Hackers emptied about $6.36 billion from Binance’s wallets on Thursday, and the part that has been recovered so far came from four companies that can freeze a token with one command. Add up the freezes the blockchain-tracing firm TRM Labs logged and the total is about $2.66 billion, or 42% of the haul.
That figure is ours, and the arithmetic is short. Tether froze about 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD and World Liberty Financial 27.8 million USD1, which adds up to $2.663 billion against $6.36 billion. Binance puts its own frozen total at $3 billion and has not said what it counts, so we used the itemized number.
Now subtract the $3.4 billion in stablecoins TRM itemizes on Ethereum and Tron. About $2.96 billion is left, roughly 47% of the theft, in ether, bitcoin, XRP and solana, which no company can freeze. TRM says the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion.
Four Hours, Ten Blockchains
TRM’s timeline starts at 20:05 UTC, 4:05 p.m. Eastern, when five Binance XRP wallets sent 233.46 million XRP to one address. The last Ethereum sweep it logged landed at 23:56 UTC, 3 hours 51 minutes later.
In between, a Bitcoin hot wallet sent out 18,270 BTC and a Tron wallet sent 612.7 million USDT. Ten blockchains were hit in all.
The Ethereum wallet is the part that drew attention. The attacker used EIP-7702, a feature from Ethereum’s 2025 Pectra upgrade that lets a wallet hand its behavior to a smart contract. Pre-signed authorizations pointed Binance’s hot wallet at a contract that obeyed only the attacker, and it emptied the wallet 3 minutes 24 seconds after the transaction went in.
That is the clever half of the story, and it is the smaller one. By TRM’s account the other nine chains were drained with ordinary signed transfers, no delegation trick at all. Another Ethereum hot wallet sent out 28,006 ETH the same plain way.
TRM reads that as evidence the attacker could get Binance’s signing system to sign whatever it wanted. The attacker had also prepared for a day and a half, funding an operator wallet with three small Tornado Cash withdrawals on October 28 and rehearsing the final code on a third wallet about four hours before the real thing.
Binance’s Explanation Has Changed Three Times
Binance’s first account, as NBC News reported it, was a compromised laptop that let an attacker reach a service container and submit unauthorized withdrawals. The company also said user funds are safe and that it will cover every loss.
Later on Friday it said it had found “additional points of breach.” Co-CEO Richard Teng then called it a more complex attack than a single action, and said the delegation over the hot wallet, in the words of Cointelegraph’s live coverage:
did not pass through our normal approval controls
That sentence is the whole story. Binance runs one of the largest custody operations in finance, and a wallet holding more than a billion dollars of one token could be redirected without tripping the approval step that exists to stop exactly this.
We do not think “a laptop was compromised” explains a loss across ten chains, and Binance’s own revisions show the first account was incomplete. An engineer’s machine may be how the attacker got in. The failure, by Teng’s own description, is that the approval step never caught a sweep of that size.
What Customers Can Do While Withdrawals Are Paused
Binance says user funds are safe and that it will cover the losses, so nothing here is a reason to panic. The pause is still a reminder of what an exchange balance is: a promise from the exchange to hand your money back when you ask.
Finance YouTuber Andrei Jikh posted that walkthrough the day after the theft, and the practical half of it is ordinary account hygiene worth doing this weekend. His steps:
- Keep only what you are actively trading on an exchange, and spread it across more than one. No exchange is too big to be the only place you hold funds.
- Turn on every security feature the exchange offers, and use an authenticator app or a physical security key for two-factor login, not text messages.
- Switch on withdrawal address whitelisting, so funds can only be sent to addresses you have approved.
- Expect scams. Fake support messages and fake compensation forms follow every major hack, and no legitimate company will message you first to help you recover money.
- Never copy a wallet address from your transaction history. Scammers send tokens from lookalike addresses hoping you will paste the wrong one.
- If you buy a hardware wallet, buy it from the manufacturer, never used and never from a marketplace seller, and back up the recovery phrase, because nobody can recover it for you.
He also makes a point we think matters. The companies behind Tether and Circle froze billions of dollars within an hour of the first transfer, and he notes that the same button works on any holder.
That power went to work against a thief this time. We think stablecoin holders should know it exists, and that it comes with USDT and USDC rather than being an exception to them.
What Binance Owes Its Users Before Sunday
Markets took the hit quickly. BNB fell about 8% to near $693 and bitcoin dropped under $77,000, with the Fear and Greed Index sliding to 30. Binance says it has set aside more than $6.34 billion in company funds to make customers whole, and former CEO Changpeng Zhao, a shareholder, says he expects every user to be covered.
Withdrawals are frozen, and Binance says it aims to restore them in phases by Sunday. The full proof-of-reserves report is not due until Monday.
We think that order is backwards. Binance should publish what failed, and show that the money it says it holds exists, before it asks customers to trust the wallets again. “User funds are safe” is a statement about Binance’s balance sheet. It is not a statement about the controls that just failed.
Nor is this a one-off. As LNC reported in July, about $942 million was stolen across all of 2026 through mid-July, including the $285 million Drift Protocol loss that TRM traced to a months-long social engineering campaign. One Binance afternoon is nearly seven times that, and about four times the $1.5 billion Bybit theft that held the record until Thursday.
Attribution is still an assessment, not a finding. TRM says with high confidence that the North Korean group TraderTraitor did it, and Chainalysis chief executive Jonathan Levin called that the likely answer, citing links to an earlier hack. No government has said so on the record, though the FBI named the same group over Bybit.
The next test is quieter than the first. The attacker is holding about $2.4 billion in assets that cannot be frozen, and TRM expects it to push them through bridges, swap services and over-the-counter brokers. Whether those desks ask questions will decide how much of Thursday’s 47% stays gone.