Two signatures, one theft: what the Bitcoin trail of the Binance hack reveals

On the evening of 29 October 2026, Binance became the victim of the largest theft in the history of crypto. Hot wallets on ten blockchains were affected, and the exchange puts the damage at around 6.3 billion US dollars. A large part of that was stablecoins, which their issuers were able to freeze within hours. Bitcoin offers no such option. The 18,270 BTC that left the hot wallet at 20:20 UTC are therefore the part of the loot that can only ever be watched with the means of blockchain forensics. We traced the trail with the Coinator. It tells more than one might expect at first glance.

The outflow bears the handwriting of Binance

The first finding is a surprise. The eleven transactions that carried the money out of the hot wallet look like perfectly ordinary Binance withdrawals. They have the same structure as the millions of transactions this wallet produced in the years before: the same transaction version, the same fee policy, the same ordering of inputs, and the change flows back to the hot wallet as it always does. The amounts fit the picture of a withdrawal, too. They are rounded to one decimal place, 7,636.8 BTC, then 4,696.6, then 2,946.9, and shrink from transaction to transaction, as if someone had repeatedly requested whatever balance was available.

On the chain, then, one does not see foreign software signing with stolen keys. One sees the Binance withdrawal system doing what it always does, just for the wrong recipient. That matches what the exchange itself and several analysis firms have since reported: it was not the private keys that were taken, but control over what the system signs. For forensics this is an important distinction. Anyone looking for a suspicious transaction at this point will not find one.

The peel chain: 19 lots in one block

All eleven withdrawals land on a single collection address. From there, while the withdrawals themselves are still sitting unconfirmed in the mempool, the distribution begins. The pattern is called a peel chain: each transaction peels 1,000 BTC off to a fresh address and passes the remainder to the next one. Several such chains run in parallel, the longest fed by the three largest withdrawals, and at the end the leftovers are gathered into two further lots.

The result is 19 destination addresses: 17 holding exactly 1,000 BTC, one holding 832.5 and one holding 437.7 BTC. Apart from the final consolidation, all of this happened in the same block as the outflow, within minutes. None of the 19 lots has moved since.

The second handwriting

From the collection address onwards the picture changes completely. The 19 transactions of the peel chain visibly do not come from the Binance system, and they all come from the same wallet. This can be read from a series of properties that wallet software gives its transactions, usually without its users knowing:

• Transaction version and replaceability. All attacker transactions use the newer transaction version and are flagged as replaceable. The Binance transactions are not.
• Fee-sniping protection. Every transaction carries a locktime pointing at the block that was current at the time. Four of the 19 instead point a few dozen blocks into the past. At first glance that looks like evidence of transactions prepared hours in advance, but it is not: this random backdating is a known behaviour of widely used wallet software, meant to protect its users' privacy. One of the backdated transactions spends money that did not yet exist at the time it supposedly indicates.
• Ordering. Inputs and outputs follow a fixed ordering scheme in every transaction. Across 17 transactions with two outputs each, that would be all but impossible by chance.
• Signatures. All signatures carry a property that only software produces which deliberately works towards it when signing.
• Change. The wallet does not generate fresh change addresses. Four addresses are reused two to four times across the chains, and once the change even flows back to the very address the transaction was spending from.
• Fees. The peel transactions pay flat round amounts of 500 or 700 satoshi rather than a fee rate. Incidentally at the level of the block average, not above it.

Taken together, these properties rule out several common wallets. Bitcoin Core, for instance, shuffles inputs and outputs randomly, creates new change for every transaction and does not spend unconfirmed inputs received from others. What remains is software that behaves like Electrum, or a custom script that imitates that behaviour. The flat fees and the pace, 19 transactions in a quarter of an hour on unconfirmed inputs, point rather to the latter. The chain yields no more than that, and we claim no more than that.

Where the tools lead astray

A detail from our own work shows how easy it is to be misled in this kind of analysis. The Coinator's automatic wallet detection, which works by elimination, at first returned three different verdicts for the 19 attacker transactions. For most of them "Bitcoin Core or Electrum", for the two consolidations only "Bitcoin Core", for one transaction "no known wallet". That looked like three different tools.

It was one. The two consolidations have only a single output, from which no ordering can be read, so one candidate dropped out. The odd transaction was the one whose change flowed back to the input address, which the detection treats as an exclusion criterion. Only looking at all 19 transactions side by side, with the same locktimes, the same fee logic and the same reused addresses, made it clear that a single wallet was at work. Wallet fingerprinting works, but it works at the level of the series, not the individual transaction.

What this means for the coming weeks

The 19 addresses are by now listed everywhere, and in the Coinator too they are marked as the attacker's wallet, together with the collection and intermediate addresses. Every investigator and every exchange can watch them. That is precisely why the attackers will abandon them at some point. From then on it is no longer the address list that counts but the handwriting: the combination of locktimes, ordering, fee logic and change behaviour described here. Whoever knows it will recognise the follow-up transactions even when they come from addresses that are on no list at all.

The attribution of the attack to a North Korean hacking group, which several analysis firms now put forward with high confidence, cannot be derived from the Bitcoin trail alone. It rests on observations on other chains and on parallels with earlier cases. We therefore record it as what it is: an attribution by third parties. What the Bitcoin trail does show beyond doubt is the sequence: a withdrawal system working for the wrong person, and a foreign wallet packaging the proceeds. Two signatures, one theft.

Update, 1 November 2026

On 31 October 2026 the FBI publicly named North Korea as responsible for the attack and assigned it to the activity it tracks as TraderTraitor, together with the US Secret Service and IRS Criminal Investigation. The alert lists 19 Bitcoin addresses. They are exactly the 19 destination outputs of the peel chain described here, which the Coinator has carried as the attacker's wallet since 30 October. What was an attribution by third parties has become an attribution by a law enforcement agency.

The Bitcoin trail itself is unchanged. The 18,270 BTC still sit in the 19 addresses, and the conversion of the loot into Ether that the FBI reports concerns the other chains of the attack. The FBI asks operators of swap services, DeFi protocols and analytics platforms to block transactions involving the listed addresses. Source: FBI Cyber Alert, 31 October 2026.