Binance says the October 29 hack affected roughly $6.3 billion in assets. In its October 30 announcement, the exchange said about $3 billion had been frozen and promised to cover losses using its SAFU emergency fund and company money.
Those are different things. Frozen funds have not necessarily been returned. A promise to cover losses also does not mean customers can withdraw immediately.
This account reflects reports available on October 30, 2026. The investigation is still underway.
What we know about the Binance hack
Updated October 30, 2026: we have added the transfer timeline, researchers’ technical findings, and Binance’s latest funding statement. The figures below are dated estimates, not a final accounting.
The withdrawals crossed several blockchains
TRM Labs puts the outflow at approximately $6.36 billion across ten blockchains. It says most of the money moved in about 20 minutes, starting at 20:05 UTC on October 29. That is the main withdrawal burst, not the duration of the entire incident.
Elliptic’s investigation describes an initial movement of about 233 million XRP from five Binance wallets. Other networks followed, with another wave on Avalanche and Polygon after 23:00 UTC. Its estimate is $6.43 billion across eleven blockchains.
These reports do not give identical totals or network counts. We are keeping Binance’s approximately $6.3 billion headline figure and identifying the research estimates separately. None should be treated as an audited final loss.
Elliptic’s breakdown includes about $3.80 billion on Ethereum, 18,270 BTC valued at roughly $1.48 billion, and 612.7 million USDT on Tron. Those valuations reflect its investigation snapshot.
What the compromised laptop may explain
Binance’s initial announcement points to a possibly compromised DevOps engineer’s laptop. The company said an attacker reached service containers and submitted unauthorized withdrawals. It reported finding no evidence of compromised wallet private keys and said it had revoked affected address authorizations.
That was an early explanation. Binance later said investigators had found further breach points. As Associated Press reported, the investigation had widened beyond the initial laptop account. We still do not have the final technical report explaining how the attacker gained access or which internal controls failed.
The public reference to a service container does not establish a Docker vulnerability. It also does not establish that the engineer knowingly helped the attacker. We should not turn an early description of the entry point into either claim.
How the Ethereum wallet was used
TRM reports that the attacker used EIP-7702 delegation to make an Ethereum hot wallet run attacker-controlled sweeping code. Its analysis identifies 50 pre-signed authorizations prepared ahead of the attack. On the other nine networks it tracked, transfers used ordinary signatures.
A hot wallet is connected to systems that process transactions. In this account, the critical issue is what those systems were persuaded to authorize. TRM’s findings are consistent with misuse of signing access, but the exact route from the compromised environment to those approvals still needs Binance’s postmortem.
Frozen money, replacement funds, and withdrawals
Binance initially reported roughly $3 billion frozen with partners’ help. Elliptic independently counted about $2.84 billion frozen in its October 30 snapshot, mostly stablecoins. It also observed conversions into assets such as ETH. Issuer freezes can restrict certain tokens, while native bitcoin and ether have no equivalent issuer-controlled freeze. Those differences affect recovery options.
Frozen assets and replacement funds are separate pools. In an update reported by CoinDesk, Binance said it had set aside more than $6.34 billion in company resources. It said $5 billion was already held in the affected tokens and that it was buying the remainder through markets and over-the-counter trades. The company said those resources excluded frozen or protected assets.
That is a more specific funding statement than the initial reimbursement promise. It is still Binance’s statement, not our independent verification that every customer can withdraw or that all purchases are complete.
Binance’s service update said deposits were operating normally while withdrawals remained paused during security work. The company expected withdrawals to resume within 48 hours. That was an estimate, not confirmation of reopening. Customers should check current notices for their network before sending funds.
Who investigators think was responsible
TRM attributes the attack to TraderTraitor, a North Korean hacking group, with high confidence. AP also reported a similar assessment from Chainalysis. These are investigators’ assessments. In the reporting reviewed here, Binance was still working with law enforcement to establish who was responsible.
Elliptic considers North Korean involvement likely, but notes that a shared laundering address could connect different attackers using the same laundering service. The overlap alone does not prove a shared attacker.
What we still need to see
We want the postmortem to explain the full access path, the permissions available to the attacker, and how withdrawal checks were bypassed. It should also say when the attack was contained and what changed before services reopened.
Covering losses addresses the missing money. Customers still need evidence that the withdrawal system is safe to use again. A reserve snapshot can show assets at a particular moment. It cannot explain whether withdrawal approvals are trustworthy.
A protected key can still approve a theft
Binance’s preliminary account and the researchers’ findings point toward misuse of the systems around the keys. If that account holds up, the attacker could obtain signed transactions without taking the keys themselves.
For anyone operating wallet infrastructure, the question is whether one compromised service can both request and approve a withdrawal. Independent checks, limits, and alerts need to be outside the permissions that an attacker has already gained. We cannot yet say which of those protections Binance had or how they behaved.
Binance still owes customers those answers. Naming a compromised laptop does not explain why a withdrawal system accepted billions of dollars in unauthorized requests.
Exchange custody and holding your own keys
Not your keys, not your coins.
An exchange balance depends on the exchange keeping custody, processing withdrawals, and surviving mistakes or attacks. You can secure your login and still be caught by a failure inside the company.
For Monero users, holding your own keys removes that particular dependency. It does not make your computer safe or protect a seed phrase left in a screenshot. You take responsibility for backups, wallet downloads, and checking where you send funds.
Before moving a meaningful amount, learn how your wallet’s recovery process works. Keep the recovery information offline and private. Verify the receiving address, then try a small transfer. Do not rush into unfamiliar tools because a headline frightened you.
The same caution applies to recovery messages. Open the exchange through a saved bookmark or its app. Ignore strangers offering to unlock withdrawals or recover funds for an upfront payment.
Binance has promised a technical postmortem. Read it when it arrives. For now, the practical question is how much money you are comfortable leaving under someone else’s control, including during a withdrawal freeze.