\n
![](\"https:\/\/media.crypto.news\/2025\/02\/crypto-news-Binance-option29.webp\")
<\/p>\n
\n<\/p>\n
Binance has promised to cover every customer loss after a breach it estimates affected $6.3 billion. Its recovery effort now involves several different processes, from stablecoin freezes to tracing assets that no token issuer can block.<\/p>\n
\n Summary<\/span>\n <\/p>\n <\/p>\n Binance has estimated that $6.3 billion in cryptocurrency was affected by its October 29 breach and pledged to cover all losses while partners have frozen roughly $3 billion.<\/p>\n Binance\u2019s security update says its preliminary investigation points to a compromised DevOps engineer\u2019s laptop that may have allowed access to an internal service container and the submission of unauthorized withdrawals.<\/p>\n JUST IN: Analysts link the $6.3B Binance exploit to North Korea\u2019s hacking network<\/p>\n TRM Labs, Chainalysis and Singapore\u2019s Pangolin Intelligence reportedly point to a DPRK-linked group, while claims that the attacker moved some stolen funds through Aave to borrow ETH raise\u2026 pic.twitter.com\/r10QO8MChb<\/a><\/p>\n \u2014 crypto.news (@cryptodotnews) October 30, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n The exchange says it has found no evidence that wallet private keys leaked. It has revoked the affected address authorization, involved law enforcement and promised a technical report after investigators finish establishing what happened.<\/p>\n Blockchain investigators have published separate accounts of the transfers. Their figures describe different stages of the incident and use different scopes, with some counting the value when assets left Binance and others describing assets that were subsequently frozen.<\/p>\n The $3 billion freeze figure therefore sits alongside the $6.3 billion estimate. Binance has not described $3 billion as money already returned to customers, nor has it published a final accounting of its own financial loss after recoveries.<\/p>\n According to TRM Labs<\/a>, the main burst of transfers began at approximately 20:05 UTC on October 29 and moved most of the stolen funds within about 20 minutes. Its investigation covers 10 networks, with a further wave reaching Avalanche and Polygon later that evening.<\/p>\n TRM\u2019s estimate values the assets at the time of each transfer. Binance\u2019s $6.3 billion figure is the company\u2019s estimate of the incident\u2019s impact, so the difference between the two totals does not by itself establish that investigators found another theft.<\/p>\n The firm attributes the attack to North Korea\u2019s TraderTraitor group using on-chain and off-chain intelligence. Binance has not confirmed the attacker\u2019s identity, and the attribution remains the investigators\u2019 assessment.<\/p>\n As crypto.news previously reported, the initial attribution and tracing<\/a> connected the incident with a hacking unit previously identified by the FBI in the February 2025 Bybit theft. A technical attribution and a criminal finding are separate stages, even when investigators express high confidence.<\/p>\n The transfers involved assets with very different recovery options. Dollar tokens can have issuer controls, while native Bitcoin and Ethereum do not give a stablecoin company a comparable power to blacklist a holder\u2019s balance.<\/p>\n An address appearing in the tracing record can consequently be a useful lead without being a recoverable balance. Investigators can follow public transfers after an attacker changes wallets, but the ability to observe a movement does not automatically give anyone authority to reverse it.<\/p>\n Blockaid\u2019s technical investigation<\/a> describes an attack on Binance 14, a busy Ethereum hot wallet. A transaction contained 50 EIP-7702 authorizations, with one matching the account\u2019s transaction counter and activating a delegation to malicious code.<\/p>\n The researchers say the attacker subsequently used the delegated wallet to transfer a large basket of assets and reached another smart account controlled by that wallet. The malicious delegation could remain useful for later deposits until it was removed.<\/p>\n The wallet authorization mechanism<\/a> has already been examined in the publication\u2019s technical coverage. Its role in this incident was to let code operate in the context of an existing wallet after the required authorization had been accepted.<\/p>\n Ethereum\u2019s EIP-7702 specification<\/a> describes persistent delegation, not permission that necessarily disappears after a single transaction. It warns that delegated code has unrestricted access to the account and must be closely audited by wallet providers.<\/p>\n The distinction explains why removing the affected authorization belongs in the response alongside stopping withdrawals. A pause in an exchange\u2019s customer interface and the removal of an on-chain delegation address different parts of the same incident.<\/p>\n Blockaid describes other transfers as ordinary signed transactions from wallets on several networks. Its findings do not establish that every dollar left through the Ethereum delegation, and a single Ethereum feature cannot account for Bitcoin or Tron transfers by itself.<\/p>\n Binance\u2019s preliminary statement and the investigators\u2019 technical account address different questions. The exchange describes a possible route into its systems, while the researchers describe what authorized transactions did on-chain.<\/p>\n The full investigation still has to connect those stages. The exchange\u2019s statement that it has not found a private-key leak does not mean that every transaction approved by its signing infrastructure was intended by the company.<\/p>\n UPDATE: Binance CEO Richard Teng says security breach was not a \u201cone-click\u201d attack<\/p>\n Teng clarifies that the incident involved more than a single engineer\u2019s access permissions, pushing back against claims that one compromised account alone enabled the attack. https:\/\/t.co\/P2MQLnvuSl<\/a> pic.twitter.com\/olnYSe6zPC<\/a><\/p>\n \u2014 crypto.news (@cryptodotnews) October 30, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n Binance says approximately $3 billion has been frozen through cooperation with industry partners. A freeze restricts movement of the affected assets, while recovery requires a further step that returns value to the rightful owner or to an agreed recovery address.<\/p>\n Using the exchange\u2019s rounded figures, $3 billion divided by $6.3 billion equals approximately 47.6%. The remaining difference is $3.3 billion, or 52.4% of the initial estimate.<\/p>\n Those calculations describe the relationship between Binance\u2019s two announced numbers. They do not establish that $3.3 billion has disappeared beyond recovery, or that the entire frozen balance can immediately be used to reimburse customers.<\/p>\n The denominator can change as investigators identify transfers, remove double counting or update prices. The numerator can change as issuers locate more tokens or authorities authorize a recovery transaction.<\/p>\n <\/p>\n TRM\u2019s early account put frozen or secured assets at roughly $2.7 billion, below Binance\u2019s subsequent estimate. Its figures were a dated tracing snapshot, and the company\u2019s later total should not be added to it as though they describe separate pools.<\/p>\n The same caution applies to issuer announcements. A Tether freeze and a Circle freeze can be components of Binance\u2019s aggregate, so adding both to the exchange\u2019s total would count some assets twice.<\/p>\n Stablecoins that were exchanged before an issuer acted introduce another complication. A dollar token\u2019s issuer may be able to block that token, but its controls do not follow the holder into a different native asset automatically.<\/p>\n Recovery accounting therefore needs both the token balances and their status. Assets identified, assets immobilized, assets transferred into recovery custody and assets used to restore customer balances are four different descriptions.<\/p>\n Binance\u2019s commitment is to cover losses using its Secure Asset Fund for Users and company resources. It has not said that SAFU alone will absorb the entire incident.<\/p>\n The fund\u2019s earlier Bitcoin reserve conversion<\/a> was completed in February, when Binance reported 15,000 BTC worth approximately $1.005 billion at the time. The conversion announcement described a historical balance and valuation, not a fresh October statement of available insurance resources.<\/p>\n Even a hypothetical $1 billion fund would cover only 15.9% of a $6.3 billion gross incident. Subtracting $1 billion from $6.3 billion produces $5.3 billion, but that arithmetic is not an estimate of Binance\u2019s actual funding gap because recoveries and the current fund balance remain separate inputs.<\/p>\n The exchange\u2019s choice to include company funds is consequently part of the promise itself. Customers have been told that Binance will bear the loss, rather than being told to wait until investigators retrieve every stolen token.<\/p>\n The pledge does not identify the precise mix of cash, cryptocurrency or other company resources that will be used. It does not establish the timing of any issuer-controlled recoveries or the accounting treatment of the frozen balances.<\/p>\n Customer reimbursement and the company\u2019s ultimate net loss can move on different schedules. Binance can replace a missing customer asset from its own resources before the original asset is recovered, leaving the company to pursue recovery afterward.<\/p>\n If an issuer later returns an asset that has already been replaced, that recovery would affect Binance\u2019s own financial exposure. It should not be counted as a second reimbursement of the same customer loss.<\/p>\n JUST IN: ZachXBT links Binance and Bitget exploits after stolen funds converge at one wallet<\/p>\n The investigator says funds from the reported $6.3B Binance breach and $388M Bitget hack were routed through THORChain and commingled at the same address, suggesting both incidents may\u2026 pic.twitter.com\/oYs4nyjdBH<\/a><\/p>\n \u2014 crypto.news (@cryptodotnews) October 30, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n Binance has promised an updated proof of reserves after remediation. Its August reserve snapshot<\/a> reported reserve ratios of 100.25% for Bitcoin and Ethereum, with a higher ratio for USDT.<\/p>\n An August ratio cannot establish the exchange\u2019s backing after an October incident. The customer balances, reserve holdings and affected assets need to be measured at the new snapshot date.<\/p>\n\n\n
\n\n
The Binance hack reached several networks within minutes<\/strong><\/h2>\n
One Ethereum authorization changed what a hot wallet could do<\/strong><\/h2>\n
\n\n
Frozen funds and returned funds belong in separate totals<\/strong><\/h2>\n
Binance has named company funds alongside SAFU<\/strong><\/h2>\n
\n\n
A reserve update will provide a dated view of backing<\/strong><\/h2>\n