Binance has called it a security incident. By the estimates of the blockchain analytics firms that tracked the money, it is the largest theft in the history of crypto. Either way, the events of 29 to 31 October 2026 are a live test of a question that rarely gets an answer under pressure: when a large exchange loses billions from its own wallets, who actually carries the loss? All figures below were checked on 31 October 2026, and several are still moving.
What Binance has said so far
Binance’s account has changed as its investigation has gone on, which is normal in the first days of an incident but worth tracking closely. In a support announcement on 30 October it said its initial investigation pointed to a compromised DevOps engineer’s laptop, which let an attacker reach a service container and submit unauthorised withdrawals. It put the loss at about $6.3bn, said roughly $3bn had been frozen on-chain and said it had found no evidence of a wallet private key leak.
A second update, signed by co-CEOs Yi He and Richard Teng, gave the start time as 20:05 UTC on 29 October and widened the scope: the incident “may involve a compromised laptop”, but the investigation had “uncovered additional points of breach”. Teng, quoted by Decrypt, said an EIP-7702 delegation on Ethereum “did not pass through our normal approval controls”. By 31 October Binance said it had replenished 90% of the stolen assets and expected to reopen withdrawals on Sunday 1 November.
The shift from “one laptop” to “additional points of breach” matters. A single compromised device is a containable story. Several points of failure raise questions about how approval controls are designed, which is the part other exchanges and custody start-ups will want to study once the promised post-mortem appears. Binance has not given a date for it.
How much of the money can be frozen
The outside estimates of the total are close to Binance’s own: TRM Labs counts $6.36bn across ten blockchains, moved mostly within about 20 minutes, and Chainalysis about $6.4bn. Where they differ more is on recovery. Binance says about $3bn has been frozen, Chainalysis about $2.8bn and TRM Labs about $2.7bn, of which TRM attributes about $1.77bn to Tether and about $825m to Circle.
The split is instructive. Stablecoins issued by a company with a freeze function could be stopped within minutes or hours. Native assets could not: TRM Labs estimates that about $2.4bn, including 18,270 BTC and more than 420,000 ETH, is beyond any issuer’s reach. For investors, this is a reminder that “on-chain transparency” and “recoverability” are different properties. A treasury held largely in freezable stablecoins is, in a theft, a very different risk from one held in bitcoin.
It also puts a small number of private companies in a quasi-public role. Circle’s chief executive said the freeze was done “in coordination with law enforcement”. CoinDesk reported that experts are divided over how quickly issuers acted here compared with other cases. Founders building on stablecoins should assume that issuer discretion is part of their risk model, in both directions.
Who pays: the balance sheet behind the promise
Binance’s central commitment is that users will not bear the loss: “Binance will absorb the financial impact of these stolen funds, not our users,” it said on 30 October. It said it had set aside more than $6.34bn of company funds, $5bn of it already held in the exact tokens taken. On 31 October it said the money came from part of its SAFU user-protection fund, part of its futures insurance fund and its corporate treasury.
The SAFU fund on its own could not have covered this. Binance completed converting SAFU into 15,000 BTC in February 2026, worth about $1bn at the time, The Block reported. Our rough arithmetic: at the $76,664 bitcoin price The Block recorded on the night of the hack, 15,000 BTC is about $1.15bn, under a fifth of the loss. Most of the cover therefore had to come from the company’s own treasury.
That is the real lesson for anyone assessing a trading venue or a custodian. An insurance fund is a headline. What protects customers in a tail event is the size and liquidity of the operator’s own balance sheet, and its willingness to use it. Few firms in the industry could replace $6bn in tokens within 48 hours. Investors in smaller venues should ask directly what would happen at one-tenth of this scale.
Attribution, and the regulators’ response
TRM Labs attributes the theft “with high confidence” to TraderTraitor, a group it describes as linked to North Korea, and Chainalysis reaches the same conclusion. These are the assessments of private firms. The Block reported that the attribution came from blockchain investigators rather than from Binance. The FBI said it was “aware of the incident and is engaged with relevant public and private partners”, according to Nextgov. We found no government statement confirming who was responsible.
There is a precedent for official attribution. In February 2025 the FBI publicly attributed the theft of about $1.5bn from the exchange Bybit to North Korea’s “TraderTraitor” activity and published addresses for the industry to block. In December 2025 Chainalysis estimated that North Korea-linked actors stole at least $2.02bn in 2025.
The policy timing is awkward for the industry. On 5 October the CFTC announced an advance notice of proposed rulemaking on retail crypto transactions, published in the Federal Register on 13 October with a 60-day comment period. In a television interview reported by The National, CFTC chair Michael Selig said the hack “proves our exact point”. Abu Dhabi’s Financial Services Regulatory Authority, which oversees Binance’s global platform, said it was “engaging closely with Binance and monitoring the incident”.
What it means for founders and investors
Three practical points stand out, even before the post-mortem.
- Approval controls are the attack surface. Binance’s own account points to a delegation that bypassed normal approvals, not to broken cryptography. Teams running hot wallets should review how new smart-account features such as EIP-7702 interact with their signing policies.
- Recoverability depends on what you hold. Freezable stablecoins limited the damage here. Native assets did not. Treasury policy is a security decision.
- Proof of reserves is a trust tool, not a guarantee. Binance has promised a new zero-knowledge proof of reserves. It will show whether assets match liabilities at a point in time. It will not, by itself, show how the breach happened.
Market contagion was real but limited in the first hours: The Block recorded bitcoin down 4.5% to $76,664 and about $1.55bn of liquidations on the night.
What to watch
- 1 November 2026: Binance’s target date to reopen withdrawals (update of 31 October).
- By 3 November 2026 (UTC): the full zero-knowledge proof of reserves based on the 00:00 UTC snapshot of 31 October, according to Binance.
- No date yet: Binance’s technical post-mortem.
- Around 12 December 2026: the end of the CFTC’s 60-day comment period on its retail crypto notice (our calculation from the 13 October publication date).
Sources
- Binance: Security Incident Update, support announcement (30 October 2026)
- Binance: Recovery Update #2, official X (30 October 2026)
- Binance: Recovery Update #3, official X (31 October 2026)
- CFTC press release 9307-26 (5 October 2026)
- FBI public service announcement on the Bybit theft (26 February 2025)
- ADGM FSRA statement on the Binance security incident
- Jeremy Allaire, Circle, on X
- TRM Labs: North Korea Steals USD 6.36 Billion From Binance
- Chainalysis: Binance exploit, latest findings
- Chainalysis: 2025 crypto theft figures
- The Block: Inside the largest crypto hack on record
- The Block: Bitcoin slides below $77,000
- The Block: Binance finalises SAFU conversion into bitcoin
- CoinDesk: Experts divided over Binance hack asset freezes
- Nextgov: FBI involved in response to Binance hack
- Decrypt: Binance sets aside $6.34bn, quoting Richard Teng
- The National: CFTC chair Michael Selig on the Binance hack
