A folkfox special report.
The Binance breach:
where did $6.3 billion go?
An estimated $6.3 billion moved from Binance wallets. The exchange says about $3 billion has been frozen and pledges to cover losses. The investigation is still unfolding.
By the folkfox newsroom. The illustrations are conceptual.
Twenty minutes, ten blockchains
On 29 October, cryptocurrency began moving out of wallets associated with Binance. TRM Labs, a blockchain intelligence company, estimates that approximately $6.36 billion in assets moved across ten blockchains, most of it in about twenty minutes. Binance's own initial estimate was approximately $6.3 billion.
These are estimates of the value affected at a particular time. They are not a final statement of what the attacker can spend, what will ultimately be recovered, or the cost to Binance after recovery. TRM calls it the largest cryptocurrency hack in history. The estimate exceeds the approximately $1.5 billion Bybit theft in 2025, which the FBI attributed to North Korea, according to TRM.
The wallets at the centre
A hot wallet is connected to systems that can transact. It supports everyday deposits and withdrawals, which makes access and signing controls central to the exchange's security. A cold wallet keeps signing material offline, reducing some forms of network exposure but not eliminating every operational risk.
In this case, the publicly described movements involve exchange wallets, not evidence that the underlying blockchains were broken. The Next Web describes funds moved from Binance wallets. The technical account is still developing.
The laptop was an initial lead
Binance's initial incident notice, reported by SecurityWeek, said a compromised DevOps engineer's laptop may have allowed an attacker to reach a service container and submit unauthorised withdrawals. It also said it had found no evidence of a wallet private-key leak.
That was not the end of the investigation. Binance later said it had identified additional points of breach and described the attack as complex. It has not established a complete public account of how the attacker obtained every necessary permission. The laptop is a preliminary lead, not a proven single point of failure. AFP reports the later update.
What the transactions show
TRM says the first major transfers began at about 20:05 UTC on 29 October. Its analysis describes an EIP-7702 delegation on Ethereum and ordinary signed transfers on other networks. On-chain activity can show how assets moved; it cannot, on its own, show every step inside a company's infrastructure.
EIP-7702 is an Ethereum mechanism that lets an account authorise code to act in its context. A legitimate feature can become dangerous when authority is misused. TRM's interpretation of these transactions does not establish a leak of private keys, and Binance says its investigation has found no evidence of one. Nor does this Ethereum-specific account explain every transaction on the other networks.
Frozen is not returned
Binance says it worked with partners to freeze roughly $3 billion of affected assets on-chain. SecurityWeek reported that TRM tallied about $2.7 billion frozen by 00:30 UTC on 30 October, including assets frozen by Tether and Circle. These are different observations at different times, not figures to add together.
A freeze can stop certain tokens from being moved by the address that holds them. It does not by itself return the assets to Binance or settle who owns them. The ability to freeze depends on the asset and the infrastructure behind it. Native cryptocurrencies and issuer-controlled tokens do not necessarily offer the same intervention options.
About $6.3 billion
Binance’s initial estimate of the total impact. It is not the final net loss or an amount proven permanently unavailable.
About $3 billion
Binance says partners froze roughly this amount. Frozen does not mean recovered or returned.
Who pays if money is missing?
Binance says it will cover losses using its Secure Asset Fund for Users, known as SAFU, and company funds. It has also said it will publish updated proof of reserves after remedial work. These are company commitments, not an independent verification of its financial position or proof that frozen assets have been recovered.
The distinction matters because a reserve fund, company capital and recovered assets are different sources of support. A claim that a particular amount has moved out of wallets is not the same as a claim that individual users have permanently lost that amount. The final accounting depends on the investigation, recovery and what Binance actually does.
The attribution question
TRM attributes the attack to TraderTraitor, which it identifies as a North Korean hacking operation, with high confidence based on on-chain and off-chain intelligence. Chainalysis has also linked the incident to TraderTraitor, according to The Next Web. These are assessments by investigators. The public cannot independently inspect all of the intelligence behind them.
The FBI's attribution of the earlier Bybit attack does not establish responsibility for this Binance breach. Similar techniques or an overlap in alleged actors can be relevant leads, but each incident still needs its own evidence.
The trading screen and the pause
Reports on which services were paused differ and have changed as the response has progressed. Binance's first notice said deposits and withdrawals were temporarily suspended. A later Binance account described deposits as having remained open. At around 09:00 UTC on 30 October, Binance said it expected withdrawals to resume in about 45 hours, AFP reports. That was a company estimate, not a guarantee.
Those accounts should not be flattened into a single timeless claim. Customers should check the latest notice for their own jurisdiction and service. Short-term cryptocurrency prices also move quickly, so a price seen during the incident is a snapshot, not a settled measure of its eventual market impact.
What the research can and cannot tell us
A 2026 USENIX Security study by Mingyuan Huang and colleagues examined risks associated with EIP-7702 smart accounts across seven blockchains. The authors describe how programmable account behaviour changes security assumptions and can enable new attacks. Their study is context for understanding the mechanism, not evidence that its sampled attacks caused the Binance incident.
A systematic review of wallet security by Sabine Houy, Philipp Schmid and Alexandre Bartel examines vulnerabilities across wallet software and operating systems. It helps explain why security involves more than the underlying cryptography. None of that proves which particular control failed at Binance. The investigation has to answer that question.
The questions still open
The decisive public questions are how access was obtained across the relevant systems, which permissions were misused, whether any additional affected assets have been identified, and how much can actually be returned. The identities behind the attack and the timetable for full service restoration remain matters for investigation and updated company statements.
The incident shows a tension at the centre of exchange custody. Funds must be available to move when customers ask for them, yet every authorised route to move them needs protection. The ledger tells us where transactions went. It does not tell us everything that happened before they were signed.
Read the folkfox newsroom and our report on security and third-party access.
Quick answers
How much was affected in the Binance breach?
Binance estimated the impact at around $6.3 billion. TRM Labs estimated approximately $6.36 billion moved across ten blockchains, valued at the time of movement.
Has the frozen money been returned?
A freeze restricts movement of eligible assets. It does not by itself establish that the assets have been recovered or returned.
Has Binance said how it will cover losses?
Binance says it will cover losses using SAFU and company funds. This is a company pledge, not an independent audit of its reserves.
Who was responsible?
TRM and Chainalysis have attributed the attack to North Korean actors. These are investigators’ assessments; the evidence underlying every part of the attribution is not public.
Did a single compromised laptop cause the entire breach?
Binance initially identified a compromised laptop as a possible entry point. It later said it found additional points of breach and that its investigation continues.