Inside Binance’s $6.3 Billion Hack: How the Attack Unfolded and What Happens Next

A coordinated attack on Binance’s hot wallets triggered a multibillion-dollar emergency, a global effort to freeze stolen assets and a temporary withdrawal shutdown. As services reopen, investigators are examining how attackers obtained the authority to move funds across multiple blockchains.

Reporting updated to 1 November 2026. The technical investigation and asset-recovery effort remain ongoing.

Binance began restoring cryptocurrency withdrawals on Sunday, 1 November, following a theft that has become the largest recorded cryptocurrency hack. The exchange said it had replaced approximately 95 per cent of the stolen assets, while US investigators attributed the attack to a possible North Korean operation. However, this has not been independently verified.

The reopening marked an operational milestone, with the investigation and recovery of stolen funds continuing. The attack, which Binance dates to approximately 20:05 UTC on 29 October, compromised its internet-connected hot wallets and caused an estimated US$6.3 billion loss. Binance has committed to absorbing the financial impact and says it has allocated more than US$6.34 billion of company funds to cover the incident.

For customers, financial institutions and businesses using digital assets, the episode raises questions about the systems that authorise transfers, the availability of funds during a shutdown and the financial resources required to survive a major breach. Its consequences extend beyond the initial theft: rebuilding trust requires evidence that the missing assets have been replaced and that the weaknesses enabling their removal have been addressed.

How much was stolen, and where did it come from?

Although Binance’s US$6.3 billion estimate has become the principal headline figure, independent investigators have published slightly different totals. TRM Labs calculated approximately US$6.36 billion, valuing transfers when the assets were taken; Elliptic estimated US$6.43 billion. These are estimates from different investigations and should retain their attribution, rather than being presented as an agreed final accounting.

Elliptic’s reconstruction illustrates the concentration of the losses:

These are selected components of the theft, not a complete accounting. They should not be added to the overall loss estimate.

Understanding the wallet structure helps explain the exposure. Exchanges use online hot wallets to process withdrawals, while keeping other assets in separate custody arrangements. Bitquery’s analysis identified transfers from 17 Binance hot wallets in its investigation. The vulnerability of the systems controlling those wallets therefore mattered directly to the assets available for routine customer transactions.

The headline theft figure also needs to be distinguished from Binance’s eventual net financial loss. Assets that are successfully returned could reduce that loss, while replacement purchases create a separate funding requirement. An exchange can restore customer backing before recovering the stolen property, provided it has sufficient resources to do so.

Timeline: From preparation to the reopening of withdrawals

The chronology below combines Binance’s announcements with attributed blockchain reconstructions and the FBI’s public statement. Transaction times show activity recorded on-chain; they do not establish when the attackers first entered Binance’s internal systems.

All times are UTC. Oman is four hours ahead: the approximately 20:05 UTC start on 29 October corresponds to 00:05 on 30 October in Oman.

TRM’s assessment that most of the value moved in roughly 20 minutes captures the attack’s extraordinary speed. It does not mean every transfer, containment action or laundering transaction occurred within that period. The broader chronology continued for hours, followed by an investigation and financial response extending across subsequent days.

How the attackers appear to have reached the money

Binance’s first account of the incident identified a compromised DevOps engineer’s laptop as a possible entry point. According to that preliminary explanation, an attacker gained access to a service container – an environment running part of the exchange’s software – and submitted unauthorised withdrawal transactions. Binance said it had found no evidence of a wallet private-key leak.

Subsequent disclosures made clear that this initial explanation was incomplete and Binance reported additional breach points, while co-chief executive Richard Teng described a complex attack involving malicious software designed to erase evidence. Reuters reported his account that the attackers manipulated the system approving transfers from a hot wallet, bypassing its normal approval controls.

The blockchain evidence supports investigation of the signing infrastructure: TRM assessed that the attacker obtained the ability to have Binance’s hot-wallet systems authorise transactions across multiple networks. Bitquery likewise observed valid wallet signatures on the transfers it examined. That observation identifies an important distinction: a transaction can satisfy a blockchain’s signature requirements while having been initiated without the asset owner’s legitimate approval.

An analogy is a corporate payment system that accepts a fraudulent instruction because the attacker has reached the machinery that approves it. Investigators must establish how that authority was obtained, which controls failed and whether the compromise allowed instructions to bypass checks that would normally reject them. Keeping the private key secret is only one part of protecting the complete authorisation process.

The Ethereum feature that amplified the attack

On Ethereum, investigators identified the use of EIP-7702, a feature allowing an ordinary wallet to delegate execution to smart-contract code through a signed authorisation. The standard enables functions such as grouping several operations into a transaction and allowing another account to sponsor transaction fees. Delegation can remain in effect until it is changed or cleared.

Bitquery’s reconstruction found that the attacker used signed authorisations to make Binance 14 execute attacker-controlled code, then called that code repeatedly. This created a continuing mechanism for transferring assets from the wallet. The public evidence concerns how a legitimate wallet capability was deployed after unauthorised access to signing authority; Binance’s final internal failure sequence remains under investigation.

Ethereum’s own guidance describes the security implications of delegation, including the need to trust and review the code a wallet adopts. It also warns that delegating to a multisignature-style contract does not automatically remove the original key’s ability to override that arrangement.

The operational lesson is that payment controls must understand the authority a signature grants and as a general control-design inference, a system checking only the immediate transfer amount could overlook an instruction that changes what a wallet will be able to do afterwards. This is a control question raised by the reconstruction, rather than a confirmed description of Binance’s undisclosed internal rules.

Why some assets could be frozen while others kept moving

As the containment effort developed, Elliptic’s 1 November update reported approximately US$2.85 billion frozen or seized, predominantly stablecoins. Binance separately reported about US$3 billion frozen. These remain attributed snapshots, rather than a single reconciled accounting.

While issuers can block certain stablecoin holdings, bitcoin and ether have no comparable issuer-operated freezing mechanism. Elliptic documented conversions into assets beyond issuers’ reach, illustrating the importance of acting before stolen tokens are exchanged.

The FBI said it had observed the stolen assets being converted primarily into ether and anticipated further laundering through decentralised finance and instant-swap services. Working with the US Secret Service and IRS Criminal Investigation, it called on infrastructure operators, exchanges and other service providers to block transactions involving the identified addresses and their proceeds.

For investigators, the public ledger provides a continuing record of movements, but tracing and recovering property remain different (and rather gargantuan) tasks. A successful freeze can preserve an opportunity for recovery; a transaction history can establish where funds travelled. But neither should be described as money returned to Binance unless an actual return has been documented.

What Binance’s promise to cover the losses means

Binance’s response has involved purchasing replacement tokens as well as pursuing the stolen assets. Its 31 October update identified three funding sources: part of the Secure Asset Fund for Users, or SAFU; a portion of its Futures Insurance Fund; and its corporate treasury. The exchange also said the remaining tokens were less liquid and would take longer to source in the required quantities.

By 1 November, Binance reported approximately 95 per cent replenishment and said balances in ten named assets – including BTC, ETH, USDT, USDC, BNB and SOL – were fully backed. Those are based on company disclosures and they describe progress in restoring asset backing, and should not be read as a claim that investigators had recovered 95 per cent of the stolen cryptocurrency.

Three terms are therefore central to understanding the response:

This distinction also prevents misleading arithmetic that a replenishment percentage cannot simply be added to a freezing percentage: one concerns replacement financing, while the other concerns the status of stolen property. Similarly, restoring asset backing and restoring immediate withdrawal access are separate operational milestones.

Binance’s reopening announcement described a phased process for specified asset-and-network combinations, with further additions subject to readiness checks. It warned that traffic could cause processing delays and directed customers to check the availability of their chosen withdrawal route. Its updated disclosures also clarified that deposits remained operational.

What proof of reserves can establish

Alongside its replenishment programme, Binance announced a proof-of-reserves snapshot taken at 00:00 UTC on 31 October. It said a full zero-knowledge proof, enabling holders of ten listed assets to verify the backing of their balances, was expected by 3 November. That was a stated completion target, separate from the availability of the snapshot itself.

The distinction between a reserve check and a financial audit remains relevant. For instance, in a 2023 advisory, the US Public Company Accounting Oversight Board’s Office of the Investor Advocate warned that proof-of-reserves reports are not audits and can leave significant questions unanswered, including liabilities, borrowed assets, customer rights and internal controls. Its warning was general, rather than a finding about this Binance incident.

For readers who are assessing the recovery, these disclosures answer different questions: evidence of holdings addresses the availability of assets at a particular time; a technical report addresses how the theft occurred; broader financial reporting helps assess the company’s capacity to absorb the cost. Confidence depends on the consistency of those accounts and the scope of independent verification.

Who is TraderTraitor, and what has been established?

The FBI’s 31 October statement formally attributed the theft to North Korea and identified the activity as TraderTraitor. Its public notice provides a law-enforcement attribution and addresses associated with the laundering effort, but does not disclose the complete evidence supporting the identification or the full route through Binance’s systems.

In September 2024, the FBI described elaborate North Korean social-engineering campaigns targeting cryptocurrency employees, including approaches built around employment and investment opportunities. It warned that technically sophisticated staff could also be compromised. That background helps explain the industry’s concern about employee devices, but it does not establish which approach was used against Binance.

Meanwhile, Associated Press reported that President Donald Trump expressed uncertainty about North Korea’s involvement after the FBI had issued its assessment. The article’s attribution rests on the bureau’s published investigative statement; the differing political comment does not supply a separate technical account of the intrusion.

How this compares with earlier major attacks

Previous incidents provide useful context, although their mechanisms and targets differ substantially.

The comparison shows why the label “crypto hack” can conceal materially different failures: compromised customer credentials, vulnerable bridge verification and compromised institutional transaction processes require different investigations and remedies. The relevant question for custodians dabbling in cryptocurrencies is which authority an attacker obtained and how much value that authority could reach.

The questions Binance’s final investigation must answer

Despite the progress reported on replacement purchases and withdrawals, the disclosures reviewed for this article do not provide a complete forensic explanation. Binance’s 1 November update continued to promise a post-incident report once the investigation was complete.

A comprehensive account would need to resolve several issues:

• Initial access: How and when were the first device or credentials compromised, and how long did the attacker remain undetected?
• Scope of authority: How did access extend to systems controlling wallets across different blockchains?
• Approval failures: Which checks allowed unauthorised transfers or wallet delegations to receive valid signatures?
• Containment: How did internal detection, withdrawal suspension and revocation of on-chain permissions fit together?
• Financial reconciliation: What is the final loss by asset, how much has been returned, and what remains frozen or outside Binance’s control?
• Verification: What independent work will substantiate both the technical remediation and the completed restoration of customer backing?

These questions should guide scrutiny of the eventual report without assuming that every preliminary theory is correct. Public transaction records reveal what wallets did; internal logs, access records and security reviews are needed to explain why Binance’s systems permitted those actions.

What the incident means for businesses and investors in Oman

The response also drew regional regulatory attention: Reuters reported that Abu Dhabi’s Financial Services Regulatory Authority was engaging closely with Binance and monitoring the incident. It also reported declines in bitcoin, ether and BNB during the initial market reaction.

For treasury teams and investors in Oman and the wider Gulf, the case offers a practical way to examine custody risk. The amount held with an exchange, the purpose of that balance and the consequences of losing withdrawal access all deserve separate consideration. Even where a platform ultimately absorbs a theft, a temporary suspension can complicate access to working capital or the settlement of other obligations.

The security lessons extend to businesses operating their own digital-asset systems. The FBI’s earlier guidance recommends multiple authentication factors and approvals across separate networks, tighter access to sensitive systems, and independent verification of unexpected professional approaches. These measures address the people and processes surrounding transaction authority, as well as the software used to execute transfers.

For institutions assessing a service provider, useful questions include how withdrawal approvals are separated, how much value any single operational compromise could expose, and how rapidly compromised authority can be revoked. Financial resilience deserves equally concrete scrutiny: the resources available to cover a loss, the liquidity of replacement assets and the evidence supporting customer balances.

Binance’s recovery will ultimately be judged through completed withdrawals, verifiable asset backing, the return of stolen property and a credible explanation of the failure. Each is a distinct measure of progress but together, they will determine how convincingly the exchange can demonstrate that it has repaired both the immediate damage and the conditions that made it possible.