Binance has pledged to cover all customer losses following a security vulnerability. The company estimates that this vulnerability affected $6.3 billion. Its remediation efforts currently involve multiple different aspects, ranging from freezing stablecoins to tracking assets that token issuers were unable to stop.

• Binance It is estimated that the vulnerability on October 29 affected approximately $6.3 billion.
• The exchange stated that the partners have frozen approximately $3 billion in affected assets.
• TRM Labs tracked transfers across 10 blockchains and estimated the value of the funds that initially flowed out to be 6.36 billion US dollars.
• Blockaid identified a transaction targeting Binance 14 that contained 50 Ethereum authorizations.
• Binance promises to cover losses through two sources: SAFU funds and company capital.

Binance indicates that estimates show that the hacking incident on October 29 affected approximately $6.3 billion in cryptocurrencies, while partners have frozen about $3 billion, and the exchanges have pledged to cover all losses.

A security update from Binance indicates that preliminary investigations point to an intrusion into the laptop of an engineer from DevOps. This may have allowed the attacker to access internal service containers and submit unauthorized withdrawal requests.

The exchange stated that no evidence of wallet private key leakage has been found. Binance has revoked the authorization of the affected addresses, notified law enforcement authorities, and pledged to release a technical report after investigators have clarified the facts.

Blockchain investigators have separately published explanations for the fund transfers. The figures from different institutions describe different stages of the events, and the statistical scopes also vary: some are calculated based on the value of the assets at the time they left Binance, while others describe the assets that were later frozen.

Therefore, the frozen amount of $3 billion appears alongside an estimate of $6.3 billion. Binance does not describe the $3 billion as funds that have been returned to customers, nor has it published a complete accounting of its own ultimate financial losses after recovering the assets.

Binance Hackers' attacks affected multiple networks within minutes

According to TRM Labs, the main transfer occurred around 20:05 on October 29th UTC, and most of the stolen funds were transferred within about 20 minutes. The investigation covered 10 networks, and later that same night, another wave of funds flowed towards Avalanche and Polygon.

The estimation for TRM is calculated based on the asset value at the time of each transfer. The figure of $6.3 billion for Binance is the company's estimate of the impact of the incident; therefore, the difference between the two does not in itself prove that investigators have discovered another theft.

The agency attributed this attack to North Korea's TraderTraitor organization, based on both on-chain and off-chain intelligence. Binance has not yet confirmed the identity of the attacker, so this attribution remains the judgment of the investigators.

As previously reported by crypto.news, the initial attribution and tracing linked this incident to a black hacker group identified in the Bybit theft case that occurred on FBI in February 2025. Technical attribution and criminal determination are two different stages, even though investigators expressed a high level of confidence.

The assets involved in these transfers have distinctly different levels of recoverability. Dollar tokens may be under the control of the issuers, whereas native Bitcoin and Ethereum do not grant stablecoin companies the similar ability to blacklist the balances of certain holders.

Therefore, the addresses that appear in the tracking records can be useful clues, but they do not necessarily mean that the balance can be recovered. Investigators can continue to track the public transfers after the attacker changes wallets, but the ability to observe the movement of funds does not automatically imply that anyone has the right to reverse it.

An Ethereum authorization change determines what hot wallets can do

The technical investigation of Blockaid described an attack targeting Binance14, which is a busy Ethereum hot wallet. A certain transaction contained 50 EIP-7702 authorizations, one of which matched the transaction counter of that account and activated the delegation of malicious code.

Researchers said that the attackers subsequently used the entrusted wallet to transfer a large amount of assets and entered another smart account controlled by the same wallet. As long as this malicious delegation is not removed, it may continue to have an impact on subsequent deposits.

The wallet authorization mechanism has previously been discussed in technical reports by this media outlet. In this incident, its role was to enable the code to run within the context of the existing wallet after the necessary authorization was granted.

Ethereum EIP-7702 specifies persistent delegations, rather than permissions that necessarily disappear after a single transaction. It warns that the delegated code can have unrestricted access to the account, and wallet providers must conduct strict audits on it.

This distinction explains why removing the affected authorizations should be part of the response measures, along with stopping withdrawals. Pausing the exchange’s customer interface and removing on-chain orders correspond to different aspects of the same event.

Blockaid also described other transfers as ordinary signature transactions coming from multiple network wallets. Its discovery does not prove that all funds were transferred out through Ethereum mandates, and a single Ethereum function alone cannot explain the transfers of Bitcoin or Tron.

The preliminary statements of Binance differ from the technical explanations provided by the investigators. The exchange described possible pathways to enter its system, whereas the researchers described authorized transactions that have already taken place on the blockchain.

A complete investigation still needs to connect these stages. The exchange claims that no private key leaks were found, but this does not mean that every transaction approved by its signature infrastructure is in line with the company's intentions.

The frozen funds and the returned funds belong to different totals.

Binance indicates that approximately $3 billion has been frozen through cooperation with industry partners. The freeze restricts the mobility of the affected assets, and recovering these funds requires further steps to return their value to the legitimate owners or the designated recovery addresses.

Calculated using the rounded figures provided by the exchange, $3 billion divided by $6.3 billion is approximately equal to 47.6%. The remaining difference is $3.3 billion, which accounts for 52.4% of the initial estimate.

These calculations describe the relationship between two numbers published by Binance, and they cannot prove that $3.3 billion has disappeared beyond recovery, nor can they prove that all the frozen balances can be immediately used to compensate customers.

The denominator will change as investigators identify more transfers, eliminate duplicate calculations, or update prices. The numerator will also change as issuers find more tokens or as authorities authorize the resumption of trading.

TRM Earlier estimates suggested that the frozen or secured assets amounted to approximately $2.7 billion, which is lower than the later estimates of Binance. These figures represent a snapshot at a certain point in time and should not be added to the company's subsequent total assets, as if they referred to different pools of funds.

The same caution applies to the announcements from the issuers. The freeze of Tether and the freeze of Circle may both be part of the total figure summarized by Binance. Therefore, adding them to the total number on the exchange would result in double-counting of some assets.

The further complication arises from stablecoins that have already been exchanged before the issuer takes any action. While the issuer of a dollar-pegged token may be able to freeze that token, the control over it does not automatically transfer to the holder in another form of underlying asset.

Therefore, in order to recover the accounting, it is necessary to consider both the token balance and its status. Identified assets, frozen assets, assets that have been transferred back to restorative custody, and assets that have been used to restore customer balances are four different descriptions.

Binance includes the company's funds together with SAFU in the commitment.

Binance commits to using its user-facing Secure Asset Fund, for, Users ( SAFU ), as well as company resources, to cover the losses. The company does not imply that it can absorb all the losses from the incident solely through SAFU.

The conversion of this fund's previous Bitcoin reserves was completed in February. At that time, Binance reported holding 15,000 BTC, which was valued at approximately $1.005 billion at that time. The announcement of this conversion described historical balances and valuations, rather than the latest statement on the available insurance resources for October.

Even assuming a fund size of $1 billion, it would only cover 15.9% of the total $6.3 billion in incidents. Subtracting $1 billion from $6.3 billion leaves $5.3 billion, but this does not estimate the actual funding gap for Binance, as the recovery of assets and the current fund balance are still independent variables.

Therefore, the exchange's decision to include the company's funds in its commitments is itself a part of that commitment. What customers receive is the guarantee that Binance will cover any losses, rather than requiring them to wait for investigators to retrieve each stolen token.

This commitment does not specify whether cash, cryptocurrencies, or some combination of both company resources will be used, nor does it determine when the recovery under the issuer's control will occur, or how the frozen balances will be recorded in the accounts.

Customer compensation and the company's final net loss may vary at different rates. Binance can first use its own resources to make up for the missing customer assets, and then seek to recover the assets thereafter.

If the issuer later returns an asset that has already been replaced, this recovery will affect the financial exposure of Binance itself, but it should not be considered as a second compensation for the same customer's loss.

The reserve update will provide a timestamped view of support status.

Binance has committed to updating the reserve certificate after the fix. Its August reserve snapshot shows that the reserve rates for Bitcoin and Ethereum are 100.25%, while USDT has an even higher reserve rate.

The proportions in August do not prove the support level of the exchange after the events in October. Customer balances, reserve holdings, and affected assets all need to be re-evaluated on the new snapshot date.

The media's analysis and explanation of exchange reserve reporting practices state that such systems compare the covered assets with the balances of covered customers, and they do not automatically include all company liabilities. Nor can they prove that control measures remained effective between the two snapshots.

A ratio higher than 100% indicates that the assets taken into account exceed the corresponding customer balance, but it does not measure the quality of the withdrawal system, nor does it explain how attackers obtained valid authorization.

Therefore, the reserve updates and technical reviews promised by Binance serve different purposes. The former is capable of documenting support levels at a specified point in time, while the latter aims to explain the incident of the intrusion and the measures taken to shut down the paths used by the attackers.

The same asset cannot be described simultaneously as freely extractable liquidity and as frozen, recoverable property without a clear explanation of its status. Frozen tokens may still have a quote in US dollars, but ordinary customers are not able to withdraw them.

The compensation commitment keeps the timeline for recovery open.

The strongest public response is a commitment to cover all losses with the support of SAFU and company funds. The reported freezes have provided a batch of assets that attackers cannot freely transfer under their current control, which will be used for recovery efforts.

However, neither of these commitments provided a final figure for the losses. Binance has still not released a complete reconciliation of the stolen assets, frozen balances, returned assets, and the company resources used to replace customer funds.

In public records, the operational status has also been changing. The initial security notifications stated that deposits and withdrawals were suspended, while subsequent reports indicated that deposits had resumed, although withdrawals still required further security measures.

These notifications are based on their respective release times. Whether customers can withdraw funds depends on the current service status of the relevant network, and not on whether another network has already resumed operation.

Estimates of recovery time are merely company targets before the service is actually restored, and they do not represent a deadline for all customers to take immediate action; moreover, the reviewed security statement from Binance does not set a unified window for customers to withdraw their funds.

The technical report will outline the preliminary entry points.

The claim by the exchange that laptops were compromised is still just a preliminary judgment. Their statement indicates that there may be a path from engineers' devices to internal containers, but they have not provided a complete explanation of how the attackers obtained each level of authorization across the multiple affected networks.

The analysis of Blockaid provides evidence regarding the execution layer of Ethereum, while the investigation of TRM covers transfers and attribution across a larger network. These efforts cannot replace the internal access control guidelines that Binance has committed to releasing.

Binance.US, as an independent US-affiliated company of the exchange, stated that its operations have not been affected by this incident.

Matters of note

• Return of assets: A transfer that is confirmed to have been re-directed back to custodial management will be in a different status from that which was frozen by the issuer.
• Withdrawal Notice: The service update categorized by network will indicate which withdrawals have been truly restored.
• Reserve snapshots: The handling of dates, assets to be overwritten, and frozen balances will determine what the new report can illustrate.
• Technical Review: Ultimately, it should be clarified that internal access, signature authorization, and on-chain transfers need to be connected together.
• Loss reconciliation: The publicly disclosed investments and recovered assets of Binance will determine their final financial exposure.

Frequently Asked Questions

Binance What is the amount affected?

Binance is estimated to be around 6.3 billion US dollars. The separate tracking of TRM, based on the price at the time of asset departure, initially estimates the transferred value to be about 6.36 billion US dollars.

How much has been frozen?

Binance represents approximately $3 billion. Calculated based on the rounded figures from the exchanges, this accounts for about 47.6% of the estimated impact.

Does freezing equal recovery?

No. The $3 billion only refers to the restriction on asset mobility, and further steps are needed for the actual return or recovery.

Will customers bear the losses?

Binance has committed to covering all losses through SAFU and company funds. Their statement lists two sources of funds, but does not disclose how much each will ultimately contribute.

Did the attacker steal the private key?

Binance indicates that no evidence of wallet private key leakage has been found. Blockaid 50 instances were identified in this Ethereum attack, EIP-7702 authorization was involved, but the full details of the internal intrusion are still under investigation.

Are all transfers completed through EIP-7702?

No. Blockaid describes other ordinary signature transfers, while TRM tracks outflows across 10 networks, including Bitcoin and Tron.

Can the balance on SAFU at the end of February be considered the current balance?

No. The 15,000 BTC balances mentioned in the report, along with their February valuation, are from the announcements at that time, and not from the new reconciliation results of October.

Binance What will be promised to be released next?

Binance has committed to releasing an updated reserve report and a technical review, which correspond to the support situation and the details of the intrusion respectively.

This article is for informational and educational purposes only and does not constitute financial or investment advice. The figures mentioned in the text reflect regulatory documents and reports available at the time of writing and may change with each disclosure. The content herein does not constitute a recommendation to buy, sell, or hold any securities or assets. Please conduct your own research. The information is valid as of October 30, 2026.