Theft from a Binance Bitcoin hot wallet

The campaign

• 2026-10-29event:hackTheft from a Binance Bitcoin hot wallet

  On 29 October 2026, 18,270.2 BTC left a Binance Bitcoin hot wallet in 11 transactions to one address, and from there it was split across 19 addresses. The FBI lists those 19 addresses as holding or having held assets from the theft. The other chains of the same incident are in the refs.

  victimBinance
  date2026-10-29precision: day
  sourcebtcintel incident dossiers
  fetch —sha256:de433baf531e0205
  binance-hot-wallet-2026-10btcintel:events:189@v1 sha256:efd14656721ffde6copy citationdispute

Members22 current

victim

1 current

funds were taken from it

sweep

1 current · 10 waiting for review

a transaction that moved victims' funds

vault

20 current

an address holding proceeds

cash out

0 current

a deposit at a service

Member listclaims, in id order

• Victim in Theft from a Binance Bitcoin hot walletvictim

  subjectaddressbc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://onchainattack.org/document/examples/2026-10-binance-devops-laptop-service-container-hot-wallet-drain/ · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceweb crawl · 20
• Sweep in Theft from a Binance Bitcoin hot wallettheftsweep

  subjecttransaction82c0b6f217…1242df04ce

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.tibane.net/research/binance-hack · url https://nodewitness.com/en/analysis/binance-hot-wallet-outflow-tether-circle-freeze/

  fetch 2026-11-03 11:01 UTCsha256:610dbb49172a9714valid from 2026-11-02version 2

  copy citationdispute
  confidencetrusted provider · 50
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.tibane.net/research/binance-hack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance · url https://onchainattack.org/document/examples/2026-10-binance-devops-laptop-service-container-hot-wallet-drain/

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidencetrusted provider · 50
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968s

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qepc70u3u476vgvg3hfcwjgu4mecxe2uchs4lag

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qdfhmlrdvg4tm87zjl0vyf0xflp5ql50q3g88gw

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qnq6jj9jmlf3945m3l8s0kxnqehrsga300k8t3s

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1q42flhayrzy3zh8lkyevw8qcjduurt9a35wlsyx

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qz8hdwv8gmml0u96dsvnzsagz6krjyzxmgxupdp

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qm2j6v3247khlwzxl7p9vqnfkghcllyhv9wjaat

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1q0ts8gaf9ht0rr4u02hr56f8thndqsc4kmkmfv3

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1q2wvz0kcsn4hqmajwtey30ud27fl25w8pveznn6

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qalwnl7dtaa73fsq5tyn0ghfy3fgfpqkt69tca8

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qjwdw6vrzq4vf6hckutvx4ucj86awwv99mxnz7w

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qs3aej5tmcdz0vctz8y9rjcxtxg8v5385577s56

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1q63qrfrpsg5hh0zzn3kp2xx9vljl7dq7tatsjxp

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qs6xnmhar38z44g2za93pv8ygdcwurrh8l87w3v

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qg3nrzpuvq2pxqx74tcrywr09dc208ze96n3t53

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qf5cyvv9w50tx9xx9s3xwsne0z87wvjj9l8a35u

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qm8v88m5fy6kuq9myva2eemwycxqd3e0zcrs2l8

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qrg025e2pgx0rwya2kpgtj30972p64jt0hn6zyt

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60
• Vault in Theft from a Binance Bitcoin hot wallettheftvault

  subjectaddressbc1qxg0l4p6xc50zuv9cl5f0l0wmaxjpg8wcy7s9ra

  chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02

  sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)

  evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance

  fetch 2026-11-02 01:46 UTCsha256:de433baf531e0205valid from 2026-11-02

  copy citationdispute
  confidenceauthority data · 60

Files

The TagPack never tags a victim's address: a victim is not an abuse label. The STIX bundle names victims as notes, never as indicators.

Versions