Within half an hour of the main sweep, Telegram channels were guessing at North Korea. About an hour after it, a channel offered “stolen funds” for sale. The attacker’s name took far longer.
Analysts named TraderTraitor in the early hours of 30 October. Most Telegram channels in our data repeated the name only after 06:00 UTC, almost four hours after TRM Labs published it, and most of them cited TRM Labs.
We read 668 hack-related posts in Brandefense Blackhole, almost all on Telegram, and 2,255 posts on X from 1,799 accounts. Both sets run from the evening of 29 October to the morning of 30 October (UTC). This piece looks at how the story moved and who tried to profit from the gaps. The on-chain trace, the loss estimates and the freezes are in our Binance security incident report.
- 8 minTime for the first outflow figure to reach 10 Telegram channelsSource: Brandefense Blackhole and X data, 29 Oct 20:00 to 30 Oct 08:00 UTC
- 69Telegram channels that carried Binance’s laptop statement by 07:53 UTCSource: Brandefense Blackhole and X data, 29 Oct 20:00 to 30 Oct 08:00 UTC
- 3% to 31%Share of hack posts framing North Korea, before and after the first analyst attribution on XSource: Brandefense Blackhole and X data, 29 Oct 20:00 to 30 Oct 08:00 UTC
- 1.53MViews on X for accounts relaying the attribution, against 191,000 for the original postsSource: Brandefense Blackhole and X data, 29 Oct 20:00 to 30 Oct 08:00 UTC
Who Carried the Story on Telegram
The attacker’s main sweep from the Binance Ethereum hot wallet landed at 20:24 UTC on 29 October. At 20:38 a Russian-language crypto news channel posted the first relay we saw: about $2.77 billion had left the exchange across five blockchains, and a hack was not yet confirmed. That figure reached 10 channels in about 8 minutes.
The 21:00 UTC hour was the peak. Blackhole logged 258 posts naming Binance in that hour, about nine times its October hourly average. Of the 668 hack posts, 58% were mainly in Cyrillic script, 31% in Latin script and 10% in Chinese. In the first hour, about half came from channels we classed as general or finance news, not from crypto or hacker communities.
Many of these relays posted near-identical text within minutes. Our earlier look at how criminals use Telegram channels describes the same relay model. A Chinese-language layer started later, at 21:14 UTC, and grew in the Asian morning.
Facts Spread as Far as the Channels Awake to Carry Them
Binance posted its statement on the likely entry point, a compromised DevOps engineer’s laptop, at 02:25 UTC. That is 05:25 in Moscow. Only 34 channels posted anything about Binance in the hour that followed. The three fastest evening claims had 118 to 125 active channels in their first hour.
The statement still reached 5 of those 34 channels within an hour, a 15% share. Most evening claims reached 11 to 20% of the channels active in their first hour. The freeze news reached 34%.
By 07:53 UTC the laptop statement had reached 69 channels in 77 posts. That is more than twice the reach of the first outflow figure.
The language mattered as much as the hour. Cyrillic-script channels carried the laptop statement in 52 channels and Chinese-script channels in 12. Latin-script channels carried it in only 5 by 07:53 UTC.
Between 02:25 and 04:00, 34 Latin-script channels posted about Binance, and only 2 posts among them mentioned the laptop. A correct fact reached the layers that chose to repeat it.
The Underground Guessed North Korea, Then Waited for a Name
At 20:48 UTC, 24 minutes after the sweep, a Russian-language tech chat said people online suspected a North Korean trace. Three minutes later the news channel of a Russian-language underground forum gave a reason. It said the address paying the transaction fees was linked to Tornado Cash and compared the case with the Bybit theft of February 2025.
That guess rested on familiar signs, not inside knowledge. Before the first public analyst attribution on X in our sample, at 02:42 UTC, only 13 of 413 hack posts (3.1%) framed North Korea. After it, 79 of 255 did (31%).
The name itself moved slowly. TRM Labs dated its report on TraderTraitor 02:10 UTC. In Blackhole the name first appeared at 04:00 UTC, in a Russian-language channel citing TRM Labs.
Before 06:00 it appeared in 4 posts, although 65 to 82 channels were posting about Binance each hour. Then 25 posts followed by 07:53. Of the 29 posts naming the group, 19 cited TRM Labs and 4 cited Reuters.
The channels were active, so the delay does not fit a sleeping audience. It fits relays waiting for a news outlet their readers would recognise. There is a second reading: the rise starts at 09:00 Moscow time, and most of these posts came from general and finance news channels whose working day may start then.
One night of data cannot separate the two. North Korea’s role has not been confirmed by any government as of this writing. The US advisory on TraderTraitor from 2022 describes the group’s earlier targeting of crypto firms.
On X, Relays Outran the Sources
On X, accounts that repeated the attribution collected about 1.53 million views. The original analyst and company posts in our sample collected about 191,000. Of the relays, 39% named no source at all.
Figures were also recast. An on-chain count of 18,270 BTC first appeared in our X data at 22:00 UTC on 29 October. At 06:45 the next morning it was being shared as “North Korea’s Lazarus Group adds 18,270 bitcoin”. The number had appeared hours before any analyst named an attacker.
Chinese- and Vietnamese-language channels aimed at Southeast Asia show the same pull toward a name. They carried 49 Binance posts in 19 channels. Of those, 18 (37%) framed the hack as North Korean, against at most 17% in any other channel type. Many of their posts came bundled with gambling, USDT exchange and remote job ads.
What Filled the Gap Before the Facts
For six hours there was no statement on how the attacker got in. Others filled that gap. At 21:25 and 21:41 UTC, 61 and 77 minutes after the sweep, two English-language Telegram channels offered “stolen Binance funds” for a fraction of their face value.
Our incident report describes one of these offers. Its terms match a common advance-fee scam.
The attacker’s name became a product on X. After the TRM Labs report reached news accounts on X at about 04:12 UTC, the ticker $TRADERTRAITOR appeared in 83 posts from 55 accounts between 04:44 and 07:59. Those posts promoted seven different token contracts on three chains. Of the accounts pushing the ticker, 35% were created in 2025 or 2026, against 18% of all authors in our X sample.
Other lures were narrow. Three X accounts presented themselves as fund recovery services. A post with 77,000 views told users that a “Grok bot” could act for them if they connected an exchange API key with withdrawal rights.
Warnings were far more visible. About 176 X posts from 149 accounts warned about fake support, refunds and recovery offers, starting at 21:28 UTC. They appeared in Chinese, Turkish, Indonesian, Spanish and French as well as English.
Post by @CoinMarketCap on X, 30 October 2026, 04:54 UTC.
CoinMarketCap, which Binance owns, told users it “will never DM you asking for wallet details”. Those warnings tell us where lures were expected: private messages and fake support accounts, not public posts. Trade in Binance accounts did not move. Blackhole showed about 4.9 “Binance account” posts a day in October, then 5 on 29 October and 4 on 30 October.
What to Prepare Before the Next Exchange Incident
For an exchange, a wallet provider or a fintech brand, four steps follow from these 12 hours.
- Send the scam warning with the first notice. The first “stolen funds” offer came about an hour after the sweep. The cause came six hours later. A pre-approved line on fake refunds, fake support and recovery offers can go out before any facts are known.
- Own the translation and the framing. Russian- and Chinese-language relays translated the laptop statement themselves, and 37% of the Southeast Asia posts carried a North Korea frame. Publish key facts in those languages yourself. Reach Latin-script channels directly too, since they barely carried the statement.
- Give every attribution a citable source. Telegram repeated the TraderTraitor name mostly after 06:00 UTC, citing TRM Labs or the media that reported it. On X, 39% of relays dropped the source. A named, linkable source travels; an unsourced claim gets recast.
- Treat the attacker’s name and the incident’s words as brand terms. Seven tokens were promoted under one hack-themed ticker within hours. Watching new tokens, accounts and channels that use the incident’s words is the same work as brand impersonation takedown.
How We Built This Picture
Blackhole covers Telegram channels, forums and Discord indexed by Brandefense. We searched it from 29 October 20:00 to 30 October 07:53 UTC for Binance in Latin, Cyrillic and Chinese script. We compared it with October data.
X data is 2,255 unique posts from three collections. Most searches hit their result cap, so early hours are under-sampled and view counts are snapshots.
Channel types, narrative groups and the North Korea framing are our classification. One night of data cannot separate time-of-day effects from a story losing steam. Handles, links and wallet addresses are withheld.