$6.3 billion Binance hack: What failed, who pays, and what customers should check

The international journey of money is acquiring routes that bypass much of the banking system. Crypto assets can pass between digital wallets over blockchains (shared electronic ledgers that record ownership and transfers). Stablecoins, which aim to track currencies such as the US dollar, are bringing this technology into remittances and business payments. The scale is already substantial: the IMF estimates that gross cross-border flows in USDT and USDC (two major stabelcoins) reached $316 billion in the first quarter of 2025.

For many users, however, access to this technology begins with entrusting their assets to a crypto exchange. Money that can travel across a decentralised network is consequently held under the control of a single company. That concentration makes the company’s security consequential for everyone whose assets it holds. Blockchain intelligence firm TRM Labs estimates that crypto hacks have caused cumulative losses of about $28 billion, including the latest Binance theft (on October 29, 2026).

Binance puts the amount stolen at approximately $6.3 billion and has pledged to absorb the losses. Its ability to replace the assets and restore withdrawals will determine what that commitment means for customers. The breach also demands an explanation of how an exchange authorises the movement of money and how attackers managed to turn that authority to their advantage.

The starting point is the relationship between the balance a customer sees on an exchange and the assets available to honour it. Here is an explainer:

What is the incident in question?
Binance, the largest international crypto exchange, reported a cyberattack in which approximately $6.3 billion worth of crypto assets was stolen from its wallets. The unauthorised transfers began around 1.35 am IST on October 30, 2026. The exchange suspended withdrawals for security checks and said it would cover the losses using its emergency fund and company resources.

What exactly was attacked?
An exchange typically records customer balances in its own accounts while managing assets through wallets used for many customers. A customer’s displayed balance can therefore remain unchanged even when assets backing those balances have been stolen.

The Binance attack involved hot wallets, which are connected to the internet to facilitate withdrawals. TRM’s reconstruction places the start at 1.35 am IST on October 30. It estimates that most of the theft occurred within about 20 minutes, with further transfers later.

Estimates vary. TRM calculates $6.36 billion at prices prevailing when assets were taken; Elliptic estimates $6.43 billion. Binance’s approximately $6.3-billion figure remains its own estimate of the incident’s impact.

How could the cyber attackers authorise withdrawals?
Binance initially identified a potentially compromised laptop belonging to an engineer involved in running its systems. Its subsequent investigation found additional breach points. The company says it has found no evidence of leaked wallet private keys. The complete intrusion sequence remains unresolved.

A private key enables a wallet to produce the digital signatures needed to authorise transactions. An attacker who can make a legitimate signing system approve malicious instructions may not need to extract the key itself.

TRM’s analysis points to that possibility. On Ethereum, attackers used EIP-7702, a feature allowing a wallet to execute delegated software after signing an authorisation. They obtained authorisations that installed malicious instructions capable of draining the wallet and sweeping subsequent deposits. Other affected networks processed ordinary signed transfers, leading TRM to assess that Binance’s hot-wallet signing infrastructure had been compromised.

The reported evidence concerns control over wallets and signing systems. It does not establish that Bitcoin’s or Ethereum’s underlying ledger was broken. A valid signature can satisfy a blockchain’s rules even when the instruction was obtained through an attack.

Who is suspected?
TRM attributes the attack with high confidence to TraderTraitor, a North Korea-linked hacking operation. Its October 30 assessment says no government had yet formally attributed this theft. That remains an assessment by investigators, rather than an official finding about this attack.

The FBI previously attributed the approximately $1.5-billion Bybit theft of February 2025 to TraderTraitor. Binance’s reported loss is about four times that amount.

Will customers bear the loss?
Binance says it will cover the theft through its Secure Asset Fund for Users, or SAFU, and corporate resources. In its October 30 update, it reported setting aside more than $6.34 billion, including $5 billion already held in the affected token assets — approximately 80 per cent of the amount to be replaced. It said it was buying the remaining tokens. Matching the assets matters. A customer owed Bitcoin needs backing in Bitcoin; holding an equivalent dollar value in another asset leaves the exchange exposed to price changes while it makes the replacement. Binance’s undertaking must therefore be assessed through asset backing and withdrawal availability, alongside its announcements.

Why can some stolen assets be frozen?
Certain token issuers retain powers to block transfers involving their tokens. Native Bitcoin and Ether (a crypto asset like Bitcoin) have no issuer with an equivalent power to freeze balances on their underlying networks. This helps explain attackers’ efforts to convert stolen stablecoins into other assets.

Binance reports approximately $3 billion frozen. Elliptic independently identified $2.84 billion in frozen assets in its October 30 analysis; stablecoins accounted for 94 per cent of that amount. These are separately sourced estimates.

Freezing restricts an attacker’s ability to move assets. Returning them requires further recovery steps and legal or issuer processes. The frozen amount cannot simply be deducted from the theft and described as money already recovered. Nor can a customer assume that a publicly visible transaction can be reversed on request.

What will proof of reserves establish?
Binance has targeted November 2 for an updated proof-of-reserves publication. Such disclosures can help customers examine whether reported holdings back their balances.

Their scope requires scrutiny. A snapshot must be assessed for the liabilities included and any claims against the assets shown. The US Public Company Accounting Oversight Board’s investor advocate has warned that proof-of-reserves reports are not financial statement audits and may omit liabilities or fail to reveal borrowed assets. They also provide no assurance about the effectiveness of security controls.

The financial and technical examinations consequently answer different questions. Establishing that replacement assets are present does not establish how the breach happened or whether the compromised access has been removed.

Does cold storage or self-custody solve the problem?
Keeping keys offline reduces exposure to online attacks. When assets are transferred, the instructions approved during that process still require protection. Customers need to understand who controls their keys and how transactions are authorised.

Self-custody transfers that responsibility to the individual. Chainalysis estimated $713 million stolen through personal-wallet compromises in its 2025 assessment, published that December. Moving assets to a personally controlled wallet therefore requires competence in securing keys and recovery information. Losing that information can permanently remove access.

What does this mean for Indian users?
India has already experienced a major custody breach: Elliptic estimated approximately $235 million stolen from WazirX (an Indian exchange) on July 18, 2024. That precedent makes withdrawal access and the treatment of customer claims practical concerns for Indian investors.

Financial Intelligence Unit (FIU-IND) of the Union Ministry of Finance’s registration places relevant crypto service providers within India’s anti-money-laundering reporting framework. It should not be read as a guarantee against theft or reimbursement of losses. The Finance Ministry has itself warned that there may be no regulatory recourse for losses from crypto transactions. Customers must examine the entity holding their assets and the terms governing recovery.

What should customers do now?
Binance’s October 30 update proposed phased withdrawals after security checks; deposits and unaffected services remained operational. Reopening targets remain conditional until withdrawals actually work.

Customers should retain account statements and transaction records, check notices through the exchange’s official app or website and avoid unsolicited recovery offers. Two-factor authentication helps protect an individual login; it cannot correct a breach of an exchange’s signing systems. No recovery agent should be given a wallet’s private keys or recovery phrase. US consumer-protection authorities have specifically warned about scammers offering paid help after exchange losses.

For customers assessing any exchange, the useful questions are specific: who can approve a transfer, how unusual withdrawals are stopped, and what resources are available if assets are stolen. The exchange should explain those arrangements and make its financial backing open to scrutiny. Customers should be able to assess that evidence before depositing money, rather than having to seek it after withdrawals stop.