Binance $6.3B breach recovery remains complex. Binance promised to cover every customer loss. The exchange estimates the incident affected $6.3 billion.
Why the Binance $6.3B breach matters
Partners have frozen roughly $3 billion. However, that freeze is not a full refund. Therefore, recovery involves several separate processes.
Binance says a compromised DevOps engineer’s laptop may have caused the breach. Specifically, that laptop may have allowed access to an internal service container. It may also have allowed unauthorized withdrawals.
Binance found no evidence that wallet private keys leaked. It revoked the affected address authorization. It also involved law enforcement. Furthermore, it promised a technical report after investigators finish.
Blockchain investigators published separate accounts. Their figures describe different stages. For example, some count assets when they left Binance. Others describe assets later frozen.
Consequently, the $3 billion freeze sits beside the $6.3 billion estimate. Binance has not called $3 billion money already returned. It also has not published a final loss accounting.
How the Binance $6.3B breach moved across networks
TRM Labs traced the main burst. It began around 20:05 UTC on October 29. Most stolen funds moved within about 20 minutes. TRM’s investigation covers 10 networks. A later wave reached Avalanche and Polygon.
TRM values assets at each transfer time. Binance’s $6.3 billion figure is its own impact estimate. Therefore, the difference does not prove another theft.
TRM attributes the attack to North Korea’s TraderTraitor group. Binance has not confirmed the attacker’s identity. Thus, the attribution remains an investigator assessment.
The incident links to a hacking unit identified in the February 2025 Bybit theft. However, technical attribution and criminal findings are separate stages.
The transfers involved assets with different recovery options. Dollar tokens can have issuer controls. In contrast, native Bitcoin and Ethereum do not offer comparable blacklist powers.
An address in the tracing record can be a lead. It is not automatically a recoverable balance. Investigators can follow public transfers. However, observation does not grant reversal authority.
Binance $6.3B breach: frozen funds differ from returned funds
Binance says about $3 billion has been frozen. A freeze restricts movement. Recovery requires a further step. That step returns value to the owner or an agreed address.
Using rounded figures, $3 billion is about 47.6% of $6.3 billion. The remaining difference is $3.3 billion. That is 52.4% of the initial estimate.
Those figures describe Binance’s two announced numbers. They do not prove $3.3 billion is gone forever. They also do not prove frozen funds can immediately reimburse customers.
The denominator can change as investigators identify transfers. They may remove double counting or update prices. The numerator can change as issuers locate more tokens.
TRM’s early account put frozen or secured assets near $2.7 billion. That was below Binance’s later estimate. Its figures were a dated snapshot. Therefore, do not add them to Binance’s total as separate pools.
The same caution applies to issuer announcements. A Tether freeze and a Circle freeze can be components of Binance’s aggregate. Adding both to the exchange total could count assets twice.
Stablecoins exchanged before an issuer acted add another complication. An issuer can block its token. However, its controls do not follow the holder into another native asset.
Recovery accounting therefore needs token balances and status. Assets identified and assets immobilized are different. Assets in recovery custody and assets used for customer balances are also different.
One Ethereum authorization changed a hot wallet’s power
Blockaid investigated an attack on Binance 14. That is a busy Ethereum hot wallet. A transaction contained 50 EIP-7702 authorizations. One matched the account’s transaction counter. It activated a delegation to malicious code.
The attacker then used the delegated wallet. It transferred a large basket of assets. It also reached another smart account controlled by that wallet. The malicious delegation could remain useful for later deposits until removed.
EIP-7702 describes persistent delegation. It is not permission that necessarily disappears after one transaction. The specification warns that delegated code has unrestricted account access. Wallet providers must audit it closely.
Therefore, removing the affected authorization belongs in the response. A customer-interface pause and an on-chain delegation removal address different parts. Both matter.
Blockaid describes other transfers as ordinary signed transactions. Those came from wallets on several networks. Its findings do not prove every dollar left through Ethereum. A single Ethereum feature cannot explain Bitcoin or Tron transfers alone.
Binance’s statement and the investigators’ account address different questions. The exchange describes a possible route into its systems. Researchers describe what authorized transactions did on-chain.
The full investigation must connect those stages. Binance found no private-key leak. However, that does not mean every approved transaction was intended.
SAFU and company funds back the promise
Binance will use its Secure Asset Fund for Users and company resources. It has not said SAFU alone will absorb the incident.
SAFU’s earlier Bitcoin conversion finished in February. Binance reported 15,000 BTC worth about $1.005 billion then. That was a historical balance and valuation. It was not an October statement of available insurance.
Even a hypothetical $1 billion fund covers only 15.9% of $6.3 billion. Subtracting $1 billion leaves $5.3 billion. However, that arithmetic is not the actual funding gap. Recoveries and the current fund balance remain separate inputs.
Therefore, the company-funds pledge is part of the promise. Customers have been told Binance will bear the loss. They have not been told to wait for every stolen token.
The pledge does not identify the precise mix of resources. It does not set timing for issuer-controlled recoveries. It also does not explain accounting for frozen balances.
Customer reimbursement and Binance’s net loss can move on different schedules. Binance can replace a missing customer asset from its own resources. It can pursue recovery afterward.
If an issuer later returns an asset already replaced, that affects Binance’s exposure. It should not count as a second reimbursement of the same loss.
Reserve update will provide a dated view
Binance promised an updated proof of reserves after remediation. Its August snapshot reported 100.25% ratios for Bitcoin and Ethereum. USDT had a higher ratio.
An August ratio cannot establish backing after an October incident. Customer balances and reserve holdings need measurement at the new date.
Reserve systems compare covered assets with covered customer balances. They do not automatically include every corporate liability. They also do not prove controls work continuously between snapshots.
A ratio above 100% means included assets exceed included customer balances. It does not measure withdrawal-system quality. It also does not show how an attacker obtained valid authorization.
Therefore, the reserve update and technical post-mortem serve different purposes. The first documents backing at a stated time. The second should explain the compromise and fixes.
The same asset should not appear as both free withdrawal liquidity and immobilized recovery property. Frozen tokens may keep a quoted value. However, customers cannot withdraw them normally.
Reimbursement timetable remains open
Binance’s strongest response is its commitment to cover all losses. SAFU and company funds back that promise. The reported freezes give recovery an identified asset pool.
Neither commitment supplies a final loss figure. Binance has not published a full reconciliation. That reconciliation should cover stolen assets and frozen balances. It should also cover returned assets and company resources.
The public record also contains changing operational status. The initial notice described a deposit and withdrawal pause. Later reporting described deposits as operational. Withdrawals remained subject to security work.
Each notice belongs to its publication time. A customer’s withdrawal ability depends on the current network notice. It does not depend on another network’s status.
A resumption estimate is a company target until service returns. It is not a universal customer deadline. Binance’s examined statement does not impose a universal withdrawal window.
Technical report will address the preliminary entry point
The compromised-laptop reference remains preliminary. Binance identifies a possible path from an engineer’s device. It does not yet publish a complete explanation of every authorization.
Blockaid’s analysis offers evidence about Ethereum execution. TRM’s investigation covers transfers and attribution across more networks. Their work does not replace Binance’s internal access-control account.
Finally, Binance.US said its operations were not affected. That is a separate American affiliate.
Key takeaway
Binance $6.3B breach recovery has two different totals. About $3 billion is frozen. That is not $3 billion returned. Binance promises to cover customer losses with SAFU and company funds. However, a final reconciliation remains pending.
