Binance's $6.36B hack, traced onchain

Market News

News: Binance loses $6.36B in the largest crypto theft on record

TRM Labs · CoinDesk · Oct 30 to Nov 2

• $6.36B left Binance wallets on 10 chains on Oct 29, most of it in about 20 minutes
• TRM attributes it to North Korea's TraderTraitor; nearly $2.7B was frozen, ~$2.4B sits in ETH and BTC
• Withdrawals reopened Nov 1: $4.65B out vs $1.01B in over the first ~9.5 hours; Binance says it replenished ~95%

For analysts: wallet outflows are not customer withdrawals. DefiLlama saw $6.1B leave Binance-linked wallets in 24h, which can include internal transfers.

Sources: TRM Labs · CoinDesk · CoinDesk live

News: ETF investors pull back after the hack

Farside · SoSoValue · Oct 30 to Nov 2

• US spot BTC ETFs lost $643.2M on Oct 30, the largest daily outflow in more than 4 months
• Another $398.6M left on Nov 2; IBIT alone saw ~$405.3M in redemptions
• Spot ETH ETFs lost $1.61B in October, their biggest month of outflows since launch

For analysts: one fund drove Nov 2. Check per-issuer flows before reading a total as a broad exit.

Sources: Farside · Crypto News AU · CoinDesk

New: Blockchain Data Engineering Guide

The Blockchain Data Engineering Guide is out

Become the data engineer crypto companies are hiring for: from how raw chain data is shaped to tested, queryable models, with code you can run.

125 pages, 22 hands-on exercises, 7 end-to-end projects and a private GitHub repo. PDF, ePub and Markdown.

Launch price until Nov 17.

Onchain Data News

News: TRM traces how the Binance proceeds are laundered

TRM Labs · Nov 3

• On TRON: a self-minted token and pool let stolen funds change hands with no direct transfer
• Lending receipt tokens moved value between wallets, out of sight of USDT-only traces
• Chained cross-chain swaps; funds now move on TRON and Solana, the big ETH and BTC balances sit parked

For analysts: trace receipt and pool tokens, not just stablecoins, and screen several hops out.

Sources: TRM Labs · Decrypt · CoinDesk

News: GoldRush MCP lands in Claude's connector directory

Covalent GoldRush · Oct 29

• 37 tools: 28 blockchain data tools on 65 chains plus 9 protocol analytics tools
• The analytics tools refuse mismatched comparisons
• Also works at its MCP endpoint with ChatGPT, Grok, Claude Code and Cursor

For analysts: pair it with the new with-classification flag (Oct 22), which labels transactions by action.

Sources: Changelog · Classification

Chart of the Week, powered by Allium

Chart: Binance net flows by chain

Daily net flow in USD, Oct 25 to Nov 1

Caption: Allium · Binance daily net flow by chain (USD) · below zero means money leaving Binance · transfers between Binance's own wallets excluded · Other: Arbitrum, Avalanche, Base, Optimism, Plasma, Polygon, Linea, HyperEVM

• Ethereum carried most of it: about $4.3B of daily net flow (counted in absolute terms) over the 8 days, vs Tron $1.25B, BSC $1.1B and Solana $0.52B
• Nov 1, withdrawals reopen: the biggest day, about $3.33B net out, led by Ethereum ($2.66B) with BSC joining ($864M). USDT + USDC alone were about $2.85B net out, almost all USDT
• Tron mattered around the hack: Oct 29 was about $750M net out (Ethereum $584M, Tron $159M), then Oct 30 about $590M came back in, led by Tron ($290M) and Ethereum ($177M)
• Before the hack, Oct 25 to 28: steady net outflows, stablecoins about $130M to $630M a day, mostly Ethereum and Tron

Why it matters: this is the net flow of Binance-labeled wallets, not the $6.36B TRM says was stolen (Market News). The two measure different things and only agree in direction: the big exit came when withdrawals reopened, not on hack day.

Data stops at Nov 1 (Nov 2 and 3 not yet published). No Bitcoin: token transfers on chains like Ethereum and Tron only. Chart values were typed in from Allium's curated metric and rounded, so treat USD figures as approximate.

Jobs of the week

4 picks from 345+ open roles.

Job: Senior Data Scientist, Platform

Coinbase · Remote US · $180k–$212k

Job: Senior Risk Analyst, Payments Risk Ops

Coinbase · Remote US · $180k–$212k

Job: VP, Data Engineer (KDB Developer)

Galaxy · Mumbai · Competitive

Job: GM, Head of Data

Coin Metrics (Talos) · London / New York · Competitive

WizardCamp · Solana

Is Solana's failure rate 25% or 44%?

Caption: Exercise sample: 140 mainnet blocks, Aug 24–30, 2026

• The failed count covers non-vote (app) transactions, but votes are about half of all transactions
• Divide by the wrong total and the failure rate drops by almost half
• Puzzle: daily failed share of non-vote transactions, from blocks only

Catch: sum per day first, then divide, and guard against a zero denominator.

blocks(slot, block_date, total_transactions,
  total_vote_transactions,
  total_non_vote_transactions,
  failed_non_vote_transactions)
-- expected: block_date | failed_transactions
--   | non_vote_transactions | failed_share_pct

Next, in Pro: the share of Solana transactions that set a priority fee. Pro is $15/month, or $12/month billed annually.

Service highlight

Fractional Head of Data by Vincent Charles

Your Web3 data lead, without the full-time hire

Data strategy, KPIs, stack architecture and team mentorship from a former Binance and Morpho data lead. Plus hands-on pipelines, indexing, BI dashboards and executive reporting.

Strategy and the hands-on data engineering, all in one, from the same person.

• Advisory: Data Strategy Audit · Web3 OKR Strategy · Advisory Call
• Data services: Dune Dashboards · Onchain Pipelines · Product Analytics · Web3 Attribution · Web3 SEO

Join the community

Join CryptoDataWizards

• Our Telegram community of onchain data professionals
• Ask questions, share queries, discuss anything onchain