{
 "episode": "003",
 "title": "Binance Hack: Where Did $6 Billion Go?",
 "slug": "binance-hack-where-did-6-billion-go",
 "url": "https://researchism.tv/binance-hack-where-did-6-billion-go/",
 "short_url": "https://researchism.tv/003",
 "runtime": "7:49",
 "published": "2026-10-30T11:03:00-04:00",
 "youtube_id": "jbPBOj16bBM",
 "page_created": "2026-10-30",
 "information_as_of": "2026-10-30",
 "numbering": "Source numbers match the numbered notes in the film's right margin; https://researchism.tv/binance-hack-where-did-6-billion-go/#<n> jumps to source <n>.",
 "dating": "date = publication date as published; accessed = the date we retrieved and read the source; link_checked = the date of the last link check (link_status ok: the link opened that day; blocked: the site blocks automated checks, so the link was not confirmed).",
 "legend": {
  "lit": "established: court finding, admission, official record",
  "half": "reported or alleged: indictments, prosecutors' claims, press reports",
  "dark": "unknown or unverified"
 },
 "legal_status": {
  "as_of": "Oct. 30, 2026, 3:25 a.m. ET",
  "film_as_of": "Oct. 30, 2026, 3:25 a.m. ET",
  "status_checked": "2026-10-30",
  "status_summary": "one change since the film, listed below.",
  "checked": "What we checked: for the film, Binance’s announcements and posts on X, the FBI’s IC3 notices, headlines from the major outlets and the Ethereum ledger itself, last on Oct. 30, 2026, between 3:00 and 3:25 a.m. ET (#108); for this box, Binance’s deposit and withdrawal status and new attribution claims, at 10:05 a.m. ET. No government had named a culprit at either check. Wallet balances and estimates change by the hour, so every figure here carries its time.",
  "since_film": [
   "Binance says the laptop was not the only point of breach. On Oct. 30, 2026, at 4:47 a.m. ET, it said its later investigation “uncovered additional points of breach”; the film shows only its early finding, a possibly compromised laptop. In the same post, Binance said it was “still on track” to resume withdrawals in 45 hours and that deposits “remain unaffected”. #109"
  ],
  "points": [
   "Binance estimates the total impact at about $6.3 billion and says about $3 billion is frozen on-chain. Binance says it will cover all losses. #1",
   "Withdrawals were still paused at our last check; Binance said at 4:47 a.m. ET that it was still on track to resume them in 45 hours. #101 #108 #109",
   "Deposits: Binance says they are unaffected and operate as normal (on X since Oct. 30, 12:36 a.m. ET; added to its announcement as a clarification at 7:36 a.m. ET), although its post of Oct. 29, 8:13 p.m. ET, had said all deposits and withdrawals were suspended. #108 #1 #88",
   "Binance says it found no evidence that a wallet private key leaked; its early finding is that an engineer’s laptop may have been compromised. We do not name or describe the engineer. #1",
   "Tether froze the attacker’s main wallet at 5:01:35 p.m. ET on Oct. 29 and Circle at 5:04:59 p.m. ET, before Binance’s first public statement at 5:15:37 p.m. ET. #10 #65",
   "Analysts’ estimates of the total range from about $3.3 billion (Blockaid, three blockchains only) to about $6.4 billion (TRM Labs). #27 #102",
   "Who did it is not confirmed. ZachXBT, Blockaid, TRM Labs and Chainalysis point to North Korea; TRM Labs and Chainalysis name North Korea’s TraderTraitor group. No government has confirmed that. It is a suspicion, not a fact. #23 #102 #103 #110"
  ],
  "presumption": "Attributions by researchers and analytics firms are their own assessments, not findings of any government or court; no government has named a culprit. Information only, not financial or investment advice.",
  "victim": "No private persons are named. The engineer Binance mentions is never named, described or shown; wallet addresses and transaction IDs are shortened; pseudonymous researchers appear only under their public handles.",
  "records": "This story is still developing. When the facts change, we update this box, say when we checked, and log the change below; the film itself stays as it is.",
  "kind": "developing",
  "status_time": "10:05 a.m. ET"
 },
 "credits": [
  "Map data: Map data © OpenStreetMap contributors (ODbL). Land and border outlines: Natural Earth (public domain).",
  "Voice, music, sound: The narration is an AI voice (ElevenLabs), reading our script. Original music and sound effects were generated with ElevenLabs and edited and mixed by us. There is no third-party sound in the film.",
  "3D and graphics: 3D scenes, reconstructions, maps and graphics: researchism. Reconstructions and illustrations are labeled on screen; the attacker is never shown as a person.",
  "Type: Fraunces, Source Serif 4 and Charis SIL (SIL Open Font License)."
 ],
 "sources": [
  {
   "n": 1,
   "section": "on_screen",
   "kind": "other",
   "title": "Security Incident Update (2026-10-30)",
   "title_type": "quoted",
   "publisher": "Binance (announcement on binance.com)",
   "date": "Oct. 29, 2026, 10:23 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7",
   "also": [],
   "note": "Binance’s own account: an estimated total impact of about $6.3 billion, about $3 billion frozen on-chain, no evidence of a wallet private key leak, an early finding that an engineer’s laptop may have been compromised, and a promise to cover all losses. Updated on Oct. 30, 2026 (7:36 a.m. ET, per the page’s data) with a note that deposits “remain unaffected and continue to operate as normal”; withdrawals stay suspended.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#1",
   "certainty": "lit",
   "appearances": [
    {
     "t": "1:14",
     "seconds": 74.71,
     "frame": 1793,
     "state": "lit",
     "glyph": "primary"
    }
   ],
   "used_at": [
    "0:00",
    "0:32",
    "0:43",
    "1:14",
    "2:46",
    "2:53",
    "3:00",
    "4:37",
    "4:43",
    "4:57",
    "5:51",
    "5:59",
    "6:03",
    "6:14",
    "6:30",
    "6:46",
    "6:59",
    "7:13"
   ]
  },
  {
   "n": 2,
   "section": "further_reading",
   "kind": "social media",
   "title": "Binance’s statements on X and to the press during the night of the hack",
   "title_type": "descriptive",
   "publisher": "Binance, as quoted by Cointelegraph (#27), The Block (#24), TechCrunch (#26) and FinanceFeeds (#39)",
   "date": "Oct. 29–30, 2026",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": "Includes the first post, later edited to “User funds are completely safe” (#63), the frozen totals (#84, #85), the suspension of deposits and withdrawals (#88) and a spokesperson’s statement to TechCrunch (#26).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#2",
   "used_at": [
    "0:43",
    "3:58",
    "4:37",
    "6:03",
    "6:14"
   ]
  },
  {
   "n": 3,
   "section": "further_reading",
   "kind": "other",
   "title": "Predict (PREDICT) Listing Will Be Postponed",
   "title_type": "quoted",
   "publisher": "Binance (announcement on binance.com)",
   "date": "Oct. 29, 2026, 10:32 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.binance.com/en/support/announcement/detail/eb1fb9e5f41f43b682332aff0b7b89ce",
   "also": [],
   "note": "Context only: still Binance’s newest announcement at our re-checks on Oct. 30, between 12:40 and 3:23 a.m. ET.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#3"
  },
  {
   "n": 4,
   "section": "further_reading",
   "kind": "dataset",
   "title": "Ethereum transaction 0xad99…298b: 50 EIP-7702 authorizations for Binance 14, a Binance hot wallet",
   "title_type": "plain",
   "publisher": "Ethereum blockchain, checked by researchism via Blockscout · block 26,300,753",
   "date": "Oct. 29, 2026, 4:20:59 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://eth.blockscout.com/block/26300753",
   "also": [],
   "note": "Our own check of the public ledger: one transaction from the attacker’s wallet (0x7C86…5CA0) carrying 50 authorizations, each signed for Binance 14 and all pointing to the same contract. Transaction ID shortened; the link opens the block.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#4",
   "used_at": [
    "0:10",
    "0:53",
    "1:43",
    "2:01",
    "2:08",
    "2:15",
    "2:18",
    "7:24"
   ]
  },
  {
   "n": 5,
   "section": "on_screen",
   "kind": "dataset",
   "title": "Ethereum transaction 0x53bd…e2f3: the sweep out of Binance 14, network fee 0.000414 ETH",
   "title_type": "plain",
   "publisher": "Ethereum blockchain, checked by researchism via Blockscout · block 26,300,770",
   "date": "Oct. 29, 2026, 4:24:23 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://eth.blockscout.com/block/26300770",
   "also": [],
   "note": "Our own check: one call moved more than 60 tokens and ether from Binance 14 to the attacker’s main wallet (0x5227…2f8c), among them 1,615,409,499 USDT. Transaction ID shortened; the link opens the block.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#5",
   "certainty": "lit",
   "appearances": [
    {
     "t": "1:15",
     "seconds": 75.04,
     "frame": 1801,
     "state": "lit",
     "glyph": "primary"
    }
   ],
   "used_at": [
    "0:00",
    "0:16",
    "0:24",
    "0:27",
    "0:53",
    "1:14",
    "2:18",
    "2:23",
    "2:34",
    "7:24"
   ]
  },
  {
   "n": 6,
   "section": "further_reading",
   "kind": "dataset",
   "title": "Transfers from Binance Hot Wallet 34 and Binance 16 into the attacker’s main wallet",
   "title_type": "plain",
   "publisher": "Ethereum blockchain, checked by researchism via Blockscout",
   "date": "Oct. 29, 2026, 4:24:47 to 4:59:47 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://eth.blockscout.com/block/26300772",
   "also": [],
   "note": "780,000,000 and 43,000,000 USDC pulled from Hot Wallet 34 (0xEe7a…4055) via Binance 14 at 4:41:23 and 4:59:47 p.m. ET; 28,005.6 ETH and 55,739,800 USDT sent by Binance 16 at 4:24:47 p.m. ET. Transaction IDs shortened; the link opens the block with Binance 16’s transfers.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#6",
   "used_at": [
    "0:53",
    "2:34",
    "2:42",
    "7:24"
   ]
  },
  {
   "n": 7,
   "section": "further_reading",
   "kind": "dataset",
   "title": "USDT sent out of the attacker’s main wallet before the freeze",
   "title_type": "plain",
   "publisher": "Ethereum blockchain, checked by researchism via Blockscout",
   "date": "Oct. 29, 2026, 4:30 to 4:59 p.m. ET",
   "date_iso": "2026-10-29",
   "url": null,
   "also": [],
   "note": "500 million USDT at 4:30:11 p.m. ET and 200 million at 4:33:23 p.m. ET to two new wallets, then split further and swapped; Tether later blacklisted both first hops. Addresses shortened.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#7",
   "used_at": [
    "0:53",
    "3:16",
    "3:34",
    "7:24"
   ]
  },
  {
   "n": 8,
   "section": "further_reading",
   "kind": "dataset",
   "title": "195,460 ETH moved to the wallet 0x8532…43D4, untouched since",
   "title_type": "plain",
   "publisher": "Ethereum blockchain, checked by researchism via Blockscout and Etherscan",
   "date": "Oct. 29, 2026, 4:38:47 p.m. ET",
   "date_iso": "2026-10-29",
   "url": null,
   "also": [],
   "note": "The wallet held 197,460 ETH with no outgoing transaction at each of our checks, from 11:13 p.m. ET on Oct. 29 to 3:23 a.m. ET on Oct. 30 (#106, #108).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#8",
   "used_at": [
    "0:53",
    "4:24",
    "4:31",
    "6:59",
    "7:13",
    "7:24"
   ]
  },
  {
   "n": 9,
   "section": "further_reading",
   "kind": "dataset",
   "title": "The attacker’s wallet 0x7C86…5CA0: its funding and the test runs before the attack",
   "title_type": "plain",
   "publisher": "Ethereum blockchain, checked by researchism via Blockscout",
   "date": "Oct. 28–29, 2026",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": "Funded in part with small withdrawals from a mixing service; test delegations and sweeps on brand-new wallets in the hours before the attack, the last ones with the same contract. The film does not name the mixer.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#9",
   "used_at": [
    "0:53",
    "1:51",
    "7:24"
   ]
  },
  {
   "n": 10,
   "section": "further_reading",
   "kind": "dataset",
   "title": "Tether’s and Circle’s blacklist events for the attacker’s main wallet 0x5227…2f8c",
   "title_type": "plain",
   "publisher": "Ethereum blockchain (the Tether and Circle contracts), checked by researchism · blocks 26,300,954 and 26,300,971",
   "date": "Oct. 29, 2026, 5:01:35 and 5:04:59 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://eth.blockscout.com/block/26300954",
   "also": [
    "https://eth.blockscout.com/block/26300971"
   ],
   "note": "Tether froze the wallet at 5:01:35 p.m. ET, with about 971 million USDT inside, and Circle at 5:04:59 p.m. ET, with 823 million USDC, read from the contracts’ own event logs. The links open the two blocks.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#10",
   "used_at": [
    "0:53",
    "2:34",
    "3:34",
    "3:43",
    "3:51",
    "3:58",
    "4:10",
    "7:13",
    "7:24"
   ]
  },
  {
   "n": 11,
   "section": "on_screen",
   "kind": "social media",
   "title": "Tether froze more than 1.567B USDT related to a potential Binance exchange hack.",
   "title_type": "quoted",
   "publisher": "Paolo Ardoino, chief executive of Tether, on X",
   "date": "Oct. 29, 2026, 5:25 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/paoloardoino/status/2115918000373346709",
   "also": [],
   "note": "Read first via The Block (#24), CoinDesk (#23) and Cointelegraph (#27); a crop of the post is shown in the film (#66).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#11",
   "certainty": "lit",
   "appearances": [
    {
     "t": "1:14",
     "seconds": 74.88,
     "frame": 1797,
     "state": "lit",
     "glyph": "primary"
    }
   ],
   "used_at": [
    "1:14",
    "3:16",
    "3:23",
    "3:43"
   ]
  },
  {
   "n": 12,
   "section": "further_reading",
   "kind": "social media",
   "title": "we have frozen more than 800M USDC associated with the incident",
   "title_type": "quoted",
   "publisher": "Jeremy Allaire, chief executive of Circle, on X",
   "date": "Oct. 29, 2026, 5:18 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/jerallaire/status/2115916207463481846",
   "also": [],
   "note": "Excerpt; the post says the freeze was made in coordination with law enforcement. Read first via The Block (#24), CoinDesk (#23) and CryptoTicker (#34); a crop is shown in the film (#67).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#12",
   "used_at": [
    "1:14",
    "3:16",
    "3:23",
    "3:51"
   ]
  },
  {
   "n": 13,
   "section": "further_reading",
   "kind": "social media",
   "title": "User funds are safe! It does look like a hack on Binance.",
   "title_type": "quoted",
   "publisher": "Changpeng Zhao (CZ), Binance founder and shareholder, on X",
   "date": "Oct. 29, 2026, 5:15 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/cz_binance/status/2115915423174853077",
   "also": [],
   "note": "Read first via The Block (#24), CoinDesk (#23), TechCrunch (#26) and CryptoTicker (#34); the post itself is #78.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#13",
   "used_at": [
    "3:43",
    "3:58"
   ]
  },
  {
   "n": 14,
   "section": "further_reading",
   "kind": "social media",
   "title": "User funds are safe. Binance will cover all hacking losses.",
   "title_type": "quoted",
   "publisher": "Yi He, Binance co-founder, on X",
   "date": "Oct. 29, 2026, 8:04 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/heyibinance/status/2115958049244631357",
   "also": [],
   "note": "Read first via The Block (#24) and CryptoTicker (#34); the post itself is #89.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#14",
   "used_at": [
    "6:14"
   ]
  },
  {
   "n": 15,
   "section": "further_reading",
   "kind": "other",
   "title": "customer funds and services are secure and operating normally",
   "title_type": "quoted",
   "publisher": "Binance.US, as quoted by The Block (#24)",
   "date": "as quoted on Oct. 29, 2026",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": "Binance.US is a separate platform; it said it was not affected. Context only.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#15"
  },
  {
   "n": 16,
   "section": "further_reading",
   "kind": "other",
   "title": "Aave’s statement that it froze its DAO-operated V3 and V4 markets and that its contracts were not affected",
   "title_type": "descriptive",
   "publisher": "Aave, as reported by The Block (#24) and Cointelegraph (#27)",
   "date": "Oct. 29, 2026, 6:32 p.m. ET",
   "date_iso": "2026-10-29",
   "url": null,
   "also": [],
   "note": "Aave’s own post on X is #83.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#16",
   "used_at": [
    "4:35"
   ]
  },
  {
   "n": 17,
   "section": "further_reading",
   "kind": "social media",
   "title": "Further freezes by World Liberty Financial, Ripple, the Arbitrum Security Council and First Digital",
   "title_type": "descriptive",
   "publisher": "Statements and posts on X, as reported by Cointelegraph (#27) and Disruption Banking (#38)",
   "date": "Oct. 29, 2026, 6:08 to 10:21 p.m. ET",
   "date_iso": "2026-10-29",
   "url": null,
   "also": [],
   "note": "World Liberty Financial: $27 million in USD1 and $2 million in WLFI (6:36 p.m. ET). Ripple: about $200 million in RLUSD, an amount given only by Yi He (#82). Arbitrum Security Council: about $30.5 million, announced by Yi He at 8:24 p.m. ET. First Digital: FDUSD (10:21 p.m. ET).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#17",
   "used_at": [
    "4:35"
   ]
  },
  {
   "n": 18,
   "section": "further_reading",
   "kind": "dataset",
   "title": "CoinGecko API: exchanges ranked by 24-hour trading volume, and prices",
   "title_type": "plain",
   "publisher": "CoinGecko",
   "date": "live data",
   "date_iso": null,
   "url": "https://api.coingecko.com/api/v3/exchanges",
   "also": [],
   "note": "Basis for “the largest crypto exchange by trading volume” (Binance 173,391 BTC in 24 hours at 11:24 p.m. ET on Oct. 29; the next exchange 64,111 BTC) and for the ether price behind the 96-cent fee (#58).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#18",
   "used_at": [
    "0:00",
    "0:24",
    "4:31",
    "6:26"
   ]
  },
  {
   "n": 19,
   "section": "further_reading",
   "kind": "government",
   "title": "North Korea Responsible for $1.5 Billion Bybit Hack",
   "title_type": "quoted",
   "publisher": "FBI, Internet Crime Complaint Center (IC3), public service announcement I-022625-PSA",
   "date": "Feb. 26, 2025",
   "date_iso": "2025-02-26",
   "url": "https://www.ic3.gov/PSA/2025/PSA250226",
   "also": [],
   "note": "About the Bybit hack of 2025, not about Binance. The top of the page is shown in the film (#87).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#19",
   "used_at": [
    "5:11",
    "5:29",
    "5:38",
    "6:59"
   ]
  },
  {
   "n": 20,
   "section": "further_reading",
   "kind": "news",
   "title": "FBI links largest crypto hack ever to North Korean hackers",
   "title_type": "quoted",
   "publisher": "BleepingComputer",
   "date": "Apr. 14, 2022",
   "date_iso": "2022-04-14",
   "url": "https://www.bleepingcomputer.com/news/security/fbi-links-largest-crypto-hack-ever-to-north-korean-hackers",
   "also": [],
   "note": "Reports the FBI’s attribution of the Ronin theft to “Lazarus Group and APT38”.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#20",
   "used_at": [
    "5:11"
   ]
  },
  {
   "n": 21,
   "section": "further_reading",
   "kind": "news",
   "title": "FBI links North Korean hackers to $308 million crypto heist",
   "title_type": "quoted",
   "publisher": "BleepingComputer; The Hacker News",
   "date": "Dec. 23–24, 2024",
   "date_iso": "2024-12-23",
   "url": "https://www.bleepingcomputer.com/news/security/fbi-links-north-korean-hackers-to-308-million-crypto-heist",
   "also": [
    "https://thehackernews.com/2024/12/north-korean-hackers-pull-off-308m.html"
   ],
   "note": "Both report the statement of Dec. 23, 2024, by the FBI, the Defense Department’s Cyber Crime Center (DC3) and Japan’s National Police Agency: the DMM Bitcoin theft is attributed to “TraderTraitor” and began with a fake recruiter and a “pre-employment test”. We have not linked the FBI’s own statement.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#21",
   "used_at": [
    "5:43",
    "5:51"
   ]
  },
  {
   "n": 22,
   "section": "further_reading",
   "kind": "government",
   "title": "Binance and CEO Plead Guilty to Federal Charges in $4B Resolution",
   "title_type": "quoted",
   "publisher": "U.S. Department of Justice",
   "date": "Nov. 21, 2023",
   "date_iso": "2023-11-21",
   "url": "https://www.justice.gov/archives/opa/gallery/binance-and-ceo-plead-guilty-federal-charges-4b-resolution",
   "also": [],
   "note": "Background only. The film leaves Binance’s legal history out of this story.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "blocked",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#22"
  },
  {
   "n": 23,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance loses over $6 billion in 'biggest crypto hack in history'",
   "title_type": "quoted",
   "publisher": "CoinDesk",
   "date": "Oct. 29, 2026, 5:12 p.m. ET; updated 10:55 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets",
   "also": [],
   "note": "First published as a story on a “potential multi-billion” hack. Source of “ZachXBT and Blockaid said North Korea was likely behind the hack” (shown as a clipping in the film), Arkham’s count of more than $5.7 billion including about $1.5 billion in bitcoin, DefiLlama’s $144 billion (#57) and the size of Binance’s SAFU fund. A later CoinDesk headline, “North Korea’s Lazarus Group, likely behind Binance hack: blockchain sleuths”, is redrawn in the film; we read only that headline.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#23",
   "used_at": [
    "0:47",
    "1:17",
    "4:51",
    "5:11",
    "5:29",
    "6:14",
    "6:38",
    "6:46",
    "6:53"
   ]
  },
  {
   "n": 24,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance investigating hack as suspicious outflows reach up to $5.8 billion",
   "title_type": "quoted",
   "publisher": "The Block",
   "date": "Oct. 29, 2026, 5:49 p.m. ET; updated 8:34 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171",
   "also": [],
   "note": "Quotes from CZ, Yi He, Tether and Circle; the first public alarm by Spreek; estimates of up to $5.8 billion and, by Blockaid, of about $3.3 billion.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#24",
   "used_at": [
    "2:23",
    "3:08",
    "5:29",
    "6:46"
   ]
  },
  {
   "n": 25,
   "section": "further_reading",
   "kind": "news",
   "title": "Bitcoin slides below $77,000, BNB drops amid Binance hack",
   "title_type": "quoted",
   "publisher": "The Block",
   "date": "Oct. 29, 2026, 10:22 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.theblock.co/news/markets/2026-10-29-bitcoin-slides-below-77000-binance-hack-432183",
   "also": [],
   "note": "Market moves at 10 p.m. ET: bitcoin −4.5%, BNB −7.1%, ether −5.2%; $1.55 billion in liquidations (CoinGlass).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#25",
   "used_at": [
    "6:26"
   ]
  },
  {
   "n": 26,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance pauses withdrawals as hackers suspected of stealing billions in crypto",
   "title_type": "quoted",
   "publisher": "TechCrunch",
   "date": "Oct. 29, 2026, 6:27 p.m. ET (3:27 p.m. PT)",
   "date_iso": "2026-10-29",
   "url": "https://techcrunch.com/2026/10/29/binance-pauses-withdrawals-as-hackers-suspected-of-stealing-billions-in-crypto/",
   "also": [],
   "note": "Binance’s spokesperson: withdrawals temporarily suspended on multiple networks; “user funds are completely safe”.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#26",
   "used_at": [
    "6:03"
   ]
  },
  {
   "n": 27,
   "section": "further_reading",
   "kind": "news",
   "title": "Live blog on the Binance hack",
   "title_type": "descriptive",
   "publisher": "Cointelegraph",
   "date": "Oct. 29, 2026, 5:19 to 10:25 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://cointelegraph.com/news/binance-linked-wallet-faces-possible-exploit-blockchain-researcher-warns",
   "also": [],
   "note": "Frozen totals, the suspension of deposits, the further freezes (#16, #17), estimates by Chainalysis ($5.912 billion) and Arkham ($5.84 billion), Blockaid’s first estimate (about $3.3 billion) and its “key misuse”, and LlamaRisk’s account of the attacker’s Aave loan (#59).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#27",
   "used_at": [
    "4:35",
    "6:46"
   ]
  },
  {
   "n": 28,
   "section": "further_reading",
   "kind": "news",
   "title": "Biggest-ever crypto hack impacts $6.3 billion …",
   "title_type": "quoted",
   "publisher": "CNBC",
   "date": "Oct. 29, 2026, 6:01 p.m. ET; updated 11:01 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.cnbc.com/2026/10/29/circle-tether-freeze-funds-impacted-by-potential-binance-security-issue.html",
   "also": [],
   "note": "Confirms Binance’s figures and the suspension. The film redraws the headline as we recorded it; on Oct. 30, 2026, the article’s headline read “$6.3 billion Binance hack is largest crypto theft on record”.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#28",
   "used_at": [
    "0:32"
   ]
  },
  {
   "n": 29,
   "section": "further_reading",
   "kind": "news",
   "title": "Billions in crypto frozen in Binance hack. Here's what happens next",
   "title_type": "quoted",
   "publisher": "CNBC",
   "date": "Oct. 29, 2026, 9:54 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.cnbc.com/2026/10/30/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next-.html",
   "also": [],
   "note": "Why issuers can freeze stablecoins but nobody can freeze bitcoin or ether; TRM Labs’ estimate that about $2.4 billion in bitcoin and ether was still with the attacker; recovery “can take months or years”. Headline as we recorded it; on Oct. 30, 2026, it read “Binance's $6.3 billion hack: What we know and what comes next”.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#29",
   "used_at": [
    "3:23",
    "4:17",
    "7:13"
   ]
  },
  {
   "n": 30,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance mounts an urgent response …",
   "title_type": "quoted",
   "publisher": "NBC News",
   "date": "Oct. 29, 2026, 6:46 p.m. ET; updated 11:31 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.nbcnews.com/business/markets/binance-hack-tether-circle-stablecoins-rcna606445",
   "also": [],
   "note": "Exchange balances are not insured like bank deposits (quoted in the film). Headline as we recorded it; on Oct. 30, 2026, it read “Binance targeted in $6.3 billion crypto heist, the largest ever”.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#30",
   "used_at": [
    "6:21"
   ]
  },
  {
   "n": 31,
   "section": "further_reading",
   "kind": "news",
   "title": "Crypto platform Binance confirms major hack, more than $2.5bn frozen",
   "title_type": "quoted",
   "publisher": "AFP, via Yahoo Finance",
   "date": "Oct. 29, 2026, 9:30 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://finance.yahoo.com/markets/crypto/articles/crypto-platform-binance-confirms-major-013059975.html",
   "also": [],
   "note": "The FBI and the Justice Department “did not immediately respond”. Headline as we recorded it; the story was updated on Oct. 30, 2026, as “Crypto platform Binance confirms 'complex' $6.3 bn hack”.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#31",
   "used_at": [
    "4:57"
   ]
  },
  {
   "n": 32,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance probes potential $5.8 billion crypto-theft hack",
   "title_type": "quoted",
   "publisher": "BleepingComputer",
   "date": "Oct. 29, 2026, 6:45 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/",
   "also": [],
   "note": "The on-chain analyst StarPlatinum’s “$2.53B across 64 different tokens” for the first drain; Arkham’s count of about $5.78 billion across 55 addresses; Binance’s warning about scam messages.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#32",
   "used_at": [
    "0:27",
    "6:46"
   ]
  },
  {
   "n": 33,
   "section": "further_reading",
   "kind": "news",
   "title": "Inside the $5.8B Binance Hack: What’s Confirmed and What Isn’t",
   "title_type": "quoted",
   "publisher": "Bitcoin.com News",
   "date": "Oct. 29, 2026, 8:41 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://news.bitcoin.com/security/inside-the-5-8b-binance-hack-whats-confirmed-and-what-isnt/",
   "also": [],
   "note": "Blockaid: the attacker rehearsed on test wallets; unexplained bitcoin and Tron outflows; no report of an insider.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#33",
   "used_at": [
    "1:51",
    "5:59",
    "6:38"
   ]
  },
  {
   "n": 34,
   "section": "further_reading",
   "kind": "news",
   "title": "Crypto Crash After Binance Hack: The Timeline of the Night",
   "title_type": "quoted",
   "publisher": "CryptoTicker",
   "date": "updated Oct. 29, 2026, 10:39 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://cryptoticker.io/en/crypto-crash-binance-hack-timeline-liquidations/",
   "also": [
    "https://cryptoticker.io/en/binance-hack-hot-wallet-drained/"
   ],
   "note": "A timeline of the night: Spreek’s alarm at 4:32 p.m. ET, Binance 16’s 28,005.6 ETH, the ether in the sweep. Partly written with AI help, so every number we took from it was checked against the ledger or a second source.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#34",
   "used_at": [
    "0:16",
    "2:23",
    "3:08"
   ]
  },
  {
   "n": 35,
   "section": "further_reading",
   "kind": "news",
   "title": "ZachXBT: Binance Hacker Suspected to Be North Korean Hacker Group Lazarus Group",
   "title_type": "quoted",
   "publisher": "PANews",
   "date": "Oct. 29, 2026, 10:46 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://panews.io/articles/01a18ab3-bf77-738e-ae28-83dee015e239",
   "also": [],
   "note": "ZachXBT’s own post was not read; his view is reported here and by CoinDesk (#23). An attribution by an investigator, not a finding.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#35",
   "used_at": [
    "0:47",
    "4:51",
    "5:11",
    "6:53"
   ]
  },
  {
   "n": 36,
   "section": "further_reading",
   "kind": "news",
   "title": "ZachXBT Comments on Binance Attacker’s Identity",
   "title_type": "quoted",
   "publisher": "TokenPost",
   "date": "Oct. 29, 2026, 10:47 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.tokenpost.com/news/technology/44161",
   "also": [],
   "note": "Reports the attribution as tentative (“may be linked”); background for keeping it a theory.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#36"
  },
  {
   "n": 37,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance hack may involve private key ‘misuse,’ not theft: Blockaid CEO",
   "title_type": "quoted",
   "publisher": "Cointelegraph, via cryptonews.net",
   "date": "Oct. 29, 2026, 8:26 p.m. ET (Cointelegraph)",
   "date_iso": "2026-10-29",
   "url": "https://cryptonews.net/news/security/33674251/",
   "also": [],
   "note": "Ido Ben-Natan, Blockaid’s chief executive: “key misuse”, “We don’t think a key was leaked”, “very, very similar” to Bybit; of 50 authorizations, one matched. We link the copy on cryptonews.net (8:40 p.m. ET).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#37",
   "used_at": [
    "0:47",
    "2:08",
    "2:15",
    "3:00",
    "4:51",
    "5:11",
    "5:22"
   ]
  },
  {
   "n": 38,
   "section": "further_reading",
   "kind": "news",
   "title": "Does the Binance Hot-Wallet Drain Follow the Pattern of North Korea’s Biggest Exchange Thefts?",
   "title_type": "quoted",
   "publisher": "Disruption Banking",
   "date": "Oct. 29, 2026, 9:36 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.disruptionbanking.com/2026/10/30/does-the-binance-hot-wallet-drain-follow-the-pattern-of-north-koreas-biggest-exchange-thefts/",
   "also": [],
   "note": "No firm or government had formally attributed the hack; also reports the Arbitrum freeze.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#38",
   "used_at": [
    "0:47",
    "4:57",
    "5:51",
    "6:53"
   ]
  },
  {
   "n": 39,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance Hack: Statement Edited Twice to Say Funds Are Safe",
   "title_type": "quoted",
   "publisher": "FinanceFeeds",
   "date": "Oct. 29, 2026, 6:14 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://financefeeds.com/binance-hack-statement-edited-user-funds-safe/",
   "also": [],
   "note": "How Binance’s first statement (about 5:16 p.m. ET) was edited to “User funds are completely safe”.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#39"
  },
  {
   "n": 40,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance halts withdrawals after over $5 bln hack",
   "title_type": "quoted",
   "publisher": "Investing.com, via Yahoo Finance",
   "date": "Oct. 29, 2026, 8:05 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://finance.yahoo.com/markets/crypto/articles/binance-halts-withdrawals-amid-5-000533365.html",
   "also": [],
   "note": "Glassnode’s estimate: about $5.3 billion, including about $1.66 billion in USDT, 17,985 bitcoin (about $1.45 billion) and $767 million in USDC. Headline as we recorded it; on Oct. 30, 2026, it read “Binance halts withdrawals after record hack; digital assets, crypto stocks slump”.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#40",
   "used_at": [
    "6:38",
    "6:46"
   ]
  },
  {
   "n": 41,
   "section": "further_reading",
   "kind": "news",
   "title": "Suspected Binance Hack Prompts Asset Freeze, Triggers Crypto Selloff",
   "title_type": "quoted",
   "publisher": "Bloomberg",
   "date": "Oct. 29, 2026",
   "date_iso": "2026-10-29",
   "url": "https://www.bloomberg.com/news/articles/2026-10-29/binance-founder-says-possible-hack-of-exchange-bitcoin-falls",
   "also": [],
   "note": "Behind a paywall: we did not read it and did not rely on it. Bloomberg’s news sitemap now lists this address under the headline “Binance Suspends Deposits, Withdrawals After $6.3 Billion Hack Shakes Industry”.",
   "license": null,
   "accessed": null,
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#41"
  },
  {
   "n": 42,
   "section": "further_reading",
   "kind": "news",
   "title": "Headlines only: “Binance's possible hack triggers $3 billion freeze in crypto assets” (Reuters) and “Cryptocurrencies Slide as News of Major Hack Spooks Markets” (The Wall Street Journal)",
   "title_type": "descriptive",
   "publisher": "Reuters; The Wall Street Journal",
   "date": "Oct. 29, 2026",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": "Seen only as headlines in a list of related stories on #40; not verified and not used.",
   "license": null,
   "accessed": null,
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#42"
  },
  {
   "n": 43,
   "section": "further_reading",
   "kind": "news",
   "title": "UN probing 58 alleged crypto heists by North Korea worth $3 billion",
   "title_type": "quoted",
   "publisher": "The Record",
   "date": "Mar. 22, 2024",
   "date_iso": "2024-03-22",
   "url": "https://therecord.media/north-korea-cryptocurrency-hacks-un-experts",
   "also": [],
   "note": "The UN Panel of Experts on 58 suspected North Korean crypto attacks, 2017 to 2023. Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#43"
  },
  {
   "n": 44,
   "section": "further_reading",
   "kind": "news",
   "title": "Report on Chainalysis’ count: North Korea stole a record $2.02 billion in crypto in 2025, about $6.75 billion in total",
   "title_type": "descriptive",
   "publisher": "The Register",
   "date": "Dec. 18, 2025",
   "date_iso": "2025-12-18",
   "url": "https://www.theregister.com/2025/12/18/north_korea_stole_2b_crypto_2025/",
   "also": [],
   "note": "Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#44"
  },
  {
   "n": 45,
   "section": "further_reading",
   "kind": "news",
   "title": "Trump pardons Binance cryptocurrency founder Changpeng Zhao",
   "title_type": "quoted",
   "publisher": "Al Jazeera",
   "date": "Oct. 23, 2025",
   "date_iso": "2025-10-23",
   "url": "https://www.aljazeera.com/news/2025/10/23/trump-pardons-binance-cryptocurrency-founder-changpeng-zhao",
   "also": [],
   "note": "Background only. The film leaves Binance’s legal history out of this story.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#45"
  },
  {
   "n": 46,
   "section": "further_reading",
   "kind": "news",
   "title": "Crypto Exchange Giant Binance Reports a Hack of 7,000 Bitcoin",
   "title_type": "quoted",
   "publisher": "Bloomberg",
   "date": "May 8, 2019",
   "date_iso": "2019-05-08",
   "url": "https://www.bloomberg.com/news/articles/2019-05-08/crypto-exchange-giant-binance-reports-a-hack-of-7-000-bitcoin",
   "also": [],
   "note": "The 2019 hack: the hot wallet held about 2% of Binance’s bitcoin. Bloomberg now headlines it “Hackers Steal $40 Million Worth of Bitcoin From Binance Exchange”.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#46",
   "used_at": [
    "1:17",
    "1:27"
   ]
  },
  {
   "n": 47,
   "section": "further_reading",
   "kind": "news",
   "title": "The world’s flashiest cryptocurrency exchange just got hacked",
   "title_type": "quoted",
   "publisher": "MIT Technology Review",
   "date": "May 8, 2019",
   "date_iso": "2019-05-08",
   "url": "https://www.technologyreview.com/f/613506/the-worlds-flashiest-cryptocurrency-exchange-just-got-hacked",
   "also": [],
   "note": "Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#47"
  },
  {
   "n": 48,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance reopens deposits and withdrawals a week after $41M hack",
   "title_type": "quoted",
   "publisher": "The Block",
   "date": "May 15, 2019",
   "date_iso": null,
   "url": "https://www.theblock.co/linked/23501/binance-reopens-withdrawals-and-deposits-a-week-after-41-million-hack-bitcoin",
   "also": [],
   "note": "Background: how Binance restarted after its 2019 hack.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#48"
  },
  {
   "n": 49,
   "section": "further_reading",
   "kind": "news",
   "title": "A $568 Million Hack of Binance Coin Roils Crypto Sector Anew",
   "title_type": "quoted",
   "publisher": "Bloomberg",
   "date": "Oct. 6, 2022",
   "date_iso": "2022-10-06",
   "url": "https://www.bloomberg.com/news/articles/2022-10-06/bnb-chain-says-bsc-temporarily-paused-on-irregular-activity",
   "also": [],
   "note": "Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#49"
  },
  {
   "n": 50,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance narrowing down identity of hacker behind BNB crypto hack: CEO",
   "title_type": "quoted",
   "publisher": "CNBC",
   "date": "Oct. 24, 2022",
   "date_iso": "2022-10-24",
   "url": "https://www.cnbc.com/2022/10/24/binance-narrowing-down-identity-of-hacker-behind-bnb-crypto-hack-ceo.html",
   "also": [],
   "note": "Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#50"
  },
  {
   "n": 51,
   "section": "further_reading",
   "kind": "news",
   "title": "Reports on the $387.5 million Bitget hack; its chief executive pointed to North Korea, unconfirmed",
   "title_type": "descriptive",
   "publisher": "BleepingComputer; Decrypt",
   "date": "Sept. 28, 2026 (BleepingComputer); Sept. 25, 2026 (Decrypt)",
   "date_iso": "2026-09-28",
   "url": "https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/amp/",
   "also": [
    "https://decrypt.co/379350/bitget-hack-387m-what-happened-why-north-korea-suspect"
   ],
   "note": "Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#51"
  },
  {
   "n": 52,
   "section": "further_reading",
   "kind": "news",
   "title": "ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack",
   "title_type": "quoted",
   "publisher": "The Block",
   "date": "Oct. 6, 2026",
   "date_iso": "2026-10-06",
   "url": "https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767",
   "also": [],
   "note": "Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#52"
  },
  {
   "n": 53,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance Pleads Guilty, Loses CZ, Pays Fines to End Legal Woes",
   "title_type": "quoted",
   "publisher": "Bloomberg Law",
   "date": "Nov. 21, 2023",
   "date_iso": "2023-11-21",
   "url": "https://news.bloomberglaw.com/bloomberg-government-news/binance-ceo-zhao-to-plead-guilty-in-us-settlement-wsj",
   "also": [],
   "note": "The 2023 plea deal: about $4.3 billion ($1.8 billion fine, $2.5 billion forfeiture) and monitors. Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#53"
  },
  {
   "n": 54,
   "section": "further_reading",
   "kind": "news",
   "title": "Report that Binance was in talks with the Justice Department about dropping its independent compliance monitor (citing Bloomberg)",
   "title_type": "descriptive",
   "publisher": "The Block",
   "date": "Sept. 16, 2025",
   "date_iso": null,
   "url": "https://www.theblock.co/post/370929/binance-in-talks-with-doj-over-dropping-independent-compliance-monitor-bloomberg",
   "also": [],
   "note": "Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#54"
  },
  {
   "n": 55,
   "section": "further_reading",
   "kind": "government",
   "title": "Letter from Senator Blumenthal to the acting Attorney General on the Binance monitorships",
   "title_type": "plain",
   "publisher": "U.S. Senate (hsgac.senate.gov)",
   "date": "Apr. 17, 2026",
   "date_iso": "2026-04-17",
   "url": "https://www.hsgac.senate.gov/wp-content/uploads/2026-04-17-Letter-from-Sen-Blumenthal-to-Acting-AG-Todd-Blanche.pdf",
   "also": [
    "https://www.fortune.com/2026/04/17/senator-blumenthal-binance-doj-fincen-treasury-monitorships-status/"
   ],
   "note": "Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "blocked",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#55"
  },
  {
   "n": 56,
   "section": "further_reading",
   "kind": "news",
   "title": "Report that the Justice Department sought $61 million in Iranian oil proceeds that moved through Binance accounts; Binance was not accused",
   "title_type": "descriptive",
   "publisher": "The Block",
   "date": "Sept. 15, 2026",
   "date_iso": "2026-09-15",
   "url": "https://www.theblock.co/news/regulation/2026-09-15-doj-61-million-crypto-proceeds-iranian-oil-sales-414768",
   "also": [],
   "note": "Background reading.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#56"
  },
  {
   "n": 57,
   "section": "further_reading",
   "kind": "dataset",
   "title": "About $144 billion in assets on known Binance addresses before the hack",
   "title_type": "descriptive",
   "publisher": "DefiLlama, as cited by CoinDesk (#23) and The Block (#24)",
   "date": "as cited on Oct. 29, 2026",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": "We did not read DefiLlama’s page ourselves.",
   "license": null,
   "accessed": null,
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#57",
   "used_at": [
    "1:27"
   ]
  },
  {
   "n": 58,
   "section": "further_reading",
   "kind": "other",
   "title": "Our calculations: the 96-cent fee (0.000413776 ETH × $2,315), the three and a half minutes between delegation and sweep, about $3.3 billion not frozen ($6.3 billion minus about $3 billion), $6.3 billion as about 4% of $144 billion, and the value of the ether wallet",
   "title_type": "descriptive",
   "publisher": "researchism, from #1, #4, #5, #8, #18 and #57",
   "date": "Oct. 29–30, 2026",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": "Our own estimates. “Roughly half” not frozen is our subtraction, not an official net-loss figure.",
   "license": null,
   "accessed": null,
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#58",
   "used_at": [
    "0:24",
    "0:27",
    "2:18",
    "4:31",
    "4:43"
   ]
  },
  {
   "n": 59,
   "section": "further_reading",
   "kind": "social media",
   "title": "The attacker’s Aave loan: 60 million USDT supplied and 19,762 wETH borrowed, minutes before the first freeze",
   "title_type": "descriptive",
   "publisher": "LlamaRisk, via Cointelegraph (#27); Marc Zeller (Aave Chan Initiative) on X",
   "date": "Oct. 29, 2026; Zeller’s post 6:53 p.m. ET",
   "date_iso": "2026-10-29",
   "url": null,
   "also": [],
   "note": "Aave’s suppliers were not at risk, they said. The film says only “minutes before the first freeze”: the timings in some reports (“about three minutes”, “about 40 minutes” before it) are not supported by the freeze times on the ledger (#10).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#59",
   "used_at": [
    "4:10"
   ]
  },
  {
   "n": 60,
   "section": "image_credit",
   "kind": "dataset",
   "title": "Blockscout: token transfers of the sweep transaction 0x53bd…e2f3",
   "title_type": "plain",
   "publisher": "Blockscout (eth.blockscout.com), captured by researchism",
   "date": "Oct. 29, 2026, 4:24:23 p.m. ET (transaction)",
   "date_iso": "2026-10-29",
   "url": "https://eth.blockscout.com/block/26300770",
   "also": [],
   "note": null,
   "license": "Fair use: a framed excerpt of the public page, captioned; full addresses barred. The link opens the block, not the transaction.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#60",
   "shown_at": [
    "0:27",
    "1:14"
   ]
  },
  {
   "n": 61,
   "section": "image_credit",
   "kind": "other",
   "title": "Binance, “Security Incident Update”, set in our type word for word (#1)",
   "title_type": "plain",
   "publisher": "Binance (binance.com)",
   "date": "Oct. 29, 2026, 10:23 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7",
   "also": [],
   "note": null,
   "license": "Quoted for news reporting and commentary, captioned with the source and the time.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#61",
   "shown_at": [
    "0:32",
    "2:46"
   ]
  },
  {
   "n": 62,
   "section": "image_credit",
   "kind": "social media",
   "title": "Binance on X: the laptop finding and the $6.3 billion estimate (crop of the post)",
   "title_type": "plain",
   "publisher": "Binance on X",
   "date": "Oct. 29, 2026, 10:25 p.m. ET (edited)",
   "date_iso": "2026-10-29",
   "url": "https://x.com/binance/status/2115993361517891592",
   "also": [],
   "note": null,
   "license": "Fair use: a framed crop of the post’s text, captioned with the account and the time.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#62",
   "shown_at": [
    "1:14",
    "2:53"
   ]
  },
  {
   "n": 63,
   "section": "image_credit",
   "kind": "social media",
   "title": "Binance on X: its first statement, last edited to “User funds are completely safe.” (crop of the post)",
   "title_type": "plain",
   "publisher": "Binance on X",
   "date": "Oct. 29, 2026, last edited 5:29 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/binance/status/2115918888429133902",
   "also": [],
   "note": null,
   "license": "Fair use: a framed crop of the post’s text, captioned with the account and the time.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#63",
   "shown_at": [
    "0:43"
   ]
  },
  {
   "n": 64,
   "section": "image_credit",
   "kind": "dataset",
   "title": "Our on-chain data: balances, transactions and freeze events, drawn as cards in our type",
   "title_type": "plain",
   "publisher": "researchism, from the Ethereum blockchain (Blockscout, Etherscan and a public Ethereum node)",
   "date": "Oct. 29, 2026, 11:00 p.m., to Oct. 30, 12:54 a.m. ET",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": null,
   "license": "Our own data and drawings; basis #4 to #10 and #106.",
   "accessed": null,
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#64",
   "shown_at": [
    "0:16",
    "0:24",
    "2:18",
    "2:34",
    "3:34",
    "3:43",
    "3:51",
    "4:31"
   ]
  },
  {
   "n": 65,
   "section": "image_credit",
   "kind": "social media",
   "title": "Our record of the posts on X: exact wording, times and edit history, drawn as post cards in our type",
   "title_type": "plain",
   "publisher": "researchism, from X’s public embed data",
   "date": "fetched Oct. 29, 2026, 11:23 p.m. ET",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": null,
   "license": "Quoted word for word with the account and the time; no screenshots.",
   "accessed": null,
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#65",
   "shown_at": [
    "0:43",
    "3:08",
    "3:43",
    "3:51",
    "3:58",
    "4:35",
    "4:37",
    "6:14"
   ]
  },
  {
   "n": 66,
   "section": "image_credit",
   "kind": "social media",
   "title": "Paolo Ardoino on X: Tether froze more than 1.567B USDT (crop of the post, #11)",
   "title_type": "plain",
   "publisher": "Paolo Ardoino, chief executive of Tether, on X",
   "date": "Oct. 29, 2026, 5:25 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/paoloardoino/status/2115918000373346709",
   "also": [],
   "note": null,
   "license": "Fair use: a framed crop of the post’s text, captioned with the account and the time.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#66",
   "shown_at": [
    "1:14"
   ]
  },
  {
   "n": 67,
   "section": "image_credit",
   "kind": "social media",
   "title": "Jeremy Allaire on X: Circle froze more than 800M USDC (crop of the post, #12)",
   "title_type": "plain",
   "publisher": "Jeremy Allaire, chief executive of Circle, on X",
   "date": "Oct. 29, 2026, 5:18 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/jerallaire/status/2115916207463481846",
   "also": [],
   "note": null,
   "license": "Fair use: a framed crop of the post’s text, captioned with the account and the time.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#67",
   "shown_at": [
    "1:14"
   ]
  },
  {
   "n": 68,
   "section": "image_credit",
   "kind": "dataset",
   "title": "Etherscan: the address page of Binance 14, a Binance hot wallet (0x28C6…1d60)",
   "title_type": "plain",
   "publisher": "Etherscan (etherscan.io), captured by researchism",
   "date": "live page, captured Oct. 29, 2026, 11:40 p.m. ET",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": null,
   "license": "Fair use: a framed excerpt of the public page, captioned; full addresses barred. We do not link the full address.",
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#68",
   "shown_at": [
    "1:43"
   ]
  },
  {
   "n": 69,
   "section": "image_credit",
   "kind": "dataset",
   "title": "Blockscout: the 50 authorizations in the delegation transaction 0xad99…298b",
   "title_type": "plain",
   "publisher": "Blockscout (eth.blockscout.com), captured by researchism",
   "date": "Oct. 29, 2026, 4:20:59 p.m. ET (transaction)",
   "date_iso": "2026-10-29",
   "url": "https://eth.blockscout.com/block/26300753",
   "also": [],
   "note": null,
   "license": "Fair use: a framed excerpt of the public page, captioned; full addresses barred. The link opens the block, not the transaction.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#69",
   "shown_at": [
    "2:08"
   ]
  },
  {
   "n": 70,
   "section": "further_reading",
   "kind": "social media",
   "title": "Only 1 of 50 was a hit.",
   "title_type": "quoted",
   "publisher": "Blockaid on X",
   "date": "Oct. 29, 2026, 5:50 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/blockaid_/status/2115924317888495661",
   "also": [],
   "note": "Excerpt. The film quotes the post in our type; its diagram is not shown.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#70",
   "named_at": [
    "2:08",
    "2:15"
   ]
  },
  {
   "n": 71,
   "section": "image_credit",
   "kind": "dataset",
   "title": "Etherscan: the sweep transaction 0x53bd…e2f3",
   "title_type": "plain",
   "publisher": "Etherscan (etherscan.io), captured by researchism",
   "date": "Oct. 29, 2026, 4:24:23 p.m. ET (transaction)",
   "date_iso": "2026-10-29",
   "url": "https://etherscan.io/block/26300770",
   "also": [],
   "note": null,
   "license": "Fair use: a framed excerpt of the public page, captioned; full addresses barred. Etherscan’s own commentary box barred. The link opens the block, not the transaction.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#71",
   "shown_at": [
    "2:23"
   ]
  },
  {
   "n": 72,
   "section": "checked_not_used",
   "kind": "dataset",
   "title": "Etherscan: the 780 million USDC transfer 0xdc10…7481",
   "title_type": "plain",
   "publisher": "Etherscan (etherscan.io), captured by researchism",
   "date": "Oct. 29, 2026, 4:41:23 p.m. ET (transaction)",
   "date_iso": "2026-10-29",
   "url": null,
   "also": [],
   "note": null,
   "license": "Captured; the film draws this transfer itself (#6).",
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#72"
  },
  {
   "n": 73,
   "section": "image_credit",
   "kind": "social media",
   "title": "Spreek (on-chain researcher) on X: the first public alarm (crop of the post)",
   "title_type": "plain",
   "publisher": "Spreek on X",
   "date": "Oct. 29, 2026, 4:32 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/spreekaway/status/2115904721856651382",
   "also": [],
   "note": null,
   "license": "Fair use: a framed crop of the post’s text, captioned with the account and the time. Cut before a sentence we do not use.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#73",
   "shown_at": [
    "3:08"
   ]
  },
  {
   "n": 74,
   "section": "checked_not_used",
   "kind": "other",
   "title": "Portrait of Paolo Ardoino",
   "title_type": "plain",
   "publisher": "Gage Skidmore, via Wikimedia Commons",
   "date": "May 29, 2025",
   "date_iso": "2025-05-29",
   "url": "https://commons.wikimedia.org/wiki/File:Paolo_Ardoino_by_Gage_Skidmore.jpg",
   "also": [],
   "note": null,
   "license": "CC BY-SA 3.0",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#74"
  },
  {
   "n": 75,
   "section": "checked_not_used",
   "kind": "other",
   "title": "Portrait of Jeremy Allaire",
   "title_type": "plain",
   "publisher": "MoneyConf, via Wikimedia Commons",
   "date": "2018",
   "date_iso": null,
   "url": "https://commons.wikimedia.org/wiki/File:Jeremy_Allaire_at_MoneyConf_2018_(2)_(cropped).jpg",
   "also": [],
   "note": null,
   "license": "CC BY 2.0",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#75"
  },
  {
   "n": 76,
   "section": "image_credit",
   "kind": "social media",
   "title": "Changpeng Zhao in an interview on the When Shift Happens podcast",
   "title_type": "plain",
   "publisher": "When Shift Happens (YouTube)",
   "date": "Oct. 2, 2026",
   "date_iso": "2026-10-02",
   "url": "https://www.youtube.com/watch?v=r3B_ea0pvNU",
   "also": [],
   "note": null,
   "license": "CC BY 3.0, the Creative Commons license on the YouTube upload. A short excerpt, muted, from an interview published before this hack.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#76",
   "shown_at": [
    "3:58"
   ]
  },
  {
   "n": 77,
   "section": "checked_not_used",
   "kind": "other",
   "title": "Portrait of Changpeng Zhao",
   "title_type": "plain",
   "publisher": "Web Summit, via Wikimedia Commons",
   "date": "Nov. 2, 2022",
   "date_iso": "2022-11-02",
   "url": "https://commons.wikimedia.org/wiki/File:2022_-_Press_Conferences_BE6_1595_(52471628042).jpg",
   "also": [],
   "note": null,
   "license": "CC BY 2.0",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#77"
  },
  {
   "n": 78,
   "section": "further_reading",
   "kind": "social media",
   "title": "User funds are safe! It does look like a hack on Binance. …",
   "title_type": "quoted",
   "publisher": "Changpeng Zhao (CZ) on X",
   "date": "Oct. 29, 2026, 5:15 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/cz_binance/status/2115915423174853077",
   "also": [],
   "note": "Excerpt (#13). The film shows the post’s text in our type.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#78",
   "named_at": [
    "3:58"
   ]
  },
  {
   "n": 80,
   "section": "image_credit",
   "kind": "dataset",
   "title": "Etherscan: the address page of the ether wallet 0x8532…43D4, labeled “Binance Hot Wallet Exploiter 8”",
   "title_type": "plain",
   "publisher": "Etherscan (etherscan.io), captured by researchism",
   "date": "live page, captured Oct. 29, 2026, 11:38 p.m. ET",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": null,
   "license": "Fair use: a framed excerpt of the public page, captioned; full addresses barred. We do not link the full address.",
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#80",
   "shown_at": [
    "4:24"
   ]
  },
  {
   "n": 81,
   "section": "image_credit",
   "kind": "dataset",
   "title": "Etherscan: the 195,460 ETH transfer to that wallet, 0x551d…2c76",
   "title_type": "plain",
   "publisher": "Etherscan (etherscan.io), captured by researchism",
   "date": "Oct. 29, 2026, 4:38:47 p.m. ET (transaction)",
   "date_iso": "2026-10-29",
   "url": null,
   "also": [],
   "note": null,
   "license": "Fair use: a framed excerpt of the public page, captioned; full addresses barred.",
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#81",
   "shown_at": [
    "4:24"
   ]
  },
  {
   "n": 82,
   "section": "further_reading",
   "kind": "social media",
   "title": "Post thanking Ripple for freezing approximately 200 million",
   "title_type": "descriptive",
   "publisher": "Yi He, Binance co-founder, on X",
   "date": "Oct. 29, 2026, 6:08 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/heyibinance/status/2115928691045982577",
   "also": [],
   "note": "The amount comes only from this post (#17).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#82",
   "named_at": [
    "4:35"
   ]
  },
  {
   "n": 83,
   "section": "further_reading",
   "kind": "social media",
   "title": "Post announcing that Aave froze all its DAO-operated markets",
   "title_type": "descriptive",
   "publisher": "Aave on X",
   "date": "Oct. 29, 2026, 6:44 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/aave/status/2115937863162339637",
   "also": [],
   "note": null,
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#83",
   "named_at": [
    "4:35"
   ]
  },
  {
   "n": 84,
   "section": "further_reading",
   "kind": "social media",
   "title": "verified total frozen is $2.54 billion",
   "title_type": "quoted",
   "publisher": "Binance on X",
   "date": "Oct. 29, 2026, 7:22 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/binance/status/2115947325617299903",
   "also": [],
   "note": "Excerpt. Binance’s first frozen total; at 8:52 p.m. ET it said about $3 billion (#85).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#84",
   "named_at": [
    "4:37"
   ]
  },
  {
   "n": 85,
   "section": "image_credit",
   "kind": "social media",
   "title": "Binance on X: “around $3 billion” verified frozen (crop of the post)",
   "title_type": "plain",
   "publisher": "Binance on X",
   "date": "Oct. 29, 2026, 8:52 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/binance/status/2115970069696217576",
   "also": [],
   "note": null,
   "license": "Fair use: a framed crop of the post’s text, captioned with the account and the time.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#85",
   "shown_at": [
    "4:37"
   ]
  },
  {
   "n": 86,
   "section": "checked_not_used",
   "kind": "other",
   "title": "Dubai skyline at night",
   "title_type": "plain",
   "publisher": "Robert Bock, via Wikimedia Commons",
   "date": "undated",
   "date_iso": null,
   "url": "https://commons.wikimedia.org/wiki/File:Dubai_skyline_unsplash.jpg",
   "also": [],
   "note": null,
   "license": "CC0",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#86"
  },
  {
   "n": 87,
   "section": "image_credit",
   "kind": "government",
   "title": "FBI IC3 public service announcement I-022625-PSA, top of the page (#19)",
   "title_type": "plain",
   "publisher": "FBI, Internet Crime Complaint Center (ic3.gov)",
   "date": "Feb. 26, 2025",
   "date_iso": "2025-02-26",
   "url": "https://www.ic3.gov/PSA/2025/PSA250226",
   "also": [],
   "note": null,
   "license": "U.S. government work, public domain.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#87",
   "shown_at": [
    "5:38"
   ]
  },
  {
   "n": 88,
   "section": "image_credit",
   "kind": "social media",
   "title": "Binance on X: “all deposits and withdrawals are temporarily suspended” (crop of the post)",
   "title_type": "plain",
   "publisher": "Binance on X",
   "date": "Oct. 29, 2026, 8:13 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/binance/status/2115960292115124558",
   "also": [],
   "note": null,
   "license": "Fair use: a framed crop of the post’s text, captioned with the account and the time.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#88",
   "shown_at": [
    "6:03"
   ]
  },
  {
   "n": 89,
   "section": "further_reading",
   "kind": "social media",
   "title": "Binance will cover all hacking losses.",
   "title_type": "quoted",
   "publisher": "Yi He, Binance co-founder, on X",
   "date": "Oct. 29, 2026, 8:04 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/heyibinance/status/2115958049244631357",
   "also": [],
   "note": "Excerpt (#14). The film shows the post’s text in our type.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#89",
   "named_at": [
    "6:14"
   ]
  },
  {
   "n": 90,
   "section": "image_credit",
   "kind": "dataset",
   "title": "CoinGecko five-minute prices for bitcoin, ether and BNB, drawn as our own chart",
   "title_type": "plain",
   "publisher": "CoinGecko API",
   "date": "Oct. 29, 2026, 4:00 a.m. to 11:20 p.m. ET, and Oct. 30, 12:47 a.m. ET",
   "date_iso": null,
   "url": null,
   "also": [],
   "note": null,
   "license": "Data: CoinGecko. Chart drawn by researchism; information only, not investment advice.",
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#90",
   "shown_at": [
    "6:26"
   ]
  },
  {
   "n": 91,
   "section": "further_reading",
   "kind": "social media",
   "title": "Post estimating the outflows at about $5.3 billion, including 17,985 bitcoin",
   "title_type": "descriptive",
   "publisher": "glassnode on X",
   "date": "Oct. 29, 2026, 5:59 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/glassnode/status/2115926432631410795",
   "also": [],
   "note": "The film names the estimate; glassnode’s chart is not shown.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#91",
   "named_at": [
    "6:38",
    "6:46"
   ]
  },
  {
   "n": 92,
   "section": "further_reading",
   "kind": "social media",
   "title": "Post estimating the theft at about $5.912 billion at the time it happened",
   "title_type": "descriptive",
   "publisher": "Chainalysis on X",
   "date": "Oct. 29, 2026, 8:26 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://x.com/chainalysis/status/2115963516884808078",
   "also": [],
   "note": null,
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#92",
   "named_at": [
    "6:46"
   ]
  },
  {
   "n": 93,
   "section": "image_credit",
   "kind": "government",
   "title": "FBI headquarters in Washington, D.C. (a few seconds of an FBI video)",
   "title_type": "plain",
   "publisher": "FBI, on YouTube",
   "date": "Oct. 13, 2026",
   "date_iso": "2026-10-13",
   "url": "https://www.youtube.com/watch?v=tE0QXXzyUtA",
   "also": [],
   "note": null,
   "license": "U.S. government work, public domain. Shown as an illustration: the video is about North Korean IT workers, not this hack.",
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#93",
   "shown_at": [
    "6:59"
   ]
  },
  {
   "n": 101,
   "section": "further_reading",
   "kind": "social media",
   "title": "Service Update",
   "title_type": "quoted",
   "publisher": "Yi He, Binance co-founder, on X",
   "date": "Oct. 30, 2026, 12:17 a.m. ET",
   "date_iso": "2026-10-30",
   "url": "https://x.com/heyibinance/status/2116021551262740985",
   "also": [
    "https://www.tokenpost.com/news/business/44245",
    "https://www.chaincatcher.com/en/article/2300291",
    "https://thedefiant.io/news/hacks/binance-expects-to-start-resuming-withdrawals-within-48-hours"
   ],
   "note": "Deposits “continue to operate as normal”; withdrawals expected to resume “in the next 48 hours”. Binance’s own update (#1) still said deposits were suspended. Read at our fact refresh before the narration was recorded (Oct. 30, 12:38 to 12:55 a.m. ET).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#101",
   "used_at": [
    "6:03",
    "6:59"
   ]
  },
  {
   "n": 102,
   "section": "further_reading",
   "kind": "other",
   "title": "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History",
   "title_type": "quoted",
   "publisher": "TRM Labs (blockchain analytics firm)",
   "date": "Oct. 29, 2026, 10:10 p.m. ET",
   "date_iso": "2026-10-29",
   "url": "https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history",
   "also": [],
   "note": "Attributes the attack to “TraderTraitor, North Korea’s elite hacking unit” “with high confidence”: a private firm’s judgment, not a government finding. Also its estimate (about $6.36 billion at the time of each transfer, across ten blockchains) and 18,270 bitcoin sent to an attacker address.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#102",
   "used_at": [
    "0:47",
    "3:00",
    "5:11",
    "6:38",
    "6:46",
    "6:53",
    "7:13"
   ]
  },
  {
   "n": 103,
   "section": "further_reading",
   "kind": "news",
   "title": "Blockchain analysis firm TRM says North Korea behind Binance crypto theft",
   "title_type": "quoted",
   "publisher": "Reuters, via The Korea Times",
   "date": "Oct. 30, 2026, 12:26 a.m. ET (Reuters); 12:33 a.m. ET (The Korea Times)",
   "date_iso": "2026-10-30",
   "url": "https://www.koreatimes.co.kr/foreignaffairs/northkorea/20261030/blockchain-analysis-firm-trm-says-north-korea-behind-binance-crypto-theft",
   "also": [],
   "note": "Reports TRM Labs’ attribution; no comment from Binance, the FBI or any government, and no government attribution. We read the copy in The Korea Times, not reuters.com. Headline as we recorded it at 12:33 a.m. ET; the updated story was titled “Binance freezes assets after $6.3 bil. heist, crypto industry's biggest”.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#103",
   "used_at": [
    "5:11",
    "6:53"
   ]
  },
  {
   "n": 104,
   "section": "further_reading",
   "kind": "news",
   "title": "BTC news: Binance hacker took over 18,270 bitcoin that no one can freeze",
   "title_type": "quoted",
   "publisher": "CoinDesk",
   "date": "Oct. 30, 2026, 12:50 a.m. ET",
   "date_iso": "2026-10-30",
   "url": null,
   "also": [],
   "note": "Headline only, seen via Google News; it matches TRM Labs’ 18,270 bitcoin (#102).",
   "license": null,
   "accessed": null,
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#104",
   "used_at": [
    "6:38"
   ]
  },
  {
   "n": 105,
   "section": "further_reading",
   "kind": "news",
   "title": "Binance Exploiter Swaps $911 Million Into ETH and TRX, Arkham Says",
   "title_type": "quoted",
   "publisher": "The Defiant",
   "date": "Oct. 30, 2026, about 12:41 a.m. ET",
   "date_iso": "2026-10-30",
   "url": "https://thedefiant.io/news/hacks/binance-exploiter-swaps-911-million-into-eth-and-trx-arkham-says",
   "also": [
    "https://thedefiant.io/news/hacks/misttrack-links-binance-theft-route-to-phemex-connected-address"
   ],
   "note": "Headlines only; the articles did not load for us. The second link is The Defiant’s “MistTrack Links Binance Theft Route to Phemex-Connected Address”. Not used in the film.",
   "license": null,
   "accessed": null,
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#105"
  },
  {
   "n": 106,
   "section": "further_reading",
   "kind": "dataset",
   "title": "Our on-chain re-check before the narration was recorded",
   "title_type": "plain",
   "publisher": "researchism, from the Ethereum blockchain (a public Ethereum node)",
   "date": "Oct. 30, 2026, 12:41 to 12:54 a.m. ET",
   "date_iso": "2026-10-30",
   "url": null,
   "also": [],
   "note": "The ether wallet (0x8532…43D4): 197,460 ETH and no outgoing transaction; the attacker’s main wallet still blacklisted by Tether and Circle; ether at $2,243 (CoinGecko, 12:47 a.m. ET).",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#106",
   "used_at": [
    "4:31",
    "6:26",
    "6:59"
   ]
  },
  {
   "n": 107,
   "section": "further_reading",
   "kind": "other",
   "title": "Checked, nothing new: Binance’s announcements, the FBI’s IC3 notices, ZachXBT’s Telegram channel and the Cointelegraph live blog",
   "title_type": "descriptive",
   "publisher": "researchism (our check)",
   "date": "Oct. 30, 2026, 12:38 to 12:54 a.m. ET",
   "date_iso": "2026-10-30",
   "url": null,
   "also": [],
   "note": "No post-mortem, no new proof of reserves and no FBI notice on Binance at that time.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": null,
   "link_status": null,
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#107"
  },
  {
   "n": 108,
   "section": "further_reading",
   "kind": "other",
   "title": "Our re-check before the final render: the ether wallet untouched, Binance’s update unchanged, withdrawals still paused, no government statement",
   "title_type": "descriptive",
   "publisher": "researchism (our check), with Binance on X",
   "date": "Oct. 30, 2026, 3:00 to 3:25 a.m. ET",
   "date_iso": "2026-10-30",
   "url": null,
   "also": [
    "https://x.com/binance/status/2116026356740034858"
   ],
   "note": "The ether wallet still held 197,460 ETH with no outgoing transaction at 3:23 a.m. ET. Binance on X, 12:36 a.m. ET (the link): “Withdrawals remain paused …”, “We expect to resume within 48 hours.” No statement by the FBI, the Justice Department, the Treasury or any other government. The film’s “as of Oct. 30, 2026, 3:25 a.m. ET” rests on this check.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#108",
   "used_at": [
    "4:31"
   ]
  },
  {
   "n": 109,
   "section": "further_reading",
   "kind": "social media",
   "title": "Investigation update",
   "title_type": "quoted",
   "publisher": "Binance on X",
   "date": "Oct. 30, 2026, 4:47 a.m. ET",
   "date_iso": "2026-10-30",
   "url": "https://x.com/binance/status/2116089661408108712",
   "also": [],
   "note": "Its initial investigation suggested a possibly compromised laptop; its “subsequent investigation has uncovered additional points of breach”. Also: “still on track” to resume withdrawals “in 45 hours”, deposits “remain unaffected”, about $3 billion frozen. Read via the public api.fxtwitter.com mirror. After the film’s stand, not in the film.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#109"
  },
  {
   "n": 110,
   "section": "further_reading",
   "kind": "other",
   "title": "The $6.4 Billion Binance Exploit: Tracing the North Korea Link",
   "title_type": "quoted",
   "publisher": "Chainalysis (blockchain analytics firm)",
   "date": "Oct. 30, 2026, 5:34 a.m. ET",
   "date_iso": "2026-10-30",
   "url": "https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/",
   "also": [
    "https://x.com/jony_levin/status/2116020833227587637",
    "https://x.com/chainalysis/status/2116025255965999217"
   ],
   "note": "Judges the hack to be the work of North Korea’s TraderTraitor group: a private firm’s judgment, not a government finding. Chainalysis CEO Jonathan Levin first posted the assessment on X at 12:14 a.m. ET, and the company at 12:31 a.m. ET (the links), before the film’s stand; it is not in the film.",
   "license": null,
   "accessed": "2026-10-30",
   "link_checked": "2026-10-30",
   "link_status": "ok",
   "anchor": "https://researchism.tv/binance-hack-where-did-6-billion-go/#110"
  }
 ]
}