Binance says $6.34B set aside after hack

Binance says it has set aside more than $6.34 billion following the theft of about $6.3 billion from its hot wallets. Its second incident update, dated October 30, adds a replacement-asset breakdown and a conditional timetable for restoring withdrawals.

Company funds and frozen assets are different figures

According to Binance, $5 billion is already held in the affected tokens, roughly 80% of the stolen amount; it is buying the balance through market and OTC channels. The exchange also reports about $3 billion frozen on-chain.

These figures describe different things. Company funds finance replacement assets; freezes restrict movement of stolen assets. Adding them together would not establish how much has been recovered. Holding replacement tokens also differs from having the same dollar value in other assets: token quantities matter when customer balances are denominated in cryptocurrency.

Withdrawals and the reserves report

In that update, withdrawals remain suspended while deposits and unaffected services operate. Binance targets a phased withdrawal restart within approximately 34 hours of the announcement, subject to security checks. It plans a reserves snapshot within 12 hours and results by November 2.

These are announced targets, not confirmation of reopening or a completed reserves check. A dollar-denominated compensation commitment, available assets and a functioning withdrawal service are separate questions. The next report must be read against its snapshot date rather than treated as a real-time account of every subsequent movement.

The investigation extends beyond the laptop theory

Binance says it found additional breach points after initially suspecting a compromised laptop. It reports no evidence of leaked wallet private keys and aims to release verified technical findings within about 48 hours. The full root cause remains under investigation.

TRM Labs assesses that the attacker likely gained access to the hot-wallet signing infrastructure across multiple chains. Its Ethereum analysis describes EIP-7702 authorizations delegating wallet behavior to attacker-controlled code, alongside ordinary signed transfers on other networks. This is TRM’s assessment, not Binance’s final technical conclusion; valid signatures alone do not establish that private keys were copied.

Chainalysis attributes the theft to the North Korea-linked group TraderTraitor, citing stolen Binance funds commingling with assets from the earlier Bitget theft. It also describes thousands of transfers and repeated funding patterns suggesting automated laundering. Attribution belongs to the named investigators; it is not a finding independently established here.

What the next updates need to establish

The remaining questions are whether withdrawals actually reopen, whether the required replacement assets are acquired, and what the published reserves snapshot shows. A complete incident report must also distinguish the initial entry point from the permissions that enabled withdrawals across networks.

Recovery is a separate track. A freeze can preserve an opportunity to recover assets, but return requires further action. New reports should distinguish assets traced, assets immobilized and assets actually returned, and state when each figure was measured.

Primary sources: Binance: Security Incident Update #2, October 30, 2026 · TRM Labs: on-chain analysis of the Binance theft · Chainalysis: latest findings and attribution