Binance’s $6.3B theft · events, causes and competing claims

A sourced chronology and provisional Events and Causal Factors analysis of the 29 October 2026 Binance theft, commonly reported as a roughly $6.3 billion hack. Includes contemporary reporting, changing company explanations, attribution, containment and customer access. Research cutoff: 2 November 2026, 05:00 UTC (1 November, 19:00 HST). This is a public-source synthesis, not an official investigation or a completed forensic root-cause finding.

Read the incident first

• Zoom to 29 October, 20:00 UTC – 30 October, 00:30 UTC for the theft and containment sequence. Open MISHAP, then the two CF conditions and the dashed initial-access hypothesis.
• Zoom to 30 October – 2 November for the claims and reporting sequence. Open the comparison cards attached to each record. Earlier context lies in 2023–2025; it has contextual connections without causal arrowheads.
• Use tags such as incident sequence, causal analysis, claims and reporting, context, containment, replacement assets, attribution, disputed claim and unresolved to focus the view. Selecting tags combines their matches; it does not create a separate lane for each selected tag.
• Sources appear on every entry. Date precision distinguishes UTC transaction times, publication times, approximate intervals and midnight day anchors. Midnight does not establish same-day order. On 1 November the US Eastern clock changes from EDT to EST; conversions here account for that.

What the chart distinguishes

Red marks loss; green marks containment or service restoration; purple marks claims and reporting; gold ellipses are causal conditions. Dashed outlines identify hypotheses or uncertain interval bounds. A solid company-statement card confirms that a statement was made, not that its contents were audited. A condition sampled at the mishap is not dated to its unknown onset.

Arrowheads are reserved for the technical mechanism, containment and explicitly provisional hypotheses. All other relationships are unarrowed comparisons, reporting dependence, revisions, evidence or context. Every connection has its meaning and rationale written in the source entry’s notes and analysisLinks; the platform’s underlying relationship is undirected. Chronological adjacency and political association are not treated as causes. All five plugins from the live Causal factor analysis v2 suite are enabled, with sources, dating context and rich notes.

Working causal model: an unresolved initial foothold may have enabled misuse of signing authority; on Ethereum, valid delegation authorized attacker execution and persistent permissions enabled repeated drains. Other chains used ordinary signed transfers. The complete internal failure chain is not established. Issuer freezes and authorization revocation are different barriers. Suggested verification checks are editorial proposals, not claims that Binance implemented them.

Claims worth opening

Cards headed Claim summarize an identified source’s statement; cards headed Inference check, Definition check or Technical check are this timeline’s analytical questions, not claims falsely attributed to an outside speaker. The cards compare loss and chain-count estimates, concentration of losses versus total attack duration, initial versus revised laptop explanations, absence of key-leak evidence versus signing compromise, deposit-service disagreements, freezes versus returns, replacement coverage versus recovered proceeds, reserve snapshots versus broader solvency, revised proof deadlines, analyst attribution versus the FBI notice, automation versus unsupported AI claims, and customer outflows versus theft. A separate Chainalysis intrusion is explicitly kept separate. Prior legal actions and political ties are included as news context with no invented breach-causation link.

Primary company disclosures are first-hand evidence of what Binance claimed; its financial representations remain attributed. Original investigator reports are primary for their own observations and assessments, not automatically independently reproduced here. The FBI notice establishes an official attribution, not every technical hypothesis. Secondary reporting is linked to original statements where available; stories repeating the same notice do not count as independent evidence. The selected Etherscan locator and some original social posts were inaccessible, and that limitation is retained. No anonymous social claim is promoted to a finding.

Media

Cover: Satheesh Sankaran, “Bitcoin on Laptop Keyboard”, CC BY 2.0, via Wikimedia Commons; license. It is an illustrative token photograph, not Binance equipment, a photograph of the compromised laptop or incident evidence. Original photo retained without modification. No unrelated background image is installed.

Source directory

• Binance · first incident update (updated 30 Oct) — primary · affected company.
• Binance · incident update 2 (30 Oct) — primary · affected company.
• Binance · recovery update 3 (31 Oct) — primary · affected company.
• Binance · recovery update 4 (1 Nov) — primary · affected company.
• TRM · original multichain investigation — primary · investigator analysis.
• Hypernative · original detection and transaction analysis — primary · investigator / security vendor.
• Bitquery · original chain-by-chain investigation — primary · investigator analysis.
• Chainalysis · original tracing assessment — primary · investigator analysis.
• Elliptic · investigation, updated 1 Nov 08:00 UTC — primary · investigator analysis.
• FBI · Binance attribution (31 Oct) — primary · government attribution.
• FBI/IC3 · Bybit attribution (26 Feb 2025) — primary · government attribution.
• EIP-7702 · protocol specification — primary · technical specification.
• DOJ · Binance guilty plea and resolution — primary · court/prosecutor record.
• DOJ · signed Zhao pardon, 21 Oct 2025 — primary · signed official record.
• AP · public pardon announcement, 23 Oct 2025 — secondary · original reporting.
• AP · initial security-issue report, 29 Oct — secondary · original reporting.
• AP · exchange history and political context — secondary · original reporting.
• AP · stocks, technology sell-off and crypto — secondary · original reporting.
• WIRED · contemporary 20-minute account — secondary · original reporting.
• The Block · infrastructure reporting, 30 Oct — secondary · original reporting.
• CoinDesk · attribution coverage, 31 Oct — secondary · original reporting.
• Chainalysis · separate security incident notice — primary · affected company.
• The Block · separate Chainalysis breach, 31 Oct — secondary · original reporting.
• The Block · withdrawals and net outflows, 1 Nov — secondary · original reporting.
• The Block · Tron tracing and THORChain response, 1 Nov — secondary · original reporting.
• NIST SP 800-61r3 · incident response guidance — primary · methodological guidance.
• DOE-STD-1197-2024 · causal analysis methodology — primary · methodological guidance.
• Etherscan · main Ethereum sweep transaction — primary · ledger locator (not independently retrieved).