On the evening of October 29, $6.3 billion in assets were withdrawn from Binance's hot wallets. The funds were transferred across ten networks, none of which included TON. TON balances on exchanges that evening and the following day showed no more change than on typical days over the past six months. The largest movement on the network that night was made by Binance itself: three hours after the attack began, it transferred 5.74 million TON and 59.4 million USDT from a hot wallet to a cold wallet.
What Happened with Binance
Around 20:05 UTC on October 29, attackers began withdrawing assets from Binance's hot wallets. A hot wallet is one whose keys are stored on the exchange's servers, from which client withdrawals are processed automatically. According to TRM Labs data, the funds moved across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon.
Binance estimated the damage at approximately $6.3 billion, halted deposits and withdrawals across all networks, and cited a compromised employee laptop as the cause. Approximately $3 billion in stablecoins were frozen by their issuers. The exchange reserved $6.34 billion of its own funds to cover client losses. TRM Labs and Elliptic link the attack to the North Korean group TraderTraitor. Neither Binance nor authorities have confirmed this version yet.
That same night, a list circulated, adding Bybit, Bitget, and Swyftx to Binance, each with about a billion or so in losses. All three exchanges deny the hack. A separate incident occurred that same evening with Polymarket: a malicious script stole about $2.7 million from user wallets, which is unrelated to Binance.
What This Means for TON Holders
TON held in self-custody wallets, whether Tonkeeper, MyTonWallet, or the Wallet in Telegram, is not affected by this attack: the exchange's keys were compromised, not the network. While TON and tokens on Binance's balance cannot be withdrawn currently, this is due to the general halt of withdrawals that the exchange implemented across all networks.
What Binance Did in TON
At 23:01 UTC, Binance's hot wallet sent 5,735,454 TON to address UQD4uGNd…TYCQx. At the same minute, 655 million HMSTR and 2 million CATI were sent there, and at 23:55, 59.4 million USDT, 2.17 billion NOT, and 517 million DOGS followed. Only 3 TON remained in the hot wallet.
The recipient is not an attacker but the exchange's own cold wallet, whose keys are stored offline. This is evident from its history: on October 20, 84.6 million USDT arrived from it to the same hot wallet, on October 27 — 2.57 million TON and 652 million DOGS, and throughout October, the hot wallet transferred excess DOGS, CATI, and HMSTR to it. Currently, it holds about 59.1 million TON. After October 29, it has not sent a single coin.
If keys could have leaked from an employee's laptop, everything in hot wallets is at risk until the keys are replaced. Therefore, the exchange is emptying hot wallets across all networks, including those not affected by the attack. Once the keys are replaced, the TON hot wallet will likely be new.
Exchange TON Balances Over Six Months
Each line represents the total TON in all known wallets of one of the three exchanges with the largest TON holdings. The last two points are October 29 and 30, before and after the attack. Binance's decline in October began long before the hack: on October 1, its wallets held 67.6 million TON, dropping to 59 million by the 29th. During the night of the attack, the lines for the three exchanges did not shift. Binance's transfer from a hot wallet to a cold wallet is not visible here, as both addresses belong to the exchange, and the total amount does not change from such a transfer.
Over the 24 hours of October 29, Binance's TON balance increased by 0.1 million, while Bybit's and Bitget's remained almost unchanged. OKX lost 0.9%, KuCoin 1.8%, and MEXC 2.3%. Kraken saw the largest decrease: 0.51 million TON, or 7.3%. On May 13, 15% of Kraken's balance was withdrawn in a single day, and Binance lost 4 million TON, or 7.6%, on that same day. Bitget lost a third of its TON in a day on May 27.
By the evening of October 30, five out of seven exchanges held the same amount of TON or more than they did on the 29th. Kraken had 6% less, and KuCoin 7% less.
USDT flows on the TON network during those same two days also remained within normal limits. On October 30, Bybit and Bitget saw an increase in USDT, not a decrease: plus 4 million and plus 3.1 million, respectively. Over the previous week, the daily net balance for individual exchanges reached up to 18 million in either direction.
