Binance has promised to cover every customer loss after a breach it estimates affected $6.3 billion. Its recovery effort now involves several different processes, from stablecoin freezes to tracing assets that no token issuer can block.
Summary
- Binance estimates that the October 29 breach affected approximately $6.3 billion.
- The exchange says partners have frozen roughly $3 billion in affected assets.
- TRM Labs traced transfers across 10 blockchains and values the original outflows at $6.36 billion.
- Blockaid identified 50 Ethereum authorizations in a transaction targeting Binance 14.
- Binance has pledged to cover losses through 2 sources, its SAFU fund and company funds.
Binance has estimated that $6.3 billion in cryptocurrency was affected by its October 29 breach and pledged to cover all losses while partners have frozen roughly $3 billion.
Binance’s security update says its preliminary investigation points to a compromised DevOps engineer’s laptop that may have allowed access to an internal service container and the submission of unauthorized withdrawals.
The exchange says it has found no evidence that wallet private keys leaked. It has revoked the affected address authorization, involved law enforcement and promised a technical report after investigators finish establishing what happened.
Blockchain investigators have published separate accounts of the transfers. Their figures describe different stages of the incident and use different scopes, with some counting the value when assets left Binance and others describing assets that were subsequently frozen.
The $3 billion freeze figure therefore sits alongside the $6.3 billion estimate. Binance has not described $3 billion as money already returned to customers, nor has it published a final accounting of its own financial loss after recoveries.
The Binance hack reached several networks within minutes
According to TRM Labs, the main burst of transfers began at approximately 20:05 UTC on October 29 and moved most of the stolen funds within about 20 minutes. Its investigation covers 10 networks, with a further wave reaching Avalanche and Polygon later that evening.
TRM’s estimate values the assets at the time of each transfer. Binance’s $6.3 billion figure is the company’s estimate of the incident’s impact, so the difference between the two totals does not by itself establish that investigators found another theft.
The firm attributes the attack to North Korea’s TraderTraitor group using on-chain and off-chain intelligence. Binance has not confirmed the attacker’s identity, and the attribution remains the investigators’ assessment.
As crypto.news previously reported, the initial attribution and tracing connected the incident with a hacking unit previously identified by the FBI in the February 2025 Bybit theft. A technical attribution and a criminal finding are separate stages, even when investigators express high confidence.
The transfers involved assets with very different recovery options. Dollar tokens can have issuer controls, while native Bitcoin and Ethereum do not give a stablecoin company a comparable power to blacklist a holder’s balance.
An address appearing in the tracing record can consequently be a useful lead without being a recoverable balance. Investigators can follow public transfers after an attacker changes wallets, but the ability to observe a movement does not automatically give anyone authority to reverse it.
One Ethereum authorization changed what a hot wallet could do
Blockaid’s technical investigation describes an attack on Binance 14, a busy Ethereum hot wallet. A transaction contained 50 EIP-7702 authorizations, with one matching the account’s transaction counter and activating a delegation to malicious code.
The researchers say the attacker subsequently used the delegated wallet to transfer a large basket of assets and reached another smart account controlled by that wallet. The malicious delegation could remain useful for later deposits until it was removed.
The wallet authorization mechanism has already been examined in the publication’s technical coverage. Its role in this incident was to let code operate in the context of an existing wallet after the required authorization had been accepted.
Ethereum’s EIP-7702 specification describes persistent delegation, not permission that necessarily disappears after a single transaction. It warns that delegated code has unrestricted access to the account and must be closely audited by wallet providers.
The distinction explains why removing the affected authorization belongs in the response alongside stopping withdrawals. A pause in an exchange’s customer interface and the removal of an on-chain delegation address different parts of the same incident.
Blockaid describes other transfers as ordinary signed transactions from wallets on several networks. Its findings do not establish that every dollar left through the Ethereum delegation, and a single Ethereum feature cannot account for Bitcoin or Tron transfers by itself.
Binance’s preliminary statement and the investigators’ technical account address different questions. The exchange describes a possible route into its systems, while the researchers describe what authorized transactions did on-chain.
The full investigation still has to connect those stages. The exchange’s statement that it has not found a private-key leak does not mean that every transaction approved by its signing infrastructure was intended by the company.
Frozen funds and returned funds belong in separate totals
Binance says approximately $3 billion has been frozen through cooperation with industry partners. A freeze restricts movement of the affected assets, while recovery requires a further step that returns value to the rightful owner or to an agreed recovery address.
Using the exchange’s rounded figures, $3 billion divided by $6.3 billion equals approximately 47.6%. The remaining difference is $3.3 billion, or 52.4% of the initial estimate.
Those calculations describe the relationship between Binance’s two announced numbers. They do not establish that $3.3 billion has disappeared beyond recovery, or that the entire frozen balance can immediately be used to reimburse customers.
The denominator can change as investigators identify transfers, remove double counting or update prices. The numerator can change as issuers locate more tokens or authorities authorize a recovery transaction.
TRM’s early account put frozen or secured assets at roughly $2.7 billion, below Binance’s subsequent estimate. Its figures were a dated tracing snapshot, and the company’s later total should not be added to it as though they describe separate pools.
The same caution applies to issuer announcements. A Tether freeze and a Circle freeze can be components of Binance’s aggregate, so adding both to the exchange’s total would count some assets twice.
Stablecoins that were exchanged before an issuer acted introduce another complication. A dollar token’s issuer may be able to block that token, but its controls do not follow the holder into a different native asset automatically.
Recovery accounting therefore needs both the token balances and their status. Assets identified, assets immobilized, assets transferred into recovery custody and assets used to restore customer balances are four different descriptions.
Binance has named company funds alongside SAFU
Binance’s commitment is to cover losses using its Secure Asset Fund for Users and company resources. It has not said that SAFU alone will absorb the entire incident.
The fund’s earlier Bitcoin reserve conversion was completed in February, when Binance reported 15,000 BTC worth approximately $1.005 billion at the time. The conversion announcement described a historical balance and valuation, not a fresh October statement of available insurance resources.
Even a hypothetical $1 billion fund would cover only 15.9% of a $6.3 billion gross incident. Subtracting $1 billion from $6.3 billion produces $5.3 billion, but that arithmetic is not an estimate of Binance’s actual funding gap because recoveries and the current fund balance remain separate inputs.
The exchange’s choice to include company funds is consequently part of the promise itself. Customers have been told that Binance will bear the loss, rather than being told to wait until investigators retrieve every stolen token.
The pledge does not identify the precise mix of cash, cryptocurrency or other company resources that will be used. It does not establish the timing of any issuer-controlled recoveries or the accounting treatment of the frozen balances.
Customer reimbursement and the company’s ultimate net loss can move on different schedules. Binance can replace a missing customer asset from its own resources before the original asset is recovered, leaving the company to pursue recovery afterward.
If an issuer later returns an asset that has already been replaced, that recovery would affect Binance’s own financial exposure. It should not be counted as a second reimbursement of the same customer loss.
A reserve update will provide a dated view of backing
Binance has promised an updated proof of reserves after remediation. Its August reserve snapshot reported reserve ratios of 100.25% for Bitcoin and Ethereum, with a higher ratio for USDT.
An August ratio cannot establish the exchange’s backing after an October incident. The customer balances, reserve holdings and affected assets need to be measured at the new snapshot date.
The publication’s examination of exchange reserve reporting practices explains that these systems compare covered assets with covered customer balances. They do not automatically include every corporate liability or establish that controls function continuously between snapshots.
A ratio above 100% means the assets included in that calculation exceed the corresponding customer balances included in it. It does not measure the quality of a withdrawal system or show how an attacker obtained a valid authorization.
Binance’s promised reserve update and technical post-mortem therefore serve different purposes. The former can document backing at a stated time, while the latter is intended to explain the compromise and the steps taken to close the route used by the attacker.
The same asset should not be presented as both freely available withdrawal liquidity and immobilized recovery property without explaining its status. Frozen tokens may retain a quoted dollar value while remaining unavailable for ordinary customer withdrawals.
The reimbursement promise leaves the recovery timetable open
Binance’s strongest stated response is its commitment to cover all losses, backed by both SAFU and company funds. The reported freezes give the recovery effort an identified pool of assets that attackers cannot freely move under the applicable controls.
Neither commitment supplies a final loss figure. Binance has yet to publish the full reconciliation between stolen assets, frozen balances, returned assets and company resources committed to replacing customer funds.
The public record contains a changing operational status as well. The initial security notice described a pause in deposits and withdrawals, while subsequent reporting described deposits as operational and withdrawals subject to further security work.
The notices belong to their respective publication times. A customer’s ability to withdraw depends on the current service notice for the relevant network, not on whether another network has resumed operations.
A resumption estimate is a company target until the service is actually restored. It is not a deadline requiring every customer to act, and Binance’s examined security statement does not impose a universal customer withdrawal window.
The technical report will address the preliminary entry point
The exchange’s reference to a compromised laptop remains preliminary. Its statement identifies a possible path from an engineer’s device to an internal container, but does not publish a completed explanation of how the attacker obtained each authorization across the affected networks.
Blockaid’s analysis offers evidence about Ethereum execution, while TRM’s investigation covers transfers and attribution across a larger set of networks. Their work does not replace Binance’s promised account of internal access controls.
Binance.US, the exchange’s separate American affiliate, said its operations were not affected by the incident.
What to watch
Returned assets: A confirmed transfer into recovery custody would establish a different status from an issuer freeze.
Withdrawal notices: Network-specific service updates will establish which withdrawals have actually resumed.
Reserve snapshot: The date, covered assets and treatment of frozen balances will define what the new report establishes.
Technical post-mortem: The final account should connect internal access, signing authorization and the on-chain transfers.
Loss reconciliation: Binance’s disclosed contribution and recovered assets will determine its eventual financial exposure.
FAQ
How much does Binance say was affected?
Binance estimates approximately $6.3 billion. TRM’s separate tracing valued the original transfers at approximately $6.36 billion using prices at the time they left.
How much has been frozen?
Binance says roughly $3 billion. Using the exchange’s rounded figures, that is approximately 47.6% of the estimated impact.
Does frozen mean recovered?
No. The $3 billion figure describes assets whose movement has been restricted, while an actual return or recovery requires a further step.
Will customers bear the loss?
Binance has pledged to cover all losses from SAFU and company funds. Its statement names 2 funding sources without publishing their final contributions.
Did the attacker steal a private key?
Binance says it has found no evidence of a wallet private-key leak. Blockaid identified 50 EIP-7702 authorizations in the Ethereum attack, but the complete internal compromise remains under investigation.
Was every transfer made through EIP-7702?
No. Blockaid described other ordinary signed transfers, and TRM traced outflows across 10 networks, including Bitcoin and Tron.
Can the February SAFU balance be treated as current?
No. The reported 15,000 BTC balance and its February valuation belong to that earlier announcement, not a new October reconciliation.
What has Binance promised to publish next?
Binance has promised an updated reserve report and a technical post-mortem, 2 disclosures addressing backing and the compromise respectively. This is educational analysis, not investment advice.
Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. Figures reflect regulatory filings and reporting available at the time of writing and change with each disclosure. Nothing here is a recommendation to buy, sell, or hold any security or asset. Always do your own research. Information is accurate as of October 30, 2026.
