Billions left Binance’s wallets on October 29, but the exchange says investigators have found no evidence that wallet private keys leaked. That is the central puzzle of the Binance hack, with an estimated $6.3 billion impact: an attacker may have obtained something just as dangerous as the keys—the ability to make the exchange authorize transfers. Binance now says investigators have uncovered additional points of breach beyond the initially suspected employee laptop. [1][2]
As of October 30: Binance says deposits are operating normally, withdrawals remain suspended, and losses will be covered using its SAFU fund and company funds. Its latest investigation update gave an expected 45-hour timeline to restore withdrawals; that was a target from the time of that statement, not confirmation that service had resumed. [1]
The laptop explanation is only the beginning
Binance initially described a possible route from a compromised DevOps engineer’s laptop to a service container used to submit unauthorized withdrawals. Richard Teng subsequently stressed that the attacker did not simply use one engineer’s permissions and that the operation was not a single click. He said the investigation had not assigned responsibility to any individual. [2]
That distinction matters. A private key can stay inside protected infrastructure while an attacker abuses a system permitted to request signatures. The resulting transaction can be cryptographically valid and still unauthorized by the business. The missing explanation is which approval boundaries failed between a workstation, an internal service and the systems that move customer assets.
Fifty signatures prepared for a moving target
TRM Labs traces the main burst to roughly 20 minutes beginning at 20:05 UTC. It identifies a particularly revealing Ethereum transaction: the attacker submitted 50 pre-signed EIP-7702 authorizations, each prepared for a different consecutive transaction counter, or nonce. One matched the busy wallet’s current counter and delegated its behavior to an attacker-controlled sweeper contract. [3]
Think of the counter as a moving queue number. Preparing a range reduced the risk that ordinary withdrawals would advance the wallet past the number the attacker expected. The authorization changed what the wallet could do; a subsequent call moved the money. That is why looking only for the largest transfer misses an earlier, decisive change in control.
PublicAML’s separate reconstruction describes three rehearsals on attacker-controlled wallets before the real delegation. It timestamps the Binance 14 sweep at 20:24:23 UTC and an ordinary transfer from Binance 16 to the same collector 24 seconds later. It also identifies later sweeps of newly arriving funds. [4]
Ethereum delegation does not explain everything. TRM found ordinary signed withdrawals on other blockchains too, leading it to assess that Binance’s hot-wallet signing infrastructure was compromised. That remains an investigator’s assessment, not a published final root-cause report. [3]
Why $6.3 billion, $6.36 billion and $6.43 billion appear
These are attributed estimates with different scopes and observation times. They should not be combined into a new total.
- Binance, October 30 update: about $6.3 billion affected and roughly $3 billion frozen.
- TRM, snapshot at 00:30 UTC on October 30: about $6.36 billion taken across ten blockchains, valued when transferred.
- Elliptic, October 30 report: $6.43 billion stolen across eleven blockchains; $2.84 billion verified frozen in its morning analysis.
TRM and Elliptic’s estimates both put the event far above the roughly $1.5 billion Bybit theft in 2025. Their different chain counts are another reason to keep the source beside the number. [3][5]
The race was to change what could be frozen
Elliptic’s 07:00 UTC snapshot distinguishes $2.84 billion frozen from about $3.33 billion beyond token issuers’ reach, at then-current prices. Those values are not a subtraction from the original theft valuation: prices and positions change. Its tracing shows stablecoins being exchanged for native assets such as ETH, including rushed swaps at unfavorable prices. [5]
The mechanism explains the urgency. Some token issuers can blacklist balances. Native bitcoin and ether have no equivalent issuing company that can simply freeze them. Investigators can still trace those funds, and services can act when they arrive, but that is a different intervention.
Frozen is not returned. Blocking a balance stops a particular movement; it does not by itself establish that Binance has recovered it or credited customers. Likewise, a promise to cover losses is a commitment whose fulfillment must be checked separately from the on-chain freeze total.
The North Korea link—and the limit of that evidence
TRM attributes the operation to North Korea’s TraderTraitor with high confidence. Elliptic also attributes the theft to DPRK actors and describes a shared destination for a small portion of Binance proceeds and funds linked to the earlier Bitget exploit. It cautions that a shared laundering service can handle money for different attackers. Its report says no government or law-enforcement agency had confirmed attribution at that point. [3][5]
PublicAML highlights another trap for amateur sleuths: apparent transfers involving look-alike addresses were copycat-token activity, not genuine USDT movements. A familiar ticker and matching address edges are not enough to reconstruct a money trail. [4]
What the investigation still needs to explain
The technical post-mortem needs to connect the additional breach points to the authorization failure: how initial access was obtained, which signing requests passed controls, and how access reached wallets on different chains. Repeated sweeps raise a separate containment question about when malicious permissions were revoked. These are open questions, not evidence that a named employee, an insider or a particular software flaw caused the theft.
For customers, check withdrawal availability inside the official app and preserve records of any affected transaction. No unsolicited caller or chat account can lift Binance’s exchange-wide suspension by asking you to send crypto elsewhere. The Coinbase impersonation case involving “safe” wallets shows why such instructions deserve immediate suspicion; it is a separate incident, not evidence of a Binance-specific recovery campaign.
The next meaningful milestones are a verified return of withdrawals, evidence of recoveries and a technical explanation of the failed controls. Until then, the theft estimate, frozen assets and customer reimbursement remain three different parts of the story.
References
- Binance. Investigation update: additional points of breach and service status. X, October 30, 2026; accessed October 30, 2026. Official investigation update.
- Richard Teng. Statement on the Binance security incident and withdrawal-service response. X, October 30, 2026; accessed October 30, 2026. Statement from Richard Teng.
- TRM Labs. North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History. October 29, 2026; data through October 30, 00:30 UTC; accessed October 30, 2026. Transaction and signing analysis.
- PublicAML. Binance hack: a Tornado-funded operator, three test runs, and about 430,737 stolen ETH parked on four wallets. October 30, 2026; accessed October 30, 2026. Ethereum and Tron reconstruction.
- Elliptic. The largest theft in history: North Korea likely behind the $6.4 billion Binance hack. Updated October 30, 2026, 08:00 UTC; accessed October 30, 2026. Loss, freeze and attribution analysis.
