Campaign

Theft from a Binance Bitcoin hot wallet

event:hackfrom 2026-10-29version 1 · current

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

The campaign

2026-10-29event:hackTheft from a Binance Bitcoin hot wallet
On 29 October 2026, 18,270.2 BTC left a Binance Bitcoin hot wallet in 11 transactions to one address, and from there it was split across 19 addresses. The FBI lists those 19 addresses as holding or having held assets from the theft. The other chains of the same incident are in the refs.
victimBinance
date2026-10-29precision: day
sourcebtcintel incident dossiers
fetch —sha256 de433baf531e0205
binance-hot-wallet-2026-10btcintel:events:189@v1 sha256:efd14656721ffde6dispute

Members21 current

victim: 1 current; funds were taken from it
sweep: 0 current · 11 waiting for review; a transaction that moved victims' funds
vault: 20 current; an address holding proceeds
cash out: 0 current; a deposit at a service

Member listclaims, in id order

Victim in Theft from a Binance Bitcoin hot walletvictim
subjectaddressbc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://onchainattack.org/document/examples/2026-10-binance-devops-laptop-service-container-hot-wallet-drain/ · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069571btcintel:annotations:1069571@v1 sha256:13d108beee0ec804dispute
confidenceweb crawl · 20
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.tibane.net/research/binance-hack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance · url https://onchainattack.org/document/examples/2026-10-binance-devops-laptop-service-container-hot-wallet-drain/
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069583btcintel:annotations:1069583@v1 sha256:823875da9e4c7d75dispute
confidencetrusted provider · 50
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968s
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069584btcintel:annotations:1069584@v1 sha256:4c1b996b370b9adedispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qepc70u3u476vgvg3hfcwjgu4mecxe2uchs4lag
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069585btcintel:annotations:1069585@v1 sha256:8df2f4b858b6a45edispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qdfhmlrdvg4tm87zjl0vyf0xflp5ql50q3g88gw
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069586btcintel:annotations:1069586@v1 sha256:aaa6f0b7891e2d55dispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qnq6jj9jmlf3945m3l8s0kxnqehrsga300k8t3s
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069587btcintel:annotations:1069587@v1 sha256:8213be3c0b6b4191dispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1q42flhayrzy3zh8lkyevw8qcjduurt9a35wlsyx
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069588btcintel:annotations:1069588@v1 sha256:33bd7ec53c5344e2dispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qz8hdwv8gmml0u96dsvnzsagz6krjyzxmgxupdp
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069589btcintel:annotations:1069589@v1 sha256:abab526a7671e859dispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qm2j6v3247khlwzxl7p9vqnfkghcllyhv9wjaat
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069590btcintel:annotations:1069590@v1 sha256:14530775f7236f2edispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1q0ts8gaf9ht0rr4u02hr56f8thndqsc4kmkmfv3
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069591btcintel:annotations:1069591@v1 sha256:377df4a2570037d8dispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1q2wvz0kcsn4hqmajwtey30ud27fl25w8pveznn6
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069592btcintel:annotations:1069592@v1 sha256:3e2a0409694fbadbdispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qalwnl7dtaa73fsq5tyn0ghfy3fgfpqkt69tca8
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069593btcintel:annotations:1069593@v1 sha256:801415ccbd217c43dispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qjwdw6vrzq4vf6hckutvx4ucj86awwv99mxnz7w
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069594btcintel:annotations:1069594@v1 sha256:2a1125ff272b110bdispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qs3aej5tmcdz0vctz8y9rjcxtxg8v5385577s56
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069595btcintel:annotations:1069595@v1 sha256:4e8914e6c4cc6691dispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1q63qrfrpsg5hh0zzn3kp2xx9vljl7dq7tatsjxp
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069596btcintel:annotations:1069596@v1 sha256:d0c9e9fdfc2c1e91dispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qs6xnmhar38z44g2za93pv8ygdcwurrh8l87w3v
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069597btcintel:annotations:1069597@v1 sha256:719cdaa1dd950b1bdispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qg3nrzpuvq2pxqx74tcrywr09dc208ze96n3t53
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069598btcintel:annotations:1069598@v1 sha256:379d43b0f8b939fbdispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qf5cyvv9w50tx9xx9s3xwsne0z87wvjj9l8a35u
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069599btcintel:annotations:1069599@v1 sha256:25af2915dd768ec4dispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qm8v88m5fy6kuq9myva2eemwycxqd3e0zcrs2l8
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069600btcintel:annotations:1069600@v1 sha256:60b6a69b9a4fd463dispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qrg025e2pgx0rwya2kpgtj30972p64jt0hn6zyt
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069601btcintel:annotations:1069601@v1 sha256:977a8cf63eaefc2adispute
confidenceauthority data · 60
Vault in Theft from a Binance Bitcoin hot wallettheftvault
subjectaddressbc1qxg0l4p6xc50zuv9cl5f0l0wmaxjpg8wcy7s9ra
chain checkverifiedthe source's stated fact matched the chain at import, 2026-11-02
sourcebtcintel incident dossiersbtcintel incident dossiers (CC BY 4.0)
evidenceurl https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack · url https://sochain.com/guides/where-is-the-bitcoin-stolen-from-binance
fetch 2026-11-02 01:46 UTCsha256 de433baf531e0205valid from 2026-11-02
ann_1069602btcintel:annotations:1069602@v1 sha256:415cae615641d43adispute
confidenceauthority data · 60

Files

STIX 2.1 bundle TagPack members CSV

The TagPack never tags a victim's address: a victim is not an abuse label. The STIX bundle names victims as notes, never as indicators.

Versions

version	created	actor	content sha256	citation
v1current	2026-11-02 01:46 UTC	importer:btcintel-dossiers	efd14656721ffde61c1e1a0cf1e81bb99a455687a666fff516d44a5aed8a7310	btcintel:events:189@v1 sha256:efd14656721ffde6