Binance hack: What happened and where the $6.3 billion went

Home → Feature → Binance hack: What happened and where the $6. 3 billion went Binance hack: What happened and where the $6.

3 billion went By Rony Roy Oct 30, 2026 at 10:26 AM UTC Edited by Olivia Stephanie Feature Share Link copied Binance has promised to cover every customer loss after a breach it estimates affected $6. 3 billion.

Its recovery effort now involves several different processes, from stablecoin freezes to tracing assets that no token issuer can block. Summary Binance estimates that the October 29 breach affected approximately $6. 3 billion. The exchange says partners have frozen roughly $3 billion in affected assets.

TRM Labs traced transfers across 10 blockchains and values the original outflows at $6. 36 billion. Blockaid identified 50 Ethereum authorizations in a transaction targeting Binance 14. Binance has pledged to cover losses through 2 sources, its SAFU fund and company funds. Binance has estimated that $6.

3 billion in cryptocurrency was affected by its October 29 breach and pledged to cover all losses while partners have frozen roughly $3 billion.

Binance’s security update says its preliminary investigation points to a compromised DevOps engineer’s laptop that may have allowed access to an internal service container and the submission of unauthorized withdrawals. JUST IN: Analysts link the $6.

3B Binance exploit to North Korea’s hacking network TRM Labs, Chainalysis and Singapore’s Pangolin Intelligence reportedly point to a DPRK-linked group, while claims that the attacker moved some stolen funds through Aave to borrow ETH raise… pic. twitter. com/r10QO8MChb — crypto.

news (@cryptodotnews) October 30, 2026 The exchange says it has found no evidence that wallet private keys leaked. It has revoked the affected address authorization, involved law enforcement and promised a technical report after investigators finish establishing what happened.

Blockchain investigators have published separate accounts of the transfers. Their figures describe different stages of the incident and use different scopes, with some counting the value when assets left Binance and others describing assets that were subsequently frozen.

The $3 billion freeze figure therefore sits alongside the $6. 3 billion estimate. Binance has not described $3 billion as money already returned to customers, nor has it published a final accounting of its own financial loss after recoveries.

The Binance hack reached several networks within minutes According to TRM Labs , the main burst of transfers began at approximately 20:05 UTC on October 29 and moved most of the stolen funds within about 20 minutes.

Its investigation covers 10 networks, with a further wave reaching Avalanche and Polygon later that evening. TRM’s estimate values the assets at the time of each transfer. Binance’s $6.

3 billion figure is the company’s estimate of the incident’s impact, so the difference between the two totals does not by itself establish that investigators found another theft. The firm attributes the attack to North Korea’s TraderTraitor group using on-chain and off-chain intelligence.

Binance has not confirmed the attacker’s identity, and the attribution remains the investigators’ assessment. As crypto. news previously reported, the initial attribution and tracing connected the incident with a hacking unit previously identified by the FBI in the February 2025 Bybit theft.

A technical attribution and a criminal finding are separate stages, even when investigators express high confidence. The transfers involved assets with very different recovery options.

Dollar tokens can have issuer controls, while native Bitcoin and Ethereum do not give a stablecoin company a comparable power to blacklist a holder’s balance. An address appearing in the tracing record can consequently be a useful lead without being a recoverable balance.

Investigators can follow public transfers after an attacker changes wallets, but the ability to observe a movement does not automatically give anyone authority to reverse it.

One Ethereum authorization changed what a hot wallet could do Blockaid’s technical investigation describes an attack on Binance 14, a busy Ethereum hot wallet. A transaction contained 50 EIP-7702 authorizations, with one matching the account’s transaction counter and activating a delegation to malicious code.

The researchers say the attacker subsequently used the delegated wallet to transfer a large basket of assets and reached another smart account controlled by that wallet. The malicious delegation could remain useful for later deposits until it was removed.

The wallet authorization mechanism has already been examined in the publication’s technical coverage. Its role in this incident was to let code operate in the context of an existing wallet after the required authorization had been accepted.

Ethereum’s EIP-7702 specification describes persistent delegation, not permission that necessarily disappears after a single transaction. It warns that delegated code has unrestricted access to the account and must be closely audited by wallet providers.

The distinction explains why removing the affected authorization belongs in the response alongside stopping withdrawals. A pause in an exchange’s customer interface and the removal of an on-chain delegation address different parts of the same incident.

Blockaid describes other transfers as ordinary signed transactions from wallets on several networks. Its findings do not establish that every dollar left through the Ethereum delegation, and a single Ethereum feature cannot account for Bitcoin or Tron transfers by itself.

Binance’s preliminary statement and the investigators’ technical account address different questions. The exchange describes a possible route into its systems, while the researchers describe what authorized transactions did on-chain. The full investigation still has to connect those stages.

The exchange’s statement that it has not found a private-key leak does not mean tha