Crypto: Binance had $6.3 billion stolen, what happens to its customers?

6.3 billion dollars. I reread the figure twice. Thursday evening, October 29, around 9:20 p.m. Belgian time, someone started emptying the wallets of Binance, the biggest crypto exchange platform in the world. Most of it was gone in about twenty minutes, across ten different blockchains, according to investigative firm TRM Labs. Binance itself gave the amount. The previous record was Bybit in February 2025 with 1.5 billion dollars. This is more than four times as much!

So naturally, if you have crypto at Binance, there's only one question running through your head: is it my money that's gone?

The cash register was emptied, the safe remained closed

First, your balance hasn't changed

Short answer: no. Binance announced that it would cover all the losses with the company's money, and its co-head Richard Teng said on Friday that he had set aside more than 6.34 billion dollars, including 5 billion already held in the cryptocurrencies that were stolen. There's also SAFU, a kind of emergency fund that Binance has been feeding since 2018 precisely for this kind of catastrophe. It weighs in at around 1.2 billion according to CNBC, so it isn't enough on its own: the rest comes out of Binance's pocket. A billion-dollar piggy bank that isn't enough, we don't get that kind of problem every day!

What gets stuck is the exit. Since Friday 12:13 a.m. (universal time), withdrawals have been blocked. Deposits, on the other hand, are working normally again. Binance is aiming to resume withdrawals this Sunday, November 1, in stages, and is promising proof of reserves for Monday, that is to say a public statement showing that it really holds enough to return to each customer what appears in their account. Careful, this is a goal, not a date set in stone: the resumption depends on the security checks.

A cash register emptied, not the safe

A platform like Binance stores its customers' money in two places. The vast majority sleeps in "cold" wallets, completely disconnected from the Internet: that's the bank's safe. A small part remains in "hot" wallets, permanently connected, because you do need to be able to pay out the day's withdrawals without going and opening the safe every five minutes: that's the store's cash register.

It's the cash register that was emptied. A 6.3-billion-dollar cash register, yes, but when you manage the money of hundreds of millions of customers, the day's cash register is big. Binance says that the customers' money stored in cold wallets was not touched.

A laptop and a power of attorney

How do you empty a cash register like that? Binance's initial findings point to the laptop of a "DevOps" engineer, the person who looks after the machines and servers that run the site. From this laptop, the hacker allegedly reached an internal service capable of sending withdrawal orders. Except that on Friday, the investigation found "other entry points", and Richard Teng spoke of "a complex attack", carried out by more than one person. The hacker did not "simply use the rights of a single engineer", he said. No secret wallet keys are thought to have leaked.

And then there's a detail that made me sit up. To empty the main wallet on Ethereum, the hacker used an official Ethereum function, added in May 2025 and called EIP-7702. Basically, it lets an ordinary wallet hand over its actions to a small program, a bit like when you sign a power of attorney so that a relative can handle things on your behalf. Handy for grouping several payments into one. Except that here, the power of attorney was signed in favor of the hacker, without going through Binance's usual checks, and the small program grabbed everything in one go, then self-destructed to erase the traces.

A signed power of attorney, and the program emptied everything in one go

Ido Ben-Natan, head of the security company Blockaid, sets things straight: the hacker could have stolen that money without this feature, it mainly allowed him to sweep everything up in a single go. For him, the real problem lies elsewhere: “in the end, the signing system signed a transaction it should never have signed”. The same pattern as at Bitget last month, where hackers had stolen $387 million without stealing a single key. They no longer break open the safe, they get the right person to sign at the wrong time.

As for the culprit, investigation firms TRM Labs and Chainalysis point, with a high level of confidence, to a North Korean hacking group called TraderTraitor. The same one the FBI had already linked to the theft at Bybit. Binance itself has not named anyone yet.

Three billion frozen, but not the bitcoins

Good news, and it's big: around $3 billion has already been frozen, according to Binance's update on Friday. How do you freeze crypto? It depends which one.

Some of the loot was in “stablecoins”, those tokens that are always worth one dollar, like Tether's USDT or Circle's USDC. They have one particularity: a company issues them, and that company retains control over them. According to their own announcements on October 30, Tether blocked more than 1.56 billion USDT and Circle around 800 million USDC. The frozen tokens can no longer move, and they can even be destroyed and then reissued to return them to the victim, after a court ruling.

Bitcoin and ether, on the other hand, have no boss. Nobody can block them remotely. Investigators track them on the blockchain, which is public, and wait for them to pass through a platform that cooperates. As a result, according to FinanceFeeds' tally, the hacker still controls around $3.3 billion that cannot be frozen, scattered across about forty addresses.

The stablecoins are frozen, the bitcoins made a run for it

And remember the flip side, if you have stablecoins. Tether and Circle have this power to freeze yours too. Here, it is being used to catch a thief, and that's good. But a token that a company can block with one click is not quite the same thing as a bitcoin that you alone control.

Bitcoin took a hit too

Prices didn't like it, obviously. On Friday, October 30 at 3:24 p.m. (New York time), bitcoin fell to $76,300 according to CoinDesk, its lowest level since September 18. BNB, Binance's own crypto, was down 6% at $701 according to CNBC. But Binance is not solely responsible: on the same day, the American tech stock market fell 3.4% and Intel stock crashed 25%. Lots of people were selling, and not only because of the hack.

If you have a Binance account

Three things to know, and they apply to any platform.

• you don't have to do anything to be refunded: Binance covers the loss on its own, with no form or procedure. When withdrawals return, expect delays and queues, everyone will show up at the counter at the same time ;
• scams always arrive right after a hack. In the coming days, you may receive an email or SMS from “Binance” talking to you about a refund, account verification or funds to recover, with a link. It's a trap. Nobody at Binance needs your password, your two-factor authentication code or your recovery phrase ;
• and the old rule of the trade still holds true: an exchange platform is a counter, not a safe. Crypto that you are not moving can sit on a hardware wallet, that little device that keeps your keys off the Internet, bought new and from the manufacturer's website (as I was telling you the day before yesterday with the Keystone affair).

The kind of message that will circulate this weekend, and go straight in the trash

I've always had pretty good confidence in Binance, and I think the company is reacting as it should: a quick announcement, the figures on the table, and 6.3 billion paid out of its own pocket without making customers bear a single cent. Few companies in the world can absorb that without faltering. Now, it will still have to explain to us how a single phone could have gotten this far.

Sources

• CoinDesk, October 30, 2026: Binance uncovers other entry points and aims to resume withdrawals Sunday
• CNBC, October 30, 2026: 3 billion frozen, how freezing works and what happens next
• Cointelegraph: EIP-7702 did not cause the hack, but may have made it worse
• CoinDesk, October 30, 2026: live market coverage
• FinanceFeeds: the blockchain timeline and the Tether and Circle freezes

Article written with the help of Claude Code, proofread and corrected by me.