Binance said on Friday, October 30, that it has reserved more than $6.34B of company funds to cover user losses from Thursday's hack, the largest theft in crypto history. The figure excludes assets that have already been frozen.
What Binance announced
In a post on X, Binance said $5B of that amount is already in its custody, in the exact tokens that were stolen. The rest is being bought through market and OTC channels, a process that "can take longer because some tokens may have low liquidity."
- The reserved funds exclude assets frozen after the attack
- Binance says it has already begun recovering affected assets for users
- The exchange is working with law enforcement, stablecoin issuers and blockchain intelligence firms to trace and freeze more funds
"We will weather this storm," Binance said.
What was taken and from which chains
According to TRM Labs, the attacker moved about $6.36B out of Binance wallets on ten blockchains, most of it in roughly 20 minutes starting at 20:05 UTC on October 29. That is about four times the $1.5B Bybit hack of February 2025.
Chain | Assets taken | Value |
|---|---|---|
Ethereum | 200,630 ETH + 185 tokens, including 1.875B USDT and 823M USDC | $3.79B |
Bitcoin | 18,270 BTC | $1.47B |
Tron | 612.7M USDT + 46.4M TRX | $628M |
XRP Ledger | 233.46M XRP | $296M |
Solana | 970,500 SOL | $96M |
How the attack was executed
On Ethereum, the attacker used an EIP-7702 delegation with 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper contract only the attacker could call. On the other nine chains, Binance wallets sent funds through ordinary signed transfers, which in TRM's assessment points to a compromise of Binance's hot wallet signing infrastructure.
Both TRM and Chainalysis attribute the attack to North Korea's TraderTraitor, the group the FBI named for the Bybit hack. Chainalysis said it watched Binance funds commingle in real time with proceeds of last month's Bitget exploit, which had also been attributed to North Korean actors.
What got frozen and what the attacker still holds
TRM counts about $2.7B frozen onchain as of 00:30 UTC on October 30:
- Tether: about 1.77B USDT
- Circle: about 825M USDC
- Ripple: 40.5M RLUSD
- World Liberty Financial: 27.8M USD1
- Arbitrum Security Council: 8,426 ETH and 74.6M ARB
In the first hours, the attacker sold about 325M USDT to market makers through UniswapX and other intent-based contracts for roughly 122,300 ETH, a discount of more than 10% to market. Another 60M USDT was supplied to Aave to borrow about 19,760 ETH before the protocol froze the affected markets.
The attacker now holds more than 420,000 ETH and 18,270 BTC, about $2.4B in assets beyond any issuer's reach. Chainalysis says thousands of transactions in a short window point to automated laundering, with many addresses receiving exactly 1 TRX before forwarding funds.