Developments
Binance hack: losses, reserves and access
The October 29 theft, the recovery reported by November 1, and why replacing assets, recovering stolen funds and restoring withdrawals are separate tests.
Status reviewed on 1 November 2026. This article separates company statements, external investigations and illustrative calculations. Network availability can change after publication.
The Binance theft is a financial loss and an operational interruption. Assessing the response requires three questions: how much was stolen, how much Binance can recover or replace, and when customers can actually move their capital.
Binance estimates the impact at approximately $6.3 billion. Its 30 October update says it reserved more than $6.34 billion of company funds, including about $5 billion already held in the affected tokens, and would absorb the loss through SAFU and its corporate treasury. Those are company disclosures; they do not establish the complete financial position of the business.
What changed by 1 November
In its 1 November recovery update, Binance reports that approximately 95% of the affected amount has been replenished, compared with 90% previously. It says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed. The remaining affected tokens are less liquid and take longer to source.
The same announcement sets a first withdrawal reopening window of 06:00–09:00 UTC on 1 November, with access restored progressively by asset and network. Deposits remain operational. Inclusion in the rollout is not a guarantee that every withdrawal is immediately available; Binance directs users to check the specific asset/network pair and warns about possible processing delays.
These updates change the assessment from the initial freeze. A pre-restoration estimate of a BTC or ETH reserve shortfall should not be presented as the current position. The next test is sustained withdrawal processing alongside the reported backing.
How large was the theft?
TRM Labs traced approximately $6.36 billion across ten blockchains, valuing transfers at the time they occurred. Its breakdown is an early investigation snapshot, as of 00:30 UTC on 30 October, rather than a current attacker balance.
| Network | Stolen value, approximately |
|---|---|
| Ethereum | $3.790bn |
| Bitcoin | $1.470bn |
| Tron | $0.628bn |
| XRP Ledger | $0.296bn |
| Solana | $0.096bn |
| Arbitrum, Optimism and Base combined | $0.039bn |
| Avalanche | $0.028bn |
| Polygon | $0.010bn |
The rounded rows sum to $6.357 billion. Ethereum and Bitcoin together account for about 83% of that table’s value, calculated by Sine Capital. Ethereum here includes multiple tokens, not just ETH.
Elliptic’s investigation gives a separate estimate of $6.43 billion and, in its update dated 1 November at 08:00 UTC, identifies $2.85 billion frozen or seized. Different scopes, valuation times and address attribution can produce different totals. We retain the source labels instead of combining them into a falsely precise figure.
The attack and the investigation
TRM places the first transfers at approximately 20:05 UTC on 29 October. Most of the theft occurred in about 20 minutes, followed by later outflows. On Ethereum, it describes pre-signed EIP-7702 authorizations that delegated wallet behaviour to attacker-controlled code. Other chains used ordinary signed transfers. TRM assesses this as evidence of compromised hot-wallet signing infrastructure.
Binance initially identified a potentially compromised DevOps laptop, then reported additional breach points. It said it had found no evidence of leaked private keys. A complete technical explanation remains outstanding in the recovery announcements reviewed here.
On 31 October, the FBI attributed the theft to North Korea’s TraderTraitor activity. It also reported conversion of stolen assets primarily into ETH and asked service providers to block transactions associated with the listed addresses.
For custody assessment, the operational question is which controls can prevent a compromised instruction from reaching a signer, and how those controls are isolated across assets and networks. Valid signatures alone cannot answer that question.
Frozen, recovered and replenished mean different things
Frozen assets have been immobilised or restricted. Recovered assets have returned to the rightful party. Replenished assets have been replaced using another source of funds. Replenishment can restore customer backing before stolen assets are recovered.
This is why a replenishment percentage cannot be read as the percentage of the theft recovered from the attacker. It also cannot be subtracted from the loss to calculate Binance’s eventual expense. Replacement assets funded from corporate resources still have an economic cost.
Binance’s 31 October disclosure describes funding from SAFU and a reallocation of part of the futures insurance funds. It commits to restoring SAFU to approximately $1 billion. The article does not independently verify those fund balances or whether the remaining insurance buffers are sufficient under stress.
A transparent loss sensitivity
The eventual economic loss depends on actual recovery, asset prices and the costs of replacing tokens. The table below uses a fixed $6.3 billion gross theft and varies only recoveries. These are Sine Capital calculations, not forecasts or reported accounting losses. The $3.0 billion case uses the frozen amount reported by Binance as a hypothetical full-recovery input; the $2.85 billion case uses Elliptic’s separate frozen-or-seized estimate on the same basis.
| Illustrative recovery assumption | Gross theft less recoveries |
|---|---|
| $3.00bn ultimately recovered | $3.30bn |
| $2.85bn ultimately recovered | $3.45bn |
| $1.50bn ultimately recovered | $4.80bn |
| No recovery | $6.30bn |
Formula: $6.3bn − assets ultimately recovered. The calculation excludes price changes, execution costs, legal and remediation expenses, and any other recoveries. Frozen assets enter the recovery column only under the stated hypothetical assumption.
Using SAFU changes the funding source; it does not make the economic loss disappear. Nor should SAFU be counted again as a recovery of stolen assets. Before recoveries arrive, replacement can require funding close to the gross amount, even if the eventual loss is smaller.
What public reserves can tell us
A reserve snapshot can help assess holdings and the customer balances covered by that snapshot. It cannot, on its own, establish total corporate equity, all liabilities or the availability of funds during a withdrawal interruption.
Consequently, dividing the theft by customer reserves does not establish that Binance can absorb the loss. Customer assets support customer claims. A solvency assessment also needs corporate assets, liabilities and the resources available to absorb losses. We do not infer an audited profit figure from estimated revenue and an assumed margin.
The recovery announcements are evidence of Binance’s stated response. They support closer examination of the reported replenishment and withdrawal restoration; they do not justify an unconditional solvency conclusion.
What a trading desk should measure next
For a trading team, the immediate constraint is usable capital. An account balance unavailable for withdrawal cannot be assumed available to meet margin needs elsewhere. A hedge on another venue may remain exposed to funding and liquidation risk while transfers are interrupted.
| Question | Evidence to monitor |
|---|---|
| Can capital leave the venue? | Completed withdrawals for the required asset/network pair, including completion time |
| Has backing been restored? | Dated reserve snapshots, covered liabilities and replenishment of the remaining tokens |
| Is the funding buffer being rebuilt? | Subsequent SAFU and futures insurance fund disclosures |
| Has the breach been contained? | Technical post-mortem, affected systems and verified remediation |
| Has the financial loss narrowed? | Assets actually returned, distinguished from freezes and corporate replacement |
The remaining less-liquid tokens also matter operationally. Aggregate dollar coverage can conceal a shortage in a specific asset. The relevant capacity is how much of that asset can be sourced and transferred without excessive delay or market impact.
Restoration should therefore be assessed at the level where a desk operates: the token, the network, the transfer and the time required. A commitment to make customers whole is valuable evidence about intent. Completion requires observable backing and usable access.