Key Notes
- Binance estimates the hack’s impact at about $6.3 billion and promises full coverage through SAFU and company funds.
- Investigators trace wallet-signing abuse, including persistent EIP-7702 delegation on Binance 14.
- Around $3 billion is frozen according to Binance, while recovery totals and the complete entry path remain unresolved.
Binance’s estimated $6.3 billion hack has become a test of more than an exchange’s ability to absorb a loss. Investigators are reconstructing how its own wallet-signing infrastructure could authorize a multichain drain, why one Ethereum wallet kept executing attacker-controlled code, and how much of the stolen money can still be recovered.
The clearest conclusion from the new investigations is that this was a compromise of the systems controlling Binance’s hot wallets. The Ethereum evidence does not establish a failure of the blockchain’s consensus, and valid signatures alone do not prove that private keys were extracted. That distinction is central to understanding the attack.
Binance estimates the impact at approximately $6.3 billion, says roughly $3 billion in affected assets has been frozen, and pledges to cover losses through SAFU and company funds. Its latest visible update keeps deposits available and targets a withdrawal restart 45 hours after its October 30 announcement. These are company statements; they are separate from an independently reconciled recovery total.
This explainer brings together Bitquery’s investigation, Ondology Labs’ transaction reconstruction, Binance’s statements and CoinScreamer’s reporting since the first alerts. Research figures below retain their original observation times because balances, valuations and freezes are changing.
The Attack Path, Explained Visually
What Binance Has Confirmed
In its preliminary account, Binance said a compromised DevOps engineer’s laptop may have allowed an attacker into a service container, from which unauthorized withdrawal transactions were submitted. It also said it had found no evidence of a wallet private-key leak.
The exchange’s 08:47 UTC investigation update then disclosed additional breach points without identifying them. The laptop account therefore remains an initial finding rather than a complete explanation of how the attacker obtained and exercised access.
Binance repeated that customer funds were safe and that SAFU plus company resources would cover all losses. Those assurances describe its commitment to customers. They do not mean the theft was reversed, withdrawals had resumed or every frozen token had returned to Binance. Our report on the exchange’s coverage pledge explains the initial company response.
How One Wallet Became an Execution Engine
The most revealing Ethereum sequence involves Binance 14. Ondology Labs traces a transaction at 20:20:59 UTC on October 29 that submitted 50 signed EIP-7702 authorizations for the wallet, covering consecutive nonce values. A nonce is a counter used to order activity and prevent replay; targeting a range addressed the difficulty of matching a busy wallet’s changing counter.
The researcher identifies an accepted authorization at nonce 18,914,809. This was not 50 successful asset withdrawals. Nor does the protocol generally guarantee that only one authorization can be valid. The important result was that an accepted permission pointed Binance 14 at attacker-controlled code.
Under EIP-7702, an ordinary externally owned account can authorize delegated code to execute in its context. The delegation persists until replaced or cleared. It is broader than a routine token-spending approval: the wallet itself can acquire executable behavior.
Three minutes and 24 seconds later, at 20:24:23 UTC, a separate sweep moved approximately 167,464 ETH, 1.615 billion USDT and dozens of additional tokens from Binance 14. Ondology valued that first major transfer at roughly $2.54 billion. The authorization transaction and subsequent sweep are different records. Our earlier EIP-7702 brief introduced that distinction.
Valid Signatures Do Not Settle How Access Was Obtained
The transaction sequence shows that the attacker obtained usable signing authority. It does not, by itself, distinguish between extracting a private key and persuading or compromising a service that could sign with that key while keeping it inside protected infrastructure.
That is why Binance’s statement that it found no evidence of key leakage can coexist with onchain evidence of valid authorizations. Neither observation settles the final root cause. A definitive explanation requires logs and controls from the signing environment, including what requests it accepted and which policy checks ran.
Ondology’s analysis raises the possibility of a boundary failure between ordinary withdrawals and much more powerful authorizations. That is a research assessment, not a completed Binance postmortem. It also does not explain every chain involved: other hot wallets were drained through ordinary signed transactions.
Why the Damage Reached Another Wallet
Binance 14’s delegated execution was especially consequential because Hot Wallet 34 trusted it to initiate transfers. According to Ondology, that relationship enabled the removal of approximately 823 million USDC: 780 million at 20:41:23 UTC and another 43 million at 20:59:47 UTC.
The second wallet therefore mattered even without the same delegation being installed on it. The episode illustrates how trust between operational wallets can expand the impact of one compromised authority.
Binance 16 followed another path. Ondology records nine ordinary signed transfers beginning at 20:24:47 UTC, including roughly 28,006 ETH, 55.7 million USDT and 25.9 million RLUSD alongside other tokens. Describing the entire incident as a single EIP-7702 exploit would erase these parallel transfers and the attacks on other networks.
The Timeline Behind the Drain
Ondology’s reconstruction traces preparation on October 28–29, including small Tornado Cash withdrawals and tests against separate wallets before the main attack. Funding from a mixer helps describe preparation; it does not, on its own, identify the attacker.
- October 29, 20:20:59 UTC: the Binance 14 delegation transaction submitted the authorization batch.
- 20:24:23 UTC: the first major Binance 14 sweep transferred ETH, USDT and other tokens.
- 20:41–20:59 UTC: two transfers removed approximately 823 million USDC from Hot Wallet 34.
- 21:04 UTC: Circle’s USDC freeze, as timed by the onchain investigations, restricted the receiver’s balance.
- 21:44:11 UTC: another Binance 14 sweep moved about 200.4 million USDT and 370 ETH after a fresh wallet top-up. The USDT reached an already-blacklisted receiver.
- 22:39:35 UTC: Ondology identifies a further sweep of about 128.5 ETH.
- October 30, 00:10:35 UTC: the Binance 14 delegation was revoked. Clearing that authority stopped its future use; it did not claw back assets already transferred.
One detail needs careful handling. Ondology classifies six later calls between 23:36 and 23:56 UTC as attempts that found nothing left to take, while Bitquery describes a broader drain window ending at 23:56. A successful transfer and an empty execution attempt are different evidence. Their timestamps should not be treated as interchangeable proof of additional losses.
Binance says outflows ceased when withdrawals were paused. Reconciling that statement with successful transfers, failed attempts and the timing of individual wallet controls remains a question for the final postmortem.
Why the Loss Totals Differ
The company’s approximately $6.3 billion impact estimate is the headline figure. Research totals differ because they use different chain coverage, observation windows and price snapshots.
Bitquery maps about $6.3 billion across 17 hot wallets on nine chains. Its chain-level figures include approximately $3.77 billion on Ethereum, $1.48 billion on Bitcoin, $628 million on Tron and $300 million on XRP, with smaller amounts on Solana, Arbitrum, Polygon, Optimism and Base. It describes the XRP linkage as an inference from timing and transaction patterns rather than a shared address across those networks.
Ondology’s approximately $6.28 billion, eight-chain presentation includes Avalanche but does not list Base or Polygon in that table. Its own detailed tracing concentrates on Ethereum, Arbitrum and Avalanche, while it attributes other-chain figures to external analysis. TRM Labs’ separate $6.36 billion, ten-chain assessment uses another scope.
These are overlapping estimates of the same incident. Adding them would double-count losses. A token’s value when stolen also differs from its later market value, and tokens purchased with stolen stablecoins are not automatically another theft on top of the original amount.
Frozen Assets Are Not the Same as Recovered Assets
Binance’s latest statement puts frozen affected assets at around $3 billion. Bitquery’s earlier reconstruction identifies about $2.7 billion frozen or rescued within its scope. Neither figure should be presented as a precise, final amount already repaid to customers.
The response involves different mechanisms. Stablecoin issuers can restrict tokens at specified addresses. Separately, Arbitrum’s emergency intervention moved assets into protective custody. Both can constrain an attacker, but a token freeze and a transfer into rescue custody are not identical events.
Timing also matters. Bitquery estimates that 729 million USDT was converted before freezes caught it: about 495 million on Ethereum and 234 million on Tron. Its later USDT accounting differs from the issuer’s earlier public snapshot. Our Tether confirmation and Circle confirmation preserve what each executive had actually announced at that stage.
A blacklist can arrive after an address is empty, or a later transfer can send tokens into an already-restricted address. Counting freeze transactions therefore does not tell readers how much spendable value was stopped. Final recovery will require reconciliation of balances, control, legal processes and any return or reissuance of assets.
Why the Attacker’s ETH Balance Grew
Bitquery’s 06:43 UTC snapshot on October 30 identifies 508,621 ETH under attacker control, compared with approximately 200,630 ETH originally stolen in its accounting. That does not mean Binance lost the difference in additional ETH. The attacker converted stolen assets and used lending markets to acquire more.
Ondology’s slightly earlier 06:25 UTC snapshot records 500,938 ETH. Its reconstruction includes a 435 million USDT swap into about 160,451 ETH, with severe execution costs, and a separate transaction using 60 million USDT as collateral to borrow roughly 19,762 ETH through Aave. Borrowing against collateral and outright selling it must be accounted for differently.
These were investigative snapshots, not live balances at publication. Neither balance should be added to the stablecoins used to obtain it when calculating total theft. Aave’s separate precautionary response is covered in our market-freeze brief; its announcement did not itself establish every transaction described by investigators.
Bitcoin Creates a Different Recovery Problem
The Bitcoin portion cannot be restricted by a stablecoin issuer. Our report on the 19-address split describes an earlier snapshot of approximately 18,270 BTC, then worth about $1.4 billion, distributed across new addresses.
That does not make the coins untraceable or immune from seizure. Exchanges can screen deposits, investigators can follow transactions, and authorities may recover assets if they obtain control of keys or custodial accounts. What Bitcoin lacks is a USDT- or USDC-style issuer that can blacklist the native coins directly.
At 06:43 UTC, Bitquery valued the attacker’s total remaining holdings across its tracked assets at about $3.2 billion. This is another time-specific portfolio valuation, not an audited residual loss after subtracting frozen funds from Binance’s headline estimate.
Who Investigators Say Was Behind It
TRM Labs attributes the theft to North Korea-linked TraderTraitor with high confidence, based on onchain and offchain intelligence. Our dedicated attribution report explains that assessment and distinguishes it from government findings concerning earlier, separate attacks.
Ondology’s technical reconstruction does not independently establish the perpetrators’ identity. Similar preparation, laundering behavior or signing methods can support attribution, but the chain record alone does not name the person operating a wallet.
Our ZachXBT follow-up separately reports his claim that Binance- and Bitget-linked proceeds converged after THORChain transfers. That later reported trail should not be confused with the earlier research snapshots. Bitquery had not identified a bridge exit within its cited snapshot, while Ondology described small bridge tests; neither statement proves that large-scale movement could not occur afterward.
When Withdrawals Could Resume
Binance’s 08:47 UTC announcement targeted withdrawal resumption in 45 hours while deposits remained unaffected. Measured from that statement, the estimate points to approximately 05:47 UTC on November 1. It is an indicative target, subject to security work and further company updates, rather than a fixed reopening appointment or a compensation deadline.
Our 45-hour service update covers the operational details. Earlier reports that both deposits and withdrawals were paused describe an earlier stage of the response and should not override the later deposits clarification.
Coinbase CEO Brian Armstrong has also said his exchange was blocking sends to compromised wallets and had offered assistance. Our report on that offer distinguishes platform-level transfer screening from a network-wide freeze or a completed recovery.
The Financial Questions Behind the Reassurances
The coverage pledge is now central to confidence in Binance. SAFU, company resources, frozen assets and recoverable funds are different parts of the picture; a full account would show how they meet the final liability without counting the same assets twice.
CZ has also pointed to a SpaceX shareholding he values above $1 billion, while Yi He said annual revenue could cover the loss without selling it for now. Our report on CZ’s exchange with Elon Musk explains why those comments do not amount to an announced share sale or audited cash reconciliation.
There are market consequences too, but analyst forecasts should remain distinct from the forensic findings. Our Standard Chartered follow-up covers its assessment of further downside after the incident, rather than establishing that every subsequent price move was caused solely by the hack.
What Still Needs an Answer
The final postmortem needs to explain the additional breach points, how signing permissions were obtained, which wallets shared operational trust, and why dangerous delegation remained active until after midnight. It also needs to reconcile the company’s containment timeline with individual successful and unsuccessful onchain calls.
For customers, the decisive milestones are verified restoration of withdrawals and a transparent account of loss coverage. Until then, “funds are safe” remains Binance’s assurance and commitment, while “frozen” describes restricted assets, not a completed reimbursement.
The early public picture changed quickly. CoinScreamer’s initial wallet-alert and market report and subsequent $5.57 billion outflow report document earlier estimates. The newer company and investigative figures above supersede those preliminary snapshots rather than representing additional thefts to add together.
Reporting note: this article was reviewed on October 30, 2026, at 10:50 UTC. Binance’s latest visible investigation update was issued at 08:47 UTC; the principal Bitquery and Ondology balance snapshots cited here were taken at 06:43 and 06:25 UTC respectively. CoinScreamer has reviewed the published investigations and company statements, but has not independently audited Binance’s systems or reconstructed every multichain transfer.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
