $3 billion” verified frozen (crop of the post)
Accessed
Fair use: a framed crop of the post’s text, captioned with the account and the time.
In the film 4:37
- 88
Binance on X: “all deposits and withdrawals are temporarily suspended” (crop of the post)
Accessed
Fair use: a framed crop of the post’s text, captioned with the account and the time.
In the film 6:03
Drawn by us from data
Cards, post cards, timelines and the price chart are our own drawings from these data.
- 64
- 65
- 90
CoinGecko five-minute prices for bitcoin, ether and BNB, drawn as our own chart
Accessed
Data: CoinGecko. Chart drawn by researchism; information only, not investment advice.
In the film 6:26
Government material
U.S. government works (public domain).
- 87
FBI IC3 public service announcement I-022625-PSA, top of the page (#19)
Accessed
U.S. government work, public domain.
In the film 5:38
- 93
FBI headquarters in Washington, D.C. (a few seconds of an FBI video)
Accessed
U.S. government work, public domain. Shown as an illustration: the video is about North Korean IT workers, not this hack.
In the film 6:59
Licensed video
Used under its Creative Commons license, muted.
- 76
Changpeng Zhao in an interview on the When Shift Happens podcast
Accessed
CC BY 3.0, the Creative Commons license on the YouTube upload. A short excerpt, muted, from an interview published before this hack.
In the film 3:58
- Map data
- Map data © OpenStreetMap contributors (ODbL). Land and border outlines: Natural Earth (public domain).
- Voice, music, sound
- The narration is an AI voice (ElevenLabs), reading our script. Original music and sound effects were generated with ElevenLabs and edited and mixed by us. There is no third-party sound in the film.
- 3D and graphics
- 3D scenes, reconstructions, maps and graphics: researchism. Reconstructions and illustrations are labeled on screen; the attacker is never shown as a person.
- Type
- Fraunces, Source Serif 4 and Charis SIL (SIL Open Font License).
Checked, not used in the film
_(cropped).jpg){kind=link}
.jpg){kind=link}
Status
the film shows the facts as of Oct. 30, 2026, 3:25 a.m. ET
Status checked , 10:05 a.m. ET: one change since the film, listed below.
Since the film was made:
- Binance says the laptop was not the only point of breach. On Oct. 30, 2026, at 4:47 a.m. ET, it said its later investigation “uncovered additional points of breach”; the film shows only its early finding, a possibly compromised laptop. In the same post, Binance said it was “still on track” to resume withdrawals in 45 hours and that deposits “remain unaffected”. #109
- Binance estimates the total impact at about $6.3 billion and says about $3 billion is frozen on-chain. Binance says it will cover all losses. #1
- Withdrawals were still paused at our last check; Binance said at 4:47 a.m. ET that it was still on track to resume them in 45 hours. #101 #108 #109
- Deposits: Binance says they are unaffected and operate as normal (on X since Oct. 30, 12:36 a.m. ET; added to its announcement as a clarification at 7:36 a.m. ET), although its post of Oct. 29, 8:13 p.m. ET, had said all deposits and withdrawals were suspended. #108 #1 #88
- Binance says it found no evidence that a wallet private key leaked; its early finding is that an engineer’s laptop may have been compromised. We do not name or describe the engineer. #1
- Tether froze the attacker’s main wallet at 5:01:35 p.m. ET on Oct. 29 and Circle at 5:04:59 p.m. ET, before Binance’s first public statement at 5:15:37 p.m. ET. #10 #65
- Analysts’ estimates of the total range from about $3.3 billion (Blockaid, three blockchains only) to about $6.4 billion (TRM Labs). #27 #102
- Who did it is not confirmed. ZachXBT, Blockaid, TRM Labs and Chainalysis point to North Korea; TRM Labs and Chainalysis name North Korea’s TraderTraitor group. No government has confirmed that. It is a suspicion, not a fact. #23 #102 #103 #110
Attributions by researchers and analytics firms are their own assessments, not findings of any government or court; no government has named a culprit. Information only, not financial or investment advice.
No private persons are named. The engineer Binance mentions is never named, described or shown; wallet addresses and transaction IDs are shortened; pseudonymous researchers appear only under their public handles.
What we checked: for the film, Binance’s announcements and posts on X, the FBI’s IC3 notices, headlines from the major outlets and the Ethereum ledger itself, last on Oct. 30, 2026, between 3:00 and 3:25 a.m. ET (#108); for this box, Binance’s deposit and withdrawal status and new attribution claims, at 10:05 a.m. ET. No government had named a culprit at either check. Wallet balances and estimates change by the hour, so every figure here carries its time.
This story is still developing. When the facts change, we update this box, say when we checked, and log the change below; the film itself stays as it is.
Corrections
Spotted an error? contact@researchism.tv
Tell us the source number or the timecode. We fix mistakes on this page and log every change here.
- Page created with the film’s stand: the facts as of Oct. 30, 2026, 3:25 a.m. ET.
- Status checked at 10:05 a.m. ET: Binance says its investigation found additional points of breach and that it is still on track to resume withdrawals in 45 hours; deposits remain unaffected. Still no government attribution. Source links checked.
- Correction, 11:20 a.m. ET: the first version of our 10:05 a.m. status, on this page and in the YouTube description, said Binance had “restored deposits” since the film. Binance says deposits were not affected; it has said so since 12:36 a.m. ET, which the film shows, although its post of Oct. 29, 8:13 p.m. ET, had said all deposits were suspended. We also listed Chainalysis’s attribution as new since the film; Chainalysis made it at 12:14 a.m. ET, before the film’s stand, but it is not in the film. The status box and the description are corrected.