On 29 October 2026, Binance suffered a breach now estimated at about $6.3 billion, the largest crypto theft on record. This timeline puts the day in order, using only what has been publicly reported so far. One honest caveat comes first: no full minute-by-minute internal log has been published. The one precise public timestamp in this story is an on-chain one, and the rest of the day is best described as a sequence of confirmed stages rather than a clockwork diary.

The breach itself

According to Binance's own preliminary account, the attack began with a compromised laptop belonging to a DevOps engineer. From there, the attacker reached a service container and submitted unauthorised withdrawal transactions. Binance has said there is no evidence so far of a wallet private-key leak, which matters because it points to abused system access rather than stolen keys. The central wallet in the theft was Binance 14, a hot wallet that had appeared in Binance's 1 October proof of reserves.

The on-chain timestamp: 20:24 UTC

The clearest time marker comes from Etherscan data reported after the breach. At 20:24 UTC, 167,464 ETH moved from Binance 14 and 28,005.6 ETH moved from Binance 16 to an attacker-controlled wallet. Around 204,500 ETH was taken from Binance 14 in total, cutting Binance's ETH backing from 100 percent to about 94 percent until the missing assets are replaced. These movements are the hard evidence around which the rest of the day's story is built.

Suspension and the market reaction

As the scale became clear, Binance suspended deposits and withdrawals while it secured affected systems and revoked the affected address's authorisation. The market reacted fast: bitcoin fell below $77,000 and more than $1 billion in leveraged positions were liquidated. The price fall was not a direct theft of bitcoin from holders; it reflected forced selling and panic across the wider market as news of the breach spread.

Freezes and the cover pledge

Within the first day, about $3 billion was frozen, including more than $1.567 billion in USDT frozen by Tether, about $823 million in USDC frozen by Circle, about $200 million frozen by Ripple, and $27 million in USD1 frozen by World Liberty Financial. Co-CEO Yi He said all losses would be covered from company funds and the SAFU emergency fund, worth about $1 billion in bitcoin, and that user funds are safe. Yi He also said withdrawal resumption was expected to begin within about 48 hours.

What comes next

Attribution is still an investigators' claim, not a court finding: TRM Labs has linked the attack with high confidence to North Korea's TraderTraitor unit. The next firm checkpoint is 1 November 2026, when Binance's next proof-of-reserves snapshot is due and should show whether stolen assets have been replaced. Until then, every total from 29 October should be read as preliminary.

Frequently asked questions

FAQ: What is the one exact time known from 29 October? The 20:24 UTC Etherscan movements from Binance 14 and Binance 16. Was a full minute-by-minute timeline published? No, the internal sequence has not been released in that form. What should readers watch next? Official Binance announcements and the 1 November 2026 proof-of-reserves snapshot.