Binance Estimates $6.3B Hack Impact, Freezes $3B

Binance’s loss estimate exceeds early wallet tallies

In its October 30 incident update, Binance said it had revoked the affected address authorization and engaged law enforcement and blockchain intelligence partners. The exchange described its investigation as preliminary and promised a technical post-mortem after verification.

The loss-impact check for this report, completed at 03:05 UTC on October 30, found a company estimate of $6.3 billion and a freeze estimate of roughly $3 billion. Subtracting those rounded figures gives about $3.3 billion, but does not establish a final net loss. Asset prices, recovery status and the scope of the two estimates can change.

Earlier, BleepingComputer reported that Arkham was tracking 55 addresses with holdings worth approximately $5.78 billion. That measured assets across tracked wallets, not an independently confirmed theft total. It should not be added to Binance’s later figure or presented as a separate attack wave.

The report also recorded Etherscan’s exploiter label on the initial receiving address. Neither that label nor the number of tracked addresses supplies a count of affected customers. Binance’s reviewed update did not disclose a customer count, victim-by-victim losses or a final recovered amount.

This event is distinct from the monthly Binance outflows reported in July, which measured net movements and did not establish theft. Here, the exchange explicitly describes unauthorized withdrawals and a security response.

Laptop investigation leaves Binance signing questions open

Binance said a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. It said it had found no evidence of a wallet private-key leak. That preliminary explanation does not settle how the attacker obtained effective transaction authority.

Blockaid’s investigation describes a key compromise and abuse of Ethereum’s EIP-7702 delegation mechanism. Its assessment differs from Binance’s statement about the absence of evidence of leaked private keys; the two accounts should not be treated as an agreed final root cause.

Blockaid traced an initial sweep at 20:24:23 UTC on October 29 involving 167,464 ETH, 1.615 billion USDT and about 60 other tokens, worth roughly $2.5 billion at the time. The Ethereum transaction record provides a public trail for that transfer, rather than a complete accounting across every affected network.

The investigator also described later sweeps of funds arriving at the delegated wallet. These were repeated drains within the unfolding incident, not evidence by themselves of unrelated attacks against individual Binance users.

Ethereum’s EIP-7702 specification allows an account to authorize execution of another contract’s code. The distinction is consequential: valid authorization can grant dangerous powers without a flaw in Ethereum’s consensus rules. Establishing who could authorize those powers is central to explaining the exchange breach.

Frozen assets and SAFU pledge leave recovery unfinished

Freezing tokens can restrict an attacker’s ability to move them. It does not automatically mean those tokens have been returned to the exchange or credited to customers. A recovery total needs to distinguish assets traced, immobilized and actually restored.

Binance’s SAFU explanation listed a fund of 1 billion USDC as of January 2026. That dated figure is not proof of the fund’s incident-day balance. The company’s pledge expressly includes its own funds, so it should not be read as a claim that SAFU alone covers the gross impact.

Binance’s proof-of-reserves page describes evidence of assets held against customer balances. A fresh reserve report would help assess restoration after the incident; an earlier snapshot cannot establish what remains available after unauthorized transfers.

The broader custody question follows a week in which Coinbase’s earnings highlighted growing customer USDC balances. Customer adoption figures and corporate income do not establish that a custodian’s withdrawal systems can withstand an intrusion.

The Fear & Greed Index read 30, or Fear, when checked for this report, down from 51 a day earlier. It measures broader market sentiment and cannot quantify Binance’s solvency or the probability of recovery.

The next substantive checks are a confirmed reopening time, completed recoveries, updated reserves and a verified post-mortem. The reviewed announcement supplied no reopening schedule or final attacker attribution, leaving both customer access and the complete financial accounting unresolved.