Binance Hack Timeline: $2.3 Billion Frozen in One Hour

By Tom Whitfield

Tether and Circle began freezing more than $2.3 billion within roughly 30 minutes after researcher Taylor Monahan alerted Tether during the October 29 Binance exploit, according to a minute-by-minute reconstruction. The issuers’ announcements placed the publicly disclosed freeze total above $2.3 billion, with Tether’s figure roughly twice Circle’s.

The attackers moved just after 4 p.m. New York time on October 29, draining wallets across at least four blockchains. At 4:38 p.m., Taylor Monahan of the security collective SEAL contacted Tether after suspecting an exploit. Tether, the issuer of USDT, and Circle, the issuer of USDC, began freezing transactions less than 30 minutes later.

At 5:15 p.m., Binance publicly acknowledged it was aware of a “potential security issue” and said it was investigating. At 5:18 p.m., Circle CEO Jeremy Allaire announced that Circle had frozen more than $800 million tied to a potential Binance exploit. About seven minutes later, Tether CEO Paolo Ardoino announced more than $1.5 billion frozen.

The response combined a multi-chain theft with issuer-specific controls. Tether and Circle could blacklist stolen USDT and USDC on their respective chains, reducing the funds’ transferability and turning a fast-moving drain into a slower one.

How did attackers reach wallet-signing operations?

Binance’s November 3 security report says attackers used a compromised employee computer and the exchange’s internal AI tool on October 20 to take control of two wallet-infrastructure engineers. The report says they then obtained a container deployment permission token.

On October 29, the attackers used that access to penetrate wallet-signing operations through a laptop, not a smart contract. Binance’s investigation did not establish that an AI model autonomously planned or executed the theft.

The sequence identifies privileged access and infrastructure permissions as the operative failure points. It also separates the internal AI tool’s role in the compromise from any claim that an autonomous model designed the theft.

How did the response contain the drain?

Binance assembled a war room that grew to about 100 people worldwide. The exchange coordinated with the FBI and US Secret Service, according to the account, and both agencies are part of the probe into the largest crypto theft on record.

Chainalysis called the incident the largest in crypto history and one of the single-largest financial crimes of all time. TRM Labs global head of policy Ari Redbord characterized the incident more starkly: “It’s the largest bank robbery in human history.”

Issuer blacklists supplied the immediate mechanism for slowing the outflow while investigators pursued the access trail. Each freeze could immobilize exposed balances on the relevant stablecoin chain, allowing Binance and law enforcement to continue tracing the compromised systems.

How much was frozen, and what comes next?

Binance said on October 30 that it could easily reimburse any losses. On October 31, it pledged to reinstate customer withdrawals. Its November 3 report put frozen or intercepted assets at about $2.85 billion of the $6.34 billion affected.

The exchange also said it had rebuilt the affected infrastructure and commissioned an independent cybersecurity review. The reimbursement pledge shifts the immediate customer-reimbursement burden to Binance while the review addresses the access and infrastructure weaknesses behind the breach.

The next material checkpoint is the independent cybersecurity review and any findings from the FBI and US Secret Service probe. No deadline was disclosed for either process.