Where Did Binance's $6.3 Billion Go How the Record-Breaking Hack Happened and Whether the Money Will Be Returned

On October 30, 2026, the cryptocurrency exchange Binance reported a large-scale cyberattack during which digital assets worth approximately $6.3 billion were withdrawn from its wallets. According to the company’s preliminary assessment, the attackers may have gained access to the internal infrastructure through a compromised laptop belonging to a DevOps engineer and used internal systems to make unauthorized transfers.

The bulk of the funds was transferred in about 20 minutes, with transactions occurring simultaneously across ten blockchain networks. Binance, together with its partners, announced that it had frozen approximately $3 billion in assets; however, the remainder of the stolen cryptocurrency remained beyond its control. Binance also announced that it had set aside more than $6.34 billion of its own funds to fully cover user losses. Of this amount, $5 billion is already held in the same tokens that were affected by the attack. The company has begun returning assets to customers.

There are also signs linking the attack to previous cryptocurrency thefts. On-chain researcher ZachXBT discovered that funds from the Binance and Bitget hacks ended up at the same address after being transferred via THORChain. Analysts at TRM Labs and Chainalysis believe the North Korean group TraderTraitor is likely involved, but the attackers’ identities have not yet been officially confirmed.

UA.News examines how the hack occurred, why security measures failed to stop the transactions, how billions of dollars were frozen, and what risks the incident poses to users and the crypto market.

What Happened to Binance and How Hackers Withdrew Billions

The first suspicious transactions occurred on the evening of October 29 at approximately 8:05 p.m. UTC. According to TRM Labs, within the next 20 minutes, the attackers transferred a significant portion of the funds from Binance’s hot wallets, which are used for day-to-day customer transactions. Some unauthorized transfers continued even after this initial phase.

In total, researchers traced approximately $6.36 billion in assets across ten networks: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon. The largest amounts were on Ethereum—about $3.79 billion. Over 200,000 ETH, as well as significant amounts of USDT, USDC, and other tokens, were stolen from this network. 

Another approximately $1.47 billion was transferred to Bitcoin—18,270 BTC. Funds totaling approximately $628 million passed through Tron, $296 million through the XRP Ledger, and nearly $96 million through Solana.

The scale and speed of the transfers drew particular attention from analysts. The attackers operated simultaneously across different blockchains, each of which has its own rules for conducting transactions. This indicates prior preparation and possible access to infrastructure that supports multiple networks simultaneously.

In a statement dated October 30, Binance estimated the total impact of the incident at approximately $6.3 billion. According to this preliminary estimate, the attack surpasses the previous record—the Bybit hack in February 2025, when approximately $1.5 billion was stolen. However, the $6.3 billion figure represents the value of assets affected by the attack, not the final, irrecoverable losses: some of the funds have already been frozen, and cryptocurrency prices fluctuate.

How a Compromised Laptop Could Have Granted Access to Binance Wallets

The leading theory regarding the breach involves a work device belonging to one of the exchange’s employees. Binance reported that hackers may have compromised a DevOps engineer’s laptop and then gained access to a service container, using it to send unauthorized withdrawal requests.

DevOps specialists manage the technological infrastructure, software deployments, and the automation of internal processes. In large financial companies, these tools can interact with services that process transactions. A laptop breach alone does not grant access to cryptocurrency, but access to a critical service environment can create such a risk.

Importantly, the exchange found no evidence that private wallet keys were stolen. A private key allows for the cryptographic verification of asset transactions. In this case, the attackers likely used a different method—they forced Binance’s internal infrastructure to generate and sign transfers to addresses under their control.

An analysis by TRM Labs supports this theory: the transactions bore valid digital signatures from the corresponding Binance wallets. To the blockchain, they appeared technically valid, even though they were actually carried out without the company’s authorization. Thus, the vulnerability may not have been the networks’ cryptographic algorithms, but rather the access mechanisms to the system that manages transaction signing.

At the same time, Binance Co-CEO Richard Teng clarified that the attack was significantly more complex than simply exploiting a single employee’s access. 

“I want to emphasize: the attacker did not simply exploit the access rights of a single engineer, and this was not a single ‘one-click’ action. The attack was more complex and consisted of several stages. At this time, our investigation has not identified any specific employee as responsible,” said Richard Teng.

Thus, the compromise of a work device remains one of the preliminary theories regarding the breach, but it does not explain all stages of the attack. Binance continues to determine how the attackers gained access to internal services and were able to initiate transfers. The company promises to release a detailed technical report once the investigation is complete.

Why the security system didn’t stop the transactions

Exchanges store assets in cold and hot wallets. The former are isolated from a constant internet connection, while the latter enable quick account deposits and cryptocurrency withdrawals. The automation of hot wallets speeds up customer service but makes it especially important to protect the internal mechanisms for confirming transfers.

The most complex part of the attack took place on the Ethereum network. Researchers at TRM Labs determined that the hackers exploited the capabilities of EIP-7702—a mechanism introduced during the Pectra update in May 2025. It allows a regular Ethereum address, after signing a special authorization, to execute smart contract logic.

According to analysts, the attackers had prepared 50 such authorizations in advance for one of Binance’s main wallets, tailored for different address states. After the corresponding authorization was activated, the wallet began executing code controlled by the attacker. In approximately three minutes, 167,464 ETH and dozens of other tokens—including about 1.615 billion USDT—were withdrawn from it.

The problem was not limited to a single transaction. The delegation remained active, so funds arriving at the compromised address later could also be withdrawn. Researchers recorded several such transfers over the following hours.

At the same time, EIP-7702 does not explain the compromise of all wallets. On Bitcoin, Tron, Solana, and other networks, the attackers used standard signed transactions. This reinforces the assumption of broader access to Binance’s internal services, rather than a single isolated vulnerability in Ethereum.

Preparations began well in advance: TRM Labs tracked activity on associated addresses at least 36 hours before the main attack. The attackers wrote code, tested it, and prepared addresses to receive funds. Why the monitoring system did not stop the large transfers sooner, as well as what permissions the compromised services had, remains to be determined.

How approximately $3 billion in assets were frozen

Immediately after detecting the attack, Binance began coordinating efforts with stablecoin issuers, blockchain analysts, and law enforcement agencies. This is what made it possible to quickly restrict the movement of a significant portion of the stolen tokens.

Unlike Bitcoin, which has no centralized issuer, some stablecoins have mechanisms for blocking specific addresses. Their issuers can freeze tokens linked to criminal activities if there are sufficient grounds to do so.

Tether blocked approximately 1.77 billion USDT, and Circle blocked about 825 million USDC. Transactions involving other stablecoins, including RLUSD and USD1, were also restricted. The Arbitrum team, using emergency powers, transferred 8,426 ETH and 74.6 million ARB—with a total value of approximately $30 million—to a secure wallet.

As of the early hours of October 30, analysts confirmed that approximately $2.7 billion in assets had been frozen. Binance itself reported a figure of about $3 billion. The discrepancy stems from the timing of the assessment and the specific transactions considered by researchers and the exchange.

A freeze does not equate to an automatic refund. The tokens may remain at the attacker’s address, but the attacker will no longer be able to move them freely. Additional technical and legal procedures may be required for a final refund.

Where was the cryptocurrency that wasn’t blocked in time moved?

The hackers attempted to preempt the freezing of stablecoins by quickly exchanging them for Bitcoin, Ethereum, and other assets that lack a centralized freezing mechanism. To do this, they used decentralized trading and lending protocols.

Approximately 325 million USDT was exchanged for 122,300 ETH via UniswapX and other tools. The attackers even accepted unfavorable exchange rates, as speed was more important than losing a portion of the assets’ value. Through the Aave lending platform, they also deposited about 60 million USDT as collateral and borrowed approximately 19,760 ETH.

At one of the early stages of the investigation, analysts estimated the value of the attackers’ assets—which were no longer under the control of the issuers—at over 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion. These figures do not represent the final tally of the stolen assets: some of the addresses may have been involved in subsequent trades, and the value of the coins fluctuates with the market.

What Links the Binance and Bitget Hacks

On October 30, on-chain researcher ZachXBT reported a connection between the cash flows of the two cryptocurrency attacks. According to the published data, funds stolen from Binance and assets from the previous Bitget hack were transferred via the THORChain protocol to a single cryptocurrency address.

THORChain allows assets to be exchanged between different blockchains without a traditional centralized exchange. It is a legitimate technological tool, but it can also be used by criminals to quickly move cryptocurrency between networks. When funds from different incidents converge at a single address, investigators have grounds to verify whether the perpetrators or intermediaries of these transactions are connected.

According to ZachXBT, the address 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 served as a common transfer point. The Bitget hack, which the researcher linked to this scheme, was previously estimated at approximately $388 million. Furthermore, it had already been implicated in investigations into the activities of the North Korea-linked TraderTraitor group.

Why the North Korean TraderTraitor group is suspected

Several researchers support the theory of a North Korean connection. TRM Labs stated it has a high degree of confidence in TraderTraitor’s involvement. Among the arguments are the advance preparation of infrastructure, the method of obtaining authorizations, the nature of the fund flows, and the use of services that make it difficult to track cryptocurrency.

In particular, addresses linked to the attackers were receiving small transfers via Tornado Cash even before the main breach. This service can hide the direct connection between the sender’s and recipient’s addresses. The mere fact of its use does not prove the involvement of a specific group, but it is considered alongside other technical indicators.

Chainalysis published similar findings. Its leadership linked the possible organizers to previous hacks, while cautioning against definitive attribution until the investigation is complete. In a comment to Reuters, a Chainalysis representative noted that the company is continuing to analyze the circumstances of the incident. According to an initial assessment, its specialists have traced the movement of at least $5.912 billion.

TraderTraitor has already been implicated in one of the largest crypto thefts of recent years. In February 2025, approximately $1.5 billion was stolen from the Bybit exchange. The U.S. FBI officially linked this attack to North Korea and described the rapid movement of assets between cryptocurrencies and numerous addresses.

Another notable case was the 2024 hack of Japan’s DMM Bitcoin, in which over $300 million was stolen. According to the investigation, the attackers used social engineering: they posed as recruiters and, through a malicious test assignment, gained access to the work environment of an employee at a partner company. 

This story demonstrates that the target of an attack may not be the blockchain itself, but rather a person with access to financial infrastructure. However, there is currently no evidence of a similar scheme involving a fake job posting in the case of Binance.

North Korean groups are drawing the attention of law enforcement not only because of the scale of individual thefts. The U.S. and other countries link their activities to attempts to obtain financial resources while circumventing international sanctions. Cryptocurrency platforms are an attractive target due to the concentration of large assets and the ability to quickly transfer them across jurisdictions.

Will Binance customers lose their money?

On October 30, Binance announced new measures to compensate users for their losses. The exchange has already set aside more than $6.34 billion of its own funds to fully cover any potential asset shortfall.

Of this amount, $5 billion is already held in the very same cryptocurrencies and tokens affected by the incident. The company is purchasing the remaining necessary assets on the open market and through over-the-counter (OTC) transactions.

According to Binance, this process may take time due to the limited liquidity of certain tokens and the duration of settlements for large over-the-counter transactions. However, the company has already begun returning assets to users affected by the attack.

“Binance has already begun returning assets to users affected by the incident, and continues to collaborate with law enforcement agencies, issuers, blockchain analytics firms, and other industry participants to track, freeze, and recover additional funds,” the official statement reads.

Importantly, the $6.34 billion set aside does not include approximately $3 billion in assets that have already been frozen. These funds are in the process of being returned and undergoing additional verification. 

The company emphasized that it will use its own resources to cover any confirmed shortfall. Once the process of safeguarding client funds is complete, they plan to publicly confirm this through an updated Proof of Reserves report.

How the Attack Affected Bitcoin and the Cryptocurrency Market

News of the Binance hack quickly affected digital asset prices. On October 30, Bitcoin lost more than 3% and fell to approximately $76,400—a six-week low. Ethereum also fell by more than 3%, to approximately $2,180. The negative reaction also affected the stocks of companies in the cryptocurrency sector, including Coinbase and Strategy.

Experts were concerned not only about the value of the stolen assets but also about a potential liquidity shortage. Binance plays a crucial role in global cryptocurrency trading. If clients and market makers cannot quickly withdraw funds, it becomes more difficult for them to move capital between platforms and maintain stable buy and sell prices.

Aravind Srinivasan, a representative of the market maker GSR, reported that during the peak of the turmoil, the spread between Bitcoin’s bid and ask prices on Binance’s spot market was about five times higher than usual, and for Ethereum, about 2.5 times higher.

Transfer restrictions also create problems for traders who use leverage. When funds are locked on one exchange, they cannot be transferred to another in a timely manner to cover positions. This can lead to forced liquidations and additional market volatility.

Analysts note that the further reaction depends on how quickly Binance resumes operations, the volume of returned assets, and the credibility of security guarantees. That is why the consequences of the incident extend far beyond the exchange’s immediate financial losses.

What Needs to Change in Cryptocurrency Exchange Security Following the Attack on Binance 

Binance has temporarily suspended withdrawals to conduct a comprehensive audit of relevant services and cryptocurrency addresses, and has revoked the authorization of the address linked to the incident.

Law enforcement agencies and companies specializing in blockchain transaction analysis have been brought in to assist with the investigation. They are helping to track the further movement of the stolen assets, identify related addresses, and ensure the return of funds.

“Our teams are working around the clock to ensure a safe and comprehensive resolution of the incident. We are working closely with law enforcement agencies to identify the perpetrators and bring them to justice,” Binance stated.

For Binance itself, the key priorities remain the full restoration of operations, fulfilling obligations to users, and publishing a technical report. The report is intended to explain how an unauthorized party gained access to the transaction verification systems and why the control mechanisms did not respond quickly enough.

Meanwhile, investigators continue to track the cryptocurrency. The link identified by ZachXBT between funds from the Binance and Bitget hacks could help piece together a broader picture of asset movements and verify the “TraderTraitor” theory. For now, the main takeaway from the incident is that it is not enough for crypto exchanges to simply secure their keys: they must also reliably monitor the people, devices, and programs authorized to manage billions of dollars.