By Nitesh
- Binance now says its $6.3B breach involved “additional points of breach,” not only a compromised DevOps laptop.
- About $3B is frozen, and Tether and Circle account for more than 1.567B USDT and 800M USDC of it.
- TRM Labs links the theft to North Korea’s TraderTraitor unit, with most transfers clearing in about 20 minutes across 10 blockchains.
- BNB traded at $702.86, down 6.25%, and bitcoin at $77,608, down 3.03%, on Friday morning UTC.
- Binance’s $1B SAFU fund covers about 30% of the $3.3B that is not yet frozen.
Binance hack losses of $6.3B now trace to more than one entry point. Binance said Friday its investigation found “additional points of breach” beyond a compromised laptop. About $3B is frozen.
The Binance hack bill lands on Binance if its pledge holds. Co-CEO Richard Teng said the Secure Asset Fund for Users and company money will cover every loss. Withdrawals stay paused while deposits work, so customers can send funds in but cannot take them out.
The market is already pricing the Binance hack. BNB fell 6.25% to $702.86 and bitcoin slipped 3.03% to $77,608 on Decrypt’s price feed at 09:37 UTC Friday. One afternoon also more than doubled the $2.87B that TRM counted across nearly 150 crypto hacks in all of 2025.
What changed in Binance’s account of the breach
The first official account of the Binance hack blamed a compromised DevOps engineer’s laptop. That machine let an attacker reach a service container and submit unauthorized withdrawal transactions. Friday’s update widened the story without naming the new entry points.
“Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.”
Binance, investigation update on its official X account, October 30, 2026
Teng went further on X. “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” he wrote. He also said the investigation has not blamed any individual and found no evidence of a wallet private key leak.
How the Binance hack beat the signing layer
An exchange hot wallet holds coins for daily withdrawals. Its private keys sit inside a signing service, and that service signs whatever the withdrawal system hands it. Steal the keys and you own the wallet. Control the request queue and the keys sign for you.
That split explains how two claims can both stand. Teng says no key leaked. Blockaid, a security firm, counted 11 Binance hot-wallet keys signing the outbound transfers, FinanceFeeds reported. Genuine keys signing fake orders is what a captured approval layer looks like.
TRM Labs reached the same point from the chain side. Transfers on 10 networks cleared inside the same half hour, which TRM read as an attacker able to make Binance’s signer approve transactions everywhere at once, The Next Web reported. Preparation began at least 36 hours earlier, funded through Tornado Cash.
This is a different failure from the one TechToken covered in April, when a Google quantum paper put 6.9M bitcoin at risk by 2029 through broken key cryptography. Here the cryptography held. The process wrapped around it did not.
Where the frozen $3B actually sits
Stablecoin issuers did most of the freezing after the Binance hack. Tether froze more than 1.567B USDT and Circle froze 800M USDC, The Hacker News reported. Together that is about 79% of Binance’s $3B figure. The Arbitrum Security Council froze about $30.5M more.
Native coins are harder. Bitcoin and ether have no issuer with a freeze function, so the remaining $3.3B is likely to lean toward assets nobody can lock at the contract level. Binance has not broken that figure down.
A freeze is also not a refund. Frozen tokens do not return to Binance automatically, and each issuer has to release or reissue them. Until that happens, the $3B is a claim, not cash.
Why Asian exchanges will read the Binance hack differently
Recovery from the Binance hack depends on speed from other firms. South Korean investigators previously said Binance froze only 17% of funds flagged after the Upbit Solana hot-wallet hack, which cost 44.5 billion won, about $30M. Binance said it needed verification first.
That record now cuts the other way. Binance needs Tether, Circle, Arbitrum and World Liberty Financial to act on its word, not after a verification queue. Upbit’s operator will notice the asymmetry, and so will Seoul’s investigators.
The Binance hack also fits a run of attacks. Chainalysis says funds from last month’s Bitget attack are being mixed with Binance proceeds. Polymarket paused withdrawals the same day after a third-party compromise cost about $2M.
Traders running bots through tools such as Binance AI Pro should check that no strategy is topping up a venue they cannot exit.
TechToken Take
The freeze headline flatters the Binance hack recovery. Issuers produced roughly 79% of the frozen $3B with a contract call, and the unfrozen $3.3B is the part the industry has rarely clawed back. Our call: the frozen total stalls below $3.5B by the time withdrawals reopen.
The insurance is weaker than it looks. SAFU is a $1B reserve held entirely in bitcoin, so the hack’s own selloff shrinks it: a 3.03% drop trims roughly $30M. Binance will fund most of the gap from its corporate balance sheet, not SAFU.
Our second call: the post-mortem will place the failure in withdrawal approval, not key storage. If Binance names a private key compromise as the root cause, this read is wrong.
What to watch: Binance has said it expects withdrawals to resume within 48 hours, which puts the deadline around November 1. Watch whether the frozen figure clears $3.5B before then, and whether the Binance hack root-cause report names keys or the approval layer.
What's your reaction?
