Binance Reserves Over $6.34 Billion in Company Funds for Hack Losses

Binance said in a post on its official X account on October 30, 2026, that it has already reserved over US$6.34 billion of company funds to cover losses from the October 29, 2026 security incident, and that $5 billion of those funds is already held in the exact token assets that were impacted.

The exchange said it is completing the purchase of the remaining amount by buying token assets through market channels and OTC channels, in order to match the format of the remaining token assets and address any asset shortfalls, and that this step can take longer because some tokens may have low liquidity and OTC settlement also takes time. It said the figures do not include frozen or protected assets, which remain subject to ongoing recovery and verification, and that $3 billion has currently been frozen, with thanks to its industry partners.

The company said it has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds. Binance said it will continue to use company resources to cover confirmed shortfalls and that, ultimately, all user funds will be verified publicly through its Proof of Reserves.

Breach Account and Withdrawal Suspension

In a formal security incident update published on October 30, Binance said its initial investigation suggests the incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. The company said it has found no evidence of any wallet private key leak. It put the estimated total impact at around $6.3 billion, said roughly $3 billion has been frozen on-chain so far with blockchain partners, and said it will cover all losses from the SAFU fund and the company’s funds, stating that user funds are safe.

As immediate precautions, Binance said it temporarily suspended withdrawals while security checks are completed, revoked the affected address authorisation, and engaged law enforcement and blockchain intelligence partners to trace and recover funds. The announcement was updated later on October 30 to clarify that deposits remain unaffected and continue to operate as normal.

Co-CEO Richard Teng wrote in a post that the attacker did not simply use one engineer’s permissions and that this was not a single “one-click” action, adding that the investigation has not attributed responsibility to any individual. Teng said withdrawals were suspended while Binance completes a security revamp of the withdrawal service and its related addresses. “Bottom line – your money is safe, and we’re covering every loss,” he wrote.

In a subsequent investigation update, Binance said its later investigation had uncovered additional points of breach beyond the possibly compromised laptop, describing a complex attack. The company said outflows ceased when withdrawals were paused, that around $3 billion had been frozen thus far, and that it remained on track toward an expected timeline of 45 hours to resume the withdrawal service.

On-Chain Findings and Asset Freezes

TRM Labs reported in an analysis that an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes starting at 20:05 UTC on October 29, with a second wave around 23:05 UTC reaching Binance wallets on Avalanche and Polygon (POL ). TRM said that makes the incident the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025, and that at current prices the assets taken are worth about $6.23 billion.

TRM attributed the attack with high confidence to TraderTraitor, which it described as North Korea’s elite hacking unit, and noted the FBI named the same group as responsible for the Bybit hack. Chainalysis said in its own findings that its investigators assess the approximately $6.4 billion exploit to be the work of TraderTraitor, and that the strongest evidence emerged when they observed, in real time, funds stolen from Binance commingling with funds stolen in the previous month’s Bitget exploit, which had been attributed to North Korean actors. Chainalysis said funds began leaving Binance hot wallets across multiple blockchains at around 4:20 p.m. Eastern Time on October 29.

On Ethereum (ETH ), the attacker used an EIP-7702 delegation, a mechanism that lets an ordinary wallet hand control of its behavior to a smart contract by signing an authorization, according to TRM’s report. TRM said the attacker prepared 50 pre-signed authorizations in advance to turn a Binance hot wallet into a sweeper it controlled, while Binance wallets on the other nine chains sent funds through ordinary signed transfers, a pattern that in TRM’s assessment points to a compromise of Binance’s hot wallet signing infrastructure.

TRM valued each transfer at the price of the asset at the moment it was taken, producing the following chain-by-chain accounting:

TRM said the Ethereum outflows include 200,630 ETH and 185 other tokens, the Bitcoin outflows total 18,270 BTC, Tron outflows total 612.7 million USDT and 46.4 million TRX, the XRP Ledger lost 233.46 million XRP, Solana outflows total 970,500 SOL, and the combined Arbitrum, Optimism and Base figure includes 74.6 million ARB taken on Arbitrum.

On freezes, TRM said Tether froze about 1.77 billion USDT, Circle froze about 825 million USDC, Ripple froze 40.5 million RLUSD and World Liberty Financial froze 27.8 million USD1, while Arbitrum’s (ARB ) Security Council used its emergency powers to force two transfers out of the attacker’s wallet on Arbitrum, moving 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s reach. That brought the total frozen on-chain to roughly $2.7 billion as of 00:30 UTC on October 30, according to TRM, which noted that Binance had said at 23:35 UTC on October 29 that the verified frozen total had reached $2.54 billion. Chainalysis said approximately $2.8 billion has been frozen so far, with the first freezes starting by 5:14 p.m. Eastern Time on October 29.

TRM said the attacker still controls more than 420,000 ETH and 18,270 BTC, about $2.4 billion in assets beyond any issuer’s reach, and that it expects the next stage of laundering to involve cross-chain bridges, swap services and over-the-counter brokers. Chainalysis said the attacker moved $500 million of stablecoins into a dedicated wallet and swapped $325 million of stablecoins into $285 million in ETH over nearly 20 minutes as it raced to convert freezable assets, and that it is observing laundering patterns it has not seen before, including thousands of transactions in a short period suggesting automation and addresses that receive exactly 1 TRX before receiving and forwarding additional funds.

Binance said it will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified, and will publish an updated Proof of Reserves once remediation is complete.