Binance, missing crypto and a permission that stayed
A paper-points activity explains the Binance incident, lasting digital permissions and why frozen funds are not the same as returned funds.Explained to kids
Hi! I am Bit, the robot drawn beside this story. I brought a paper-points game. You do not need money or an account to play.
Binance, a company that holds digital assets for people, reported a major theft on 29 October 2026. Some assets were stopped from moving afterward. That did not mean they had gone back to their owners. This story follows a permission that stayed switched on, and explains why stopping something and undoing it are different.
Checked 30 October 2026. These are snapshots: Binance’s funding update was published at 10:55 UTC; the team’s Ethereum record check was around 13:03 UTC; its browser check was at 13:31 UTC. UTC is a shared world clock. None of these checks promises that services are working now.
What is it?
Cryptocurrency, often shortened to crypto, is a kind of digital asset. It exists as computer records, not little coins sitting inside a phone. An asset is something people can own. Binance holds crypto on behalf of users, so problems with the company’s controls can affect other people’s holdings.
A blockchain is a shared record of actions, such as transfers between accounts. A network of computers maintains it using agreed rules. Think of a club record book with copies checked by many computers, rather than one person’s private notebook.
There are different blockchains, with different records and rules. Ethereum and Bitcoin are two examples. Researchers at TRM, a company that studies digital transfers, reported movements out of Binance across ten networks. The team behind the grown-up article checked a particular Ethereum sequence, not every movement on every network. (TRM (opens in a new tab))
Imagine a school club with a digital storeroom. A permission card allows a helper program to act for the club. A program is a set of computer instructions, like a recipe. What matters is what that card allows, and how long it lasts.
The comparison stops here: real crypto is not school equipment, and no teacher controls all blockchains. Different networks have different ways to respond when something goes wrong.
How does it work?
On Ethereum, a rule called EIP-7702 lets an account point to another program to perform actions for it. This is called delegation, like giving a helper permission to act for you. The permission stays until it is replaced or cleared. It is not a pass that automatically expires after one use. (EIP-7702 (opens in a new tab))
Giving permission and using it are separate steps. In this incident, one recorded action installed the delegation. A later action used it to move assets out. Follow the permission through three events in Ethereum’s records: when it appeared, when it was used, and when it was cleared. Notice that removing it comes after the assets have already moved.
29 October, 20:20:59 UTC
Permission is installed
The account starts pointing to another program. The permission remains available after this action ends.
29 October, 20:24:23 UTC
A separate action moves assets
A later call, meaning a request to run the program, moves assets out. Permission and use happened at different times.
30 October, 00:10:35 UTC
The delegated code is cleared
The account no longer points to that program’s code, meaning its computer instructions. This does not rewind the earlier transfers.
The later check found no delegated code at block 26,305,745, a numbered bundle of recorded actions. Its timestamp was 30 October, 13:03:11 UTC. Two services agreed on that result. This checks one account at one recorded moment; it is not proof that Binance’s entire system was safe. The grown-up investigation explains the method and its limits.
A private key is secret digital information that can authorize actions, rather like a special signing stamp. For the kind of Ethereum account checked here, it is not a website password you can simply replace. Clearing delegated code does not change that key or bring money back.
A digital signature shows that an action passed the relevant signing rules. It does not prove that a person understood and intended it. A record of a signed action cannot, by itself, explain everything that happened inside a company.
Why does it matter?
Binance says the incident caused about $6.3 billion in impact. A billion means one thousand million. It also says about $3 billion was frozen, and over $6.34 billion of separate company funds was reserved to cover the incident. These are company statements, not totals independently counted by this page. (Initial findings (opens in a new tab), funding update (opens in a new tab))
Those labels describe different things. Frozen means certain assets cannot move under the controls being used. Some tokens, digital assets managed by programs, have freezing controls available to their issuer, the organization responsible for issuing them. Freezing assets at a recipient’s address does not place them back with their previous owner.
The basic assets ETH on Ethereum and BTC on Bitcoin do not have a token issuer with that same freezing switch. That does not mean every network has identical rules or that every possible intervention is impossible.
Reserved company funds means the company says it has set aside its own assets for cover. That is different from recovering the assets that left. The three big figures cannot be added together as a total recovered. They also do not establish a final loss checked by an independent financial review, or prove everyone has been repaid.
Investigators still had unanswered questions about the cause. Binance’s later update said investigators had found additional places where its systems had been breached, meaning accessed without permission. Blaming one laptop or one employee would go beyond the evidence. The Ethereum sequence explains one part, not the entire incident. (Investigation update (opens in a new tab))
There was uncertainty about services, too. The team’s 13:31 UTC browser check showed no usable status rows on Binance’s status page. That could not establish whether deposits or withdrawals were working. An empty display is missing evidence, not a green light.
Try it
This is an entirely imaginary exercise, not Binance’s numbers. Use paper only. Draw a club box and a recipient box. Write 100 points in the recipient box to represent points that left the club. Mark 30 of those points as unable to move. Leave them in that box.
On a separate piece of paper, write 100 new points that the club sets aside from its own supplies. Keep that paper separate from the first drawing. Nothing in these steps moves the original points home. The drawing makes the distinction visible without a digital wallet, a tool for managing crypto accounts. No website connection or real transfer is needed.
Can the club say it recovered 130 points?Think first, then tap to see the answer
No. Thirty original points are stuck in the recipient box. One hundred new points are separate cover. Neither step shows original points coming home. Keep looking at which box holds them.
Choose an answer below. If the buttons do not work because JavaScript is off, use the written answer key afterward.
Answer key, also for reading offline: 1: the points cannot move under that control. 2: separate replacement cover. 3: that delegation was removed at the checked moment. You can answer aloud and compare with this line without using the buttons.
What to do
You do not need to buy crypto, open an account or send money to understand this story. Keep the activity on paper. Children do not need to investigate real accounts or test the company’s systems.
A grown-up checking an incident should compare dated official statements with what each check actually proves. A promise to cover a loss is not a receipt showing repayment. A removed permission is not proof that every problem is fixed.
If someone offers to recover funds and asks for a private key, do not share it. Nobody needs your private key to return funds to you. Show the message to a trusted grown-up rather than following its instructions.
I would keep the paper boxes separate. That way, a promise, a stopped movement and a return cannot accidentally become the same thing.
Sources
For grown-ups: this adaptation uses the approved investigation’s evidence only. These are historical source and check times, not new service assurances. The linked technical material is background for adults, not an activity for children.
- Binance, 30 October 2026: initial findings, last edited 02:25 UTC (opens in a new tab), investigation update, 08:47 UTC (opens in a new tab), funding update, 10:55 UTC (opens in a new tab).
- TRM, North Korea Steals USD 6.36 Billion from Binance in the Largest Hack in History (opens in a new tab), observations as of 30 October 2026, 00:30 UTC. The title is the researchers’ attribution, not an independently confirmed identity here.
- Ethereum, EIP-7702 (opens in a new tab), Final; recorded transactions: delegation, 29 October (opens in a new tab), separate transfer action, 29 October (opens in a new tab), code clearing, 30 October (opens in a new tab), 2026.
- Grown-up investigation and retained record-check context: read-only checks using dRPC and PublicNode around 13:03 UTC; Binance network-status page (opens in a new tab), browser check 13:31 UTC, 30 October 2026. No fresh queries were made for this adaptation.
