Binance reports $6.3bn impact; cause remains preliminary
Ten-network outflows, frozen assets and company-funded cover measure different things; Ethereum revocation is confirmed, but the intrusion route and live service status remain unresolved.
Executive summary: containment does not establish recovery
Binance estimates around $6.3bn in impact from the 29 October 2026 breach and reports around $3bn frozen. It says over $6.34bn of separate company funds have been reserved to cover the incident. Those statements establish neither completed reimbursement nor a final audited loss. [vendor] (initial findings (opens in a new tab), funding update (opens in a new tab)). Ethereum records confirm persistent delegation, a subsequent sweep and later code clearing. TRM reports outflows across ten networks; the off-chain intrusion route remains preliminary. [reproduced] (Ethereum transaction (opens in a new tab)); [reported] (TRM (opens in a new tab)).
Checked 30 October 2026. Ethereum RPC observations: approximately 13:03 UTC; browser status check: 13:31 UTC. Expanded source retrieval occurred around 13:27 UTC; the latest retrieved Binance funding post was published at 10:55 UTC, not at retrieval time. TRM’s financial observations are a 00:30 UTC snapshot. These clocks describe different evidence, not one simultaneous measurement.
The investigation combines primary-source statements, security-research reports and retained read-only RPC results; it is not a fresh all-chain audit. [reproduced] marks measured results, [vendor] company or issuer statements, [reported] researcher findings, and [inferred] analysis. This revises the evidence update following the 29 October transfer snapshot and early revocation snapshot; earlier observations retain their original time boundaries.
Impact, freezes and company cover are separate accounts
The key figures answer different questions and must not be added into a recovery total:
| Category | Finding and primary evidence | Boundary |
|---|---|---|
| Estimated impact | [vendor] Around $6.3bn, Binance (opens in a new tab) |
Not final audited loss |
| Traced outflows | [reported] ~$6.36bn at transfer-time prices; ~$6.23bn at the report’s current prices, TRM (opens in a new tab) |
Ten-network research estimate; observations as of 00:30 UTC |
| Frozen assets | [vendor] ~$3bn, Binance at 10:55 (opens in a new tab) |
Restricted, not necessarily returned |
| Company funding | [vendor] Over $6.34bn reserved; $5bn already in matching token assets, Binance (opens in a new tab) |
Separate cover, excluding frozen/protected assets; $5bn is a subset |
| Attacker native-asset holdings | [reported] More than 420,000 ETH and 18,270 BTC, worth about $2.4bn, TRM (opens in a new tab) |
Selected holdings at 00:30, not the entire remainder or net loss |
Binance’s 10:55 update says purchases of remaining replacement tokens through market and OTC channels were still underway. It says recovery has begun but gives no quantified amount returned. Its earlier commitment names SAFU and company funds; neither statement discloses an exact SAFU balance or drawdown. Promised coverage and matching-asset purchases do not prove completed 1:1 restoration. [vendor] (funding (opens in a new tab), commitment (opens in a new tab)).
Earlier issuer originals corroborate freezes: Tether’s CEO reported more than 1.567bn USDT, and Circle’s CEO more than 800m USDC. WLFI and BitGo confirmed targeted action without amounts in their retrieved originals. These overlapping response figures are not additional sums on top of Binance’s later total. [vendor] (Tether (opens in a new tab), Circle (opens in a new tab), WLFI (opens in a new tab), BitGo (opens in a new tab)).
Early estimates also covered different scopes. Blockaid valued the first Ethereum basket at about $2.5bn and later cited at least $5.5bn across chains; Chainalysis initially reported $5.912bn, while its CEO later cited about $6.4bn. No shared transaction-and-price ledger was obtained that reconciles every change. [reported] (Blockaid (opens in a new tab), Chainalysis (opens in a new tab), Jonathan Levin (opens in a new tab)). Subtracting a freeze estimate from gross impact would not establish final net loss. [inferred]
Ten reported networks, with later outflows beyond the first burst
TRM valued each transfer at the asset price when taken. Its rounded network figures support about $6.36bn, not cent-precise accounting. Every row below is [reported], not independently reproduced across all networks (TRM accounting and FAQ (opens in a new tab)).
| Reported network | Quantity or scope | Approximate transfer-time value |
|---|---|---|
| Ethereum | 200,630 ETH and 185 other tokens | $3.79bn |
| Bitcoin | 18,270 BTC | $1.47bn |
| Tron | 612.7m USDT and 46.4m TRX | $628m |
| XRP Ledger | 233.46m XRP from five wallets | $296m |
| Solana | 970,500 SOL | $96m |
| Arbitrum | Includes 74.6m ARB | Shares $39m subtotal below |
| Optimism | No separate quantity supplied | Shares $39m subtotal |
| Base | No separate quantity supplied | $39m combined with Arbitrum/Optimism |
| Avalanche | No quantity supplied in accounting paragraph | $28m |
| Polygon | No quantity supplied in accounting paragraph | $10m |
The $39m subtotal covers Arbitrum, Optimism and Base together. Ethereum’s network-wide amount exceeds the first sweep’s basket; TRM values the 233.46m XRP at about $296m. These values use TRM’s valuation basis rather than an independently reconstructed price series (TRM (opens in a new tab)).
TRM places XRP transfers at 20:05–20:09 UTC, with Solana and Optimism following shortly after 20:10. Bitcoin moved at about 20:20; Tron followed within two minutes. It does not establish identical 20:10 starts for Arbitrum and Base. Most funds moved in roughly twenty minutes, not all outflows: TRM reports subsequent Ethereum sweeps through 23:56 and a later Avalanche/Polygon wave around 23:05. Avalanche also appears in descriptions of earlier activity; the retrieved reports do not allocate its dollar total between waves. [reported] (TRM (opens in a new tab), Blockaid (opens in a new tab)).
Arbitrum forced custody; native holdings remained a snapshot
Arbitrum’s Security Council says it intervened at 00:08 UTC on 30 October, moving 8,425 ETH and 74,559,805.2 ARB from an exploit-linked address into custody at 0x0000000000000000000000000000000000000DA0. Release requires an ArbitrumDAO governance vote. The Council describes an emergency Inbox upgrade, forced cross-chain transfers and restoration of the original implementation. This was protocol-level forced custody on Arbitrum One, not an issuer blacklist of native ETH. [vendor] (Council announcement (opens in a new tab), linked Ethereum action (opens in a new tab)).
TRM valued that intervention at about $30m and included it in its earlier ~$2.7bn frozen tally. Its 8,426 ETH figure differs from the Council’s original; the Council quantity is used here. Binance does not itemize its later ~$3bn freeze ledger. Arbitrum’s action is therefore not an additional $30m to add to that total, and the sources do not establish completed return to Binance or liquidity pools. [reported] (TRM (opens in a new tab)); [vendor] (Binance (opens in a new tab)).
TRM’s 00:30 snapshot reports more than 420,000 ETH and 18,270 BTC worth about $2.4bn, plus smaller holdings elsewhere. That is not the complete unfrozen remainder. Some native assets were stolen directly; TRM also traces stablecoin sales through intent-based contracts and collateralized borrowing. It describes OTC laundering as an expected next stage, not proof every conversion already occurred OTC. Native ETH and BTC lack token-issuer blacklist controls, but that does not establish immunity from every intervention or seizure mechanism. [reported] (TRM holdings and laundering analysis (opens in a new tab)); [inferred] (Arbitrum intervention (opens in a new tab)).
Ethereum records delegation, a separate sweep and code clearing
The retained 13:03 UTC check queried transactions, receipts, execution traces and historical account code through dRPC (opens in a new tab). PublicNode (opens in a new tab) independently matched the pinned block hash and empty code. This was a two-service check, not local-full-node or state-proof verification; explorer ownership labels remain off-chain attributions.
For account 0x28c6c06298d514db089934071355e5743bf21d60, the measured sequence is:
| UTC | [reproduced] observation |
|---|---|
| 29 October 20:20:59 | Type-4 transaction (opens in a new tab) installs delegation to 0x63e8…6fae, block 26,300,753 |
| 29 October 20:24:23 | Separate call (opens in a new tab) executes sweep, block 26,300,770 |
| 30 October 00:10:35 | Zero-address authorization (opens in a new tab) clears code, block 26,301,896 |
| 30 October 13:03:11 block timestamp | Code remains 0x at pinned block 26,305,745 on both (opens in a new tab) services (opens in a new tab) |
The sweep’s internal trace transfers 167,464.247856558836135296 ETH to on-chain recipient 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c. Its receipt records 1,615,409,498.973240 USDT, decoded with six decimals. There are 63 matching ERC-20-style transfer logs, including one from USDT. The outer transaction’s value is zero; native ETH moved during internal execution. [reproduced] (transaction (opens in a new tab), trace/receipt RPC (opens in a new tab)).
EIP-7702 (opens in a new tab) makes delegation persistent until replaced or cleared. Authorization and execution are distinct operations; here they occurred 204 seconds apart, although the protocol permits both in one transaction. The installation carried 50 descending-nonce authorizations. Blockaid reports one matched and describes hardcoded-operator restrictions in the sweeper. Those findings remain [reported]: this check did not independently decompile the contract or recover every signature (Blockaid nonce analysis (opens in a new tab), contract analysis (opens in a new tab)).
Code was delegated immediately before block 26,301,896 and empty at that block and the later pinned state. Code clearing is not key rotation, does not reverse transfers and does not certify signer security. [inferred] (revocation (opens in a new tab), specification (opens in a new tab)).
Signing infrastructure is a hypothesis, not a disclosed architecture
Binance’s initial post, last edited at 02:25 UTC, suggests a compromised DevOps laptop allowed container access and unauthorized withdrawal submissions. At 08:47 it reported additional points of breach. Its statement that investigators found no evidence of wallet-key leakage is not proof no key leaked. [vendor] (initial findings (opens in a new tab), later update (opens in a new tab)).
TRM considers attacker-chosen signing through Binance’s hot-wallet system the most likely explanation for ordinary signed transfers across different chains and signing schemes. That assessment does not identify a specific API, HSM or internal topology. Different schemes do not uniquely distinguish signer-service abuse from stolen signing material or compromised approvals. [reported] and [inferred] (TRM assessment (opens in a new tab)). EIP-7702 explains the Ethereum execution path, not the entire multichain intrusion or a demonstrated signature-verification bypass (EIP-7702 (opens in a new tab)).
TraderTraitor attribution has distinct confidence language
TRM attributes the attack to North Korea’s TraderTraitor with high confidence, citing on- and off-chain intelligence. It compares advance staging, funding and execution patterns with earlier operations, while noting laundering differences from Bybit. Chainalysis CEO Jonathan Levin calls TraderTraitor involvement likely because of links to a previous hack. [reported] (TRM (opens in a new tab), Levin (opens in a new tab)).
TRM does not disclose its underlying off-chain intelligence sufficiently to reproduce the identity assessment. Binance says law-enforcement partners are working to confirm identities. No incident-specific official determination was obtained in this research; that is not a claim none exists. [vendor] (Binance (opens in a new tab)).
Historical service updates do not establish live reopening
Binance’s post last edited at 02:25 UTC described temporary suspension of deposits and withdrawals. At 04:36 UTC, Binance said deposits operated normally and withdrawals remained paused. Its 08:47 UTC update again described deposits as unaffected and withdrawal resumption as prospective. The updates give no exact deposit reopening time. [vendor] (02:25 (opens in a new tab), 04:36 (opens in a new tab), 08:47 (opens in a new tab)).
A fresh-context Playwright check at 13:31 UTC rendered Binance’s network-status page (opens in a new tab), with HTTP 202, column headings and “No records,” but no usable status rows. The displayed last-update label was 27 October, without a timezone. Earlier direct retrieval encountered a WAF challenge. Neither observation establishes current deposits, withdrawals, downtime or rate limiting. Browser rendering did not resolve live status. [reproduced]
Binance promised a detailed technical postmortem and updated Proof of Reserves. No completed post-incident deliverable or quantified returned-assets reconciliation was obtained here. [vendor] (initial promise (opens in a new tab), funding update (opens in a new tab)).
The Ethereum delegation, sweep and code clearing are observed events, beyond hypothesis. The public evidence does not yet establish the full intrusion route, final net loss or completed restitution. Removing delegated code confirms one containment step, not resolution of the entire breach. [inferred]
Sources
- Binance, 30 October 2026: initial findings, last edited 02:25 UTC (opens in a new tab), service update, 04:36 (opens in a new tab), investigation update, 08:47 (opens in a new tab), funding update, 10:55 (opens in a new tab).
- TRM investigation (opens in a new tab), observations as of 30 October 00:30 UTC; Arbitrum Council announcement (opens in a new tab), 30 October 2026.
- Blockaid report (opens in a new tab), 29 October; Jonathan Levin (opens in a new tab), 30 October.
- EIP-7702 (opens in a new tab), Final; dRPC (opens in a new tab) and PublicNode (opens in a new tab), read-only checks approximately 13:03 UTC; Binance status page (opens in a new tab), browser check 13:31 UTC, 30 October 2026. Issuer originals and transaction references are linked beside the findings.
